PHP Foundation releases urgent security update for PHP 8.x addressing two RCE vulnerabilities

The PHP Foundation released an urgent security update for the entire PHP 8.x line on October 21, 2026, to address two remote code execution (RCE) holes; the actual CVSS score is 9.2, not the initially leaked 10.0. The disclosure was accelerated due to a leak on October 20, 2026, which included a proof-of-concept video from a security firm, leading to accelerated PoC development and circulation on October 21, 2026. Wiz Research first discovered the vulnerabilities on August 19, 2026, and reported them to the PHP security team on August 24, 2026.