PHP Project Fixes Critical Flaws

On October 21, 2026, the PHP project fixed two critical remote code execution flaws rated 9.2 on CVSS v4.0. Users must upgrade to PHP 8.5.12 or other patched versions by October 22, 2026. Security researchers reported an exploit attempt on October 17, 2026, before public disclosure.