> ## Content Index
> Fetch the complete content index at: https://securinglaravel.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Laravel Security Notice: Critical PHP Security Release ⚠️
- URL: https://securinglaravel.com/laravel-security-notice-critical-php-security-release/
- Published: 2026-10-21T00:31:52.000Z
- Updated: 2026-10-21T00:31:52.000Z
- Description: [Notice #5] A Critical PHP Security Release is coming very soon - you need to be ready to patch your servers.
- Author: Stephen Rees-Carter
- Tags: Security Notice, Core PHP

Two **CRITICAL** security vulnerabilities will be patched in PHP on **Wednesday 21st October at 2pm UTC** (Midnight AEST, 10am US Eastern, 7am US Pacific, 3pm UK) . No details have been provided beyond an announcement that the patches are coming - [as per the official announcement](https://www.php.net/archive/2026.php?ref=securinglaravel.com).

> The PHP security team would like to give advance notice of an **upcoming security release.** 
> **It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.**  
> It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2.  
> All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available.  
> We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.  
> Full details, affected versions, and the fixed versions will be published with the release.  
> Thank you for helping us keep PHP secure.

No details have been released yet - to prevent exploitation until patches are available, so unfortunately all we can do wait and get ready to patch things. I don't know any details, but given they brought it forward due to the announcement leaking out early, this is likely to be a bad one. It affects version 5 onwards, so you unless you're still on PHP 4, you will be affected by this in some way. I'll update this article once the details are released.

The [Laravel Team](https://x.com/taylorotwell/status/2112666246659629104?ref=securinglaravel.com) have already confirmed they are working on how best to deploy patches quickly to Cloud, Forge, and Vapor. 

If you host your apps elsewhere, check in with your hosting providers and your ops teams to make sure they are aware and prepare your update procedures.

**The** [**PHP Supported Versions**](https://www.php.net/supported-versions.php?ref=securinglaravel.com) **plan indicates that only PHP 8.2, 8.3, 8.4, and 8.5 will be patched. If you are running an older version (version 5 onwards!), you will still be vulnerable after patches are released.**

![](https://storage.ghost.io/c/d9/0d/d90de76f-6031-4e2c-85b8-3447a38c4992/content/images/2026/10/image.png)

PHP Supported Versions Calendar

Even if you're running a supported version of PHP, if your Operating System is no longer supported, then you may not receive patches. For example, if you're on Ubuntu, you need to be on 22.04 LTS or newer.

I would also recommend running updates now as a precaution (i.e. get everything else updated now), so if there are any issues with either your update process or specific updates, you can get them fixed before the PHP update drops. Once the update drops, you'll want to focus all of your attention on that alone.

I wish I could provide more information, but that's all I've got for now. I'll update this post as I learn more. Stay safe everyone!

## Quick Checklist

1. Confirm your PHP version is 8.2 - 8.5 (older = no patch, plan an upgrade).
2. Check your OS is still supported (e.g. Ubuntu 22.04 LTS+) or you may not receive the patch.
3. Run all your other updates now, so the only thing to do when the patch drops is the patch.
4. Check in with your host / ops team and confirm your update procedure.
5. Watch for the release at 14:00 UTC and patch immediately.