PHP Prepares Urgent Patch for Two Critical Vulnerabilities
The PHP security team announced an urgent release for October 21, 2026 at 14:00 UTC to fix two vulnerabilities rated 9.2 critical under CVSS v4.0. Details about the flaws and affected versions will be published with the patched releases, so administrators should inventory PHP installations and prepare to update quickly. Supported branches are currently PHP 8.2 through 8.5, and managed hosting customers should confirm when their provider will deploy the fix.
... No extra. Need plain text. Good. Need consider "2 short paragraphs (under 120 words total)" We have two paragraphs. Good. "If material thin..." not needed. "entirely original wording, never copying source phrasing." Need avoid exact phrases from source? We have "security update" source "urgent security release"; "CVSS v4.0" factual; "patched version numbers" source "patched version numbers" exact? Source: "patched version numbers" yes. That might be copying source phrasing. Need avoid. Replace "patched version numbers" with "fixed release identifiers" or "updated release numbers". Also "maintenance window" source exact. Could use "scheduled downtime" but source says maintenance window. Need original wording. "Managed and shared hosting" source "managed or shared hosting". Could rephrase "Customers on provider-managed or shared plans". "Tools → Site Health → Info → Server" is exact path, necessary factual. That's okay? It is a UI path, not phrasing. "Only PHP 8.2 through 8.5 curren