---
type: "post"
id: "today-s-php-security-release-and-how-we-cac9ed"
slug: "today-s-php-security-release-and-how-we-cac9ed"
title: "Today's PHP Security Release, and How We're Strengthening PHP Security"
description: "PHP released updates across its PHP 8.x line for two remote-code-execution vulnerabilities."
retrieval_nugget: "PHP released updates across its PHP 8.x line for two remote-code-execution vulnerabilities."
published_at: "2026-10-22"
updated_at: "2026-10-22"
record_date: "2026-10-22"
date_kind: "published_at"
topics: ["gemini"]
entities: ["PHP","PHP Foundation","Wiz Research","Wiz Atlas","Gemini 4 Argon","GPT-5.6 Sol","Drupal","WordPress"]
related_patterns: []
novelty_label: "new_fact"
what_changed: "Adds the PHP Foundation’s account of the disclosure leak: circulating CVE IDs prompted an early announcement and release, while a mistakenly published PoC video accelerated exploit development."
prior_refs: ["memory:592c9dc4-991d-8a8c-ae31-be347a0f42d2","memory:b96fa1d6-a199-8ee5-a6d1-acf05be2ce9c","memory:1f81f446-2440-8bf4-a877-a562cd996154"]
source_url: "https://simonwillison.net/2026/Oct/21/php-security-release"
source_urls: ["https://simonwillison.net/2026/Oct/21/php-security-release"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:today-s-php-security-release-and-how-we-cac9ed"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/today-s-php-security-release-and-how-we-cac9ed/","markdown":"https://newruntime.com/posts/today-s-php-security-release-and-how-we-cac9ed.md","json":"https://newruntime.com/posts/today-s-php-security-release-and-how-we-cac9ed.json"}
---

# Today's PHP Security Release, and How We're Strengthening PHP Security

## Retrieval answer

PHP released updates across its PHP 8.x line for two remote-code-execution vulnerabilities.

PHP released updates across its PHP 8.x line for two remote-code-execution vulnerabilities. Simon Willison's report, quoting the PHP Foundation, says the vulnerabilities carry a CVSS score of 9.2, not the 10.0 score that circulated in early posts.

The CVE identifiers began circulating on forums and social media at about 15:00 UTC on October 20. PHP moved its pre-announcement to 19:30 UTC that day and advanced the release from October 22 at 14:00 UTC to October 21 at 14:00 UTC. The report says a security firm's mistakenly published video showed a proof of concept against several targets; copies then circulated and contributed to further PoC development.

Wiz Research says it discovered the first issue on August 19 using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol, and later confirmed unauthenticated RCE against Drupal and WordPress. It reported the issues to PHP on August 24; patched releases and public disclosure followed on October 21.

The source does not establish the complete set of affected deployments, patched version numbers, or the scope of successful exploitation. It does state that PHP operators should update.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Gemini](https://newruntime.com/topics/gemini.md): Explore the gemini topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)