The PHP security team pre-announced a critical release landing tonight at 21:00 WIB, fixing two vulnerabilities rated CVSS 9.2. Here's how to inventory every PHP in your fleet and plan the patch window before the details even drop.

PHP almost never warns you in advance. Security releases from the PHP team normally just land — a terse announcement, a tarball, and a Changelog entry you read after the fact. That's what makes yesterday's notice on php.net worth a second look: the security team announced, on 20 October 2026, that a security release is scheduled for Wednesday, 21 October 2026 at 14:00 UTC — that's 21:00 WIB tonight — addressing two critical vulnerabilities, both rated CVSS v4.0 9.2.

They also said they may ship earlier if details go public or active exploitation appears. Full details, affected versions, and fixed versions will be published with the release. All PHP users, the notice says, should "prepare now so they can upgrade as soon as the release is available."

So let's do exactly that. This isn't a story about two bugs we can't see yet. It's a story about the hours you have left to get ready.

Why a pre-announcement changes the math

A pre-announced security release tells you two things. First, the PHP team believes the risk window starts the moment the fix ships — otherwise they'd just ship. Second, and more uncomfortably: everyone else read the same notice. CVSS 9.2 means low attack complexity and severe impact; once details drop, the race between patchers and exploit-writers starts instantly. The notice is polite. The math is not.

If you run WordPress, Laravel, Nextcloud, phpMyAdmin, or anything on shared hosting, PHP is not one binary — it's a fleet. And 21:00 WIB is a countdown, not a suggestion.

Step 1: inventory every PHP before 21:00

You can't patch what you can't find. Run this across your boxes today:

php -v 2>/dev/null; ls /usr/bin/php* 2>/dev/null
systemctl list-units 'php*-fpm*' --no-pager
apachectl -M 2>/dev/null | grep -i php
docker ps --format '{{.Names}}' | xargs -I{} sh -c "docker exec {} php -v 2>/dev/null" | sort -u

Then check the places the CLI doesn't show you: composer.json files pinning a platform PHP version, panel-managed stacks (cPanel, Plesk, Hestia), and WordPress sites behind mod_php. Write down every version you find — that list is your patch checklist tonight.

Step 2: know your patch source — and its lag

Upstream tarballs on php.net appear first. Distro packages follow at their own pace: Debian and Ubuntu's security teams, the Ondřej Surý PPA most of us actually run on Ubuntu, RHEL and AlmaLinux streams, Arch's extra repo. The PPA usually turns around fast, but "fast" has historically meant hours to a day — and this release drops at 21:00 your time, outside anyone's business hours.

Decide now: if your distro package isn't out by morning, do you build from source, switch to the PPA, or wait? Make the decision at noon, not at midnight.

Step 3: keep the rollback in your pocket

A 9.2-rated patch is not the release to improvise with. Before upgrading tonight: snapshot the VM or container image, keep the old package files (apt keeps debs in /var/cache/apt/archives — don't clean that directory today), and note your current patch level somewhere readable during an outage. PHP minor bumps are usually safe, but opcache configs, FPM pool limits, and extension builds have all broken on "routine" security upgrades.

Step 4: smoke-test in the right order

Staging first, always — even if staging is just one VPS. Hit the login page, the payment flow, the upload endpoint. Then production, box by box, watching error logs for the first ten minutes of each. With two 9.2s, the temptation is to blast the update everywhere at once; the discipline is to go fast in sequence.

What we know — and what we don't

Confirmed: two vulnerabilities, CVSS v4.0 9.2 each, release at 14:00 UTC today (21:00 WIB), possibly earlier. Not confirmed yet: affected branches (expect fixes across the supported lines — 8.2, 8.3, 8.4, 8.5; PHP 8.6 is still in RC and shouldn't be in production anyway), the attack vectors, or whether the flaws share a component.

Don't fill the gap with speculation from random blogs tonight. When the release lands, read the php.net announcement and your distro's security tracker — that's the whole source list that matters.

The rare part of today isn't the severity. It's the head start. PHP handed you hours of warning. Spend them on the inventory, the patch source, and the rollback plan — and 21:00 becomes a routine upgrade instead of a scramble.

Sources: PHP — "Upcoming Critical PHP Security Release" (php.net, 20 Oct 2026)