Heads Up! Upcoming Critical PHP Security Release

1

The PHP security team would like to give advance notice of an upcoming security release.

It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.

It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2.

All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available.

We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.

Full details, affected versions, and the fixed versions will be published with the release.

Thank you for helping us keep PHP secure.

We suggest to update to the latest version asap when PHP update gets released.

Sites that are using Apache2 + Prefork (Default servers installed before 1.3) are affected for sure!

4

The old Launch pad servers are overloaded:

Please update your servers

If you are smart change over to change over to deb.sury.org

#!/usr/bin/env bash
set -euo pipefail

apt-get update
apt-get install -y lsb-release ca-certificates curl gnupg

codename="$(lsb_release -sc)"
arch="$(dpkg --print-architecture)"

# Remove any old ondrej/sury source files
grep -rl ondrej /etc/apt/sources.list.d 2>/dev/null | xargs -r rm -f

# Fetch the signing key first
curl -fsSL https://packages.sury.org/php/apt.gpg | gpg --dearmor -o /usr/share/keyrings/sury-keyring.gpg

# Add the repository
echo "deb [arch=${arch} signed-by=/usr/share/keyrings/sury-keyring.gpg] https://packages.sury.org/php/ ${codename} main" \
  > /etc/apt/sources.list.d/php.list

apt-get update

For hestia we are building the packages but will take some time easiest method is to temproy disable hestia or

In /usr/local/hestia/php/lib/php.ini

memory_limit=-1
post_max_size = 8M
session.upload_progress.enabled=0