Remote profile

We have posted more information about today's security releases, including the sequence of events that led to the discovery, how the PHP security team is improving their processes, and what we need from you to continue this critical work. https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
#php #security

If you rely on the volunteer maintained rpms.remirepo.net we urge you to move to distro packages or building from source now, so you can immediately apply updates. The repo will not have updates today.

The PHP security team is giving advance notice of an upcoming security release scheduled for Wednesday, 21 October 2026 at 14:00 UTC, addresses two critical vulnerabilities, both rated CVSSv4 9.2.

All PHP users are encouraged to prepare so they can upgrade immediately tomorrow. Should details of the vulnerabilities become public, or should evidence of active exploitation appear we will release sooner.

Full details, affected versions, and the fixed versions will be published with the release.