The PHP project released security updates for the entire PHP 8.x line on 21 October 2026 to address two remote code execution (RCE) vulnerabilities. The release was accelerated after details and exploit material began circulating following a leak in the coordinated disclosure process.
Incorrect details and the pre-announcement
According to a post from the PHP Foundation, on 20 October 2026 at around 15:00 UTC two CVE identifiers started circulating on online forums and social media. The information included an incorrect planned release time and an incorrect CVSS score of 10.0; the actual score is 9.2. No technical details leaked at that moment. In response, the PHP project moved its pre-announcement forward and published it at 19:30 UTC, and also advanced the planned release from 22 October 2026, 14:00 UTC to 21 October 2026, 14:00 UTC.
Unauthorized video and faster PoC proliferation
Because of the leak and the pre-announcement, around 20:00 UTC a security firm named Calif mistakenly published a video that showed their proof of concept working against several targets and revealed a few additional, though limited, details about the vulnerabilities. Copies of the deleted video quickly circulated on social media and contributed to accelerated development and wider circulation of various proofs of concept, particularly on 21 October.
Timeline from the discoverers
The team that discovered the original vulnerability, Wiz Research, published a more detailed timeline of their intended responsible disclosure:
- 19 August 2026: Wiz Research discovers the first PHP vulnerability using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol.
- 20 August 2026: Unauthenticated RCE is confirmed against Drupal.
- 21 August 2026: Unauthenticated RCE is confirmed against WordPress.
- 24 August 2026: Wiz Research reports the vulnerabilities to the PHP security team.
- 21 September 2026: PHP acknowledges the reports and begins developing a coordinated fix.
- 21 October 2026: Patched PHP releases become available.
- 21 October 2026: Public disclosure.
Practical implications
Because the flaws allowed remote code execution and exploit materials were circulating, organisations running any PHP-based services or applications should promptly upgrade to the patched PHP 8.x releases. The incident highlights weaknesses in coordinated disclosure procedures: accidental leaks and premature publications can accelerate exploit development and distribution, undermining the benefits of coordinated remediation.
Next steps
The PHP Foundation and the reporting teams will likely review and tighten internal handling procedures to reduce the risk of future leaks. Meanwhile system administrators and developers should prioritize applying the released updates and monitoring their systems for related indicators of compromise.
(This article is based on announcements from the involved organisations and the timeline published by Wiz Research.)
