---
format: "aidr-story-markdown/v1"
id: "60cdd6b596008249bf482a06ab7091130451beb502a9a6dff1ec2b4c3ae81be1"
canonical_url: "https://aidr.today/60cdd6b5?lang=en"
title: "Today's PHP Security Release, and How We're Strengthening PHP Security"
lang: "en"
requested_lang: "en"
available_langs: ["en","vi"]
translation_fallback: null
fallback_fields: []
published_at: "2026-10-21T18:41:53.000Z"
category: "Open Source"
topics: ["safety","open-source","amazon"]
source_urls: ["https://simonwillison.net/2026/Oct/21/php-security-release/","https://www.wired.com/story/hackers-exploited-the-php-vulnerabilities-days-before-they-were-patched/"]
summary: "The PHP project released security updates across the entire PHP 8.x line to address two remote code execution vulnerabilities, after CVE IDs and incorrect details began circulating on October 20th due to a leak in the coordinated disclosure process. The release was moved forward to October 21st at 14:00 UTC, and a security firm mistakenly published a proof of concept video revealing limited additional details about the vulnerabilities."
---

# Today's PHP Security Release, and How We're Strengthening PHP Security

> [Open the canonical story](<https://aidr.today/60cdd6b5?lang=en>)

**Published:** 2026-10-21T18:41:53.000Z
**Category:** Open Source
**Topics:** safety, open\-source, amazon

## Summary

The PHP project released security updates across the entire PHP 8\.x line to address two remote code execution vulnerabilities, after CVE IDs and incorrect details began circulating on October 20th due to a leak in the coordinated disclosure process\. The release was moved forward to October 21st at 14:00 UTC, and a security firm mistakenly published a proof of concept video revealing limited additional details about the vulnerabilities\.

## Sources

- [Story source](<https://simonwillison.net/2026/Oct/21/php-security-release/>)
- [Story source](<https://www.wired.com/story/hackers-exploited-the-php-vulnerabilities-days-before-they-were-patched/>)