Source · advisory · primary · captured

Upcoming Critical PHP Security Release

oss-security list (Alan Coopersmith, Oracle) · https://www.openwall.com/lists/oss-security/2026/10/20/34 · published 2026-10-20T20:22:51Z · added by collector-primary · slug openwall-oss-security-2026-10-20-34

Date header Tue, 20 Oct 2026 13:22:51 -0700 (= 20:22:51Z). Quotes the php.net pre-announcement verbatim: scheduled 21 Oct 14:00 UTC, two vulns CVSS v4.0 9.2.

The release moved forward from 22 October 14:00 UTC to 21 …The fixes were released at 14:00 UTC on 21 OctoberThe pre-announcement was published at 19:30 UTC on 20 Octo…2026-10-20 19:30 UTC: php.net publishes the pre-announceme…2026-10-20 20:22:51 UTC: Alan Coopersmith relays the php.n…2026-10-21 14:00 UTC: The planned release time. php.net's …oss-security

What it says, as the collector read it

oss-security 2026/10/20/34: notes

  • Posted by Alan Coopersmith (Oracle). Date: Tue, 20 Oct 2026 13:22:51 -0700 = 20:22:51Z.
  • Relays the php.net pre-announcement verbatim: "It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC." "It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2." "We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild."
  • Timing evidence: the php.net pre-announcement was public by 20:22Z on 20 Oct. That fits the Foundation's "19:30 UTC" and contradicts php.net's own feed timestamp of 20:32:00+00:00.

Claims that cite it

ClaimWho says itStatusPrimarySources
The release moved forward from 22 October 14:00 UTC to 21 October 14:00 UTC because of the leak
The php.net ChangeLog still dates all four releases 22 October. Wiz's X thread still says 22 October.
PHP Foundation; php.net pre-announcement; Wiz thread ('Apply the Oct 22 security release')confirmed4/4PHP Foundation oss-security Wiz on X php.net
The fixes were released at 14:00 UTC on 21 October
CERT-EU says 13:30 UTC; the tags and advisories are stamped 13:34 to 13:35 UTC; the GitHub release 14:06 UTC; the php.net feed entries carry 00:05 to 00:35 UTC, which are authoring times, not publication times.
php.net pre-announcement; Daubois; CERT-FR (16:00 Paris)disputed7/8oss-security Daubois CERT-FR CERT-EU php-src PHP php-src php.net
The pre-announcement was published at 19:30 UTC on 20 October
The php.net feed says 20:32 UTC; oss-security relayed it at 20:22:51 UTC, so it was public by then.
PHP Foundationdisputed3/3PHP Foundation oss-security php.net

Events that cite it

WhenEventTime is
2026-10-20 19:30 UTCphp.net publishes the pre-announcement: release moved to 21 October 14:00 UTC, two critical vulnerabilities, CVSS v4.0 9.2, 'we reserve the right to release earlier'.disputed
2026-10-20 20:22:51 UTCAlan Coopersmith relays the php.net pre-announcement to oss-security.stated
2026-10-21 14:00 UTCThe planned release time. php.net's advisory 'Critical remote code execution vulnerabilities, update now' and the four release posts go up.stated

The bytes

capture 20261022T081408Z · HTTP 200 · https://www.openwall.com/lists/oss-security/2026/10/20/34
  • headers.json 716db9e977d3bc55b5045e260d9914e03196ed370f73c86c22880782e6a6a114 239 bytes
  • page.html 46a94f610255e2ee75ab240c658666ef2589e34e4dd4fcb93b5c5e45fc9917d4 5,800 bytes
  • provenance.json 04ff8e63e2b72caeb3d48ed4a44ecc28434a0414db9f8d59022e7b75af8ccb40 1,012 bytes
  • rendered.html 5c80dc74b7328496b9f3ee62eef06aa707db7327bd0bcdd7ab9aa4f0c5a5a5d8 6,056 bytes
  • screenshot.png c03f4fc0fefe0485485685cdf28d3e439a4b167b3022a946ee928be55cd4ee0d 120,872 bytes
  • text.txt 57b273733e7d5fe658deca4275db17ad5fd01aeb06d84d973d55551983dfa392 1,415 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →