Government Advisory
Two Critical PHP Vulnerabilities Due for Public Disclosure on 22 October 2026
ACSC · 21 Oct 2026
Key Takeaway
Check now whether your website or any web application you rely on runs on PHP, and plan to apply the security update soon after it is released on 22 October 2026.
The Australian Cyber Security Centre (ACSC) has issued an advance notice about two critical vulnerabilities in PHP. A security release that addresses them is scheduled for public disclosure on 22 October 2026.
PHP is widely used to power web applications, so a flaw in it can affect many websites and online services. The notice does not say what the vulnerabilities do or which versions are affected, and those details are expected with the release itself.