PHP leak forces early security release after exploits begin circulating
AIThe PHP Foundation says two remote code execution vulnerabilities in the PHP 8.x line leaked on October 20, 2026, with a wrong release time and a CVSS score of 10.0 instead of 9.2. The project moved its pre-announcement and patched release forward to October 21, 2026, but a security firm mistakenly published a proof-of-concept video, accelerating exploit development.
AIWhy it matters.
The post explains how a premature leak of two PHP vulnerability IDs and a mistaken video led to exploit code circulating before the patch, which is useful for anyone managing disclosure timing.
Source details
Simon Willison · simonwillison.netPublished · added here
Original title: Today's PHP Security Release, and How We're Strengthening PHP Security