Critical PHP Security Update, Oct 21: What to Do
· 4 min read
The PHP team has announced a critical security update for PHP for Wednesday, October 21, 2026, at 14:00 UTC (16:00 in Italy), the language that runs Magento, Adobe Commerce, Mage-OS, WooCommerce and countless other online stores. It fixes two vulnerabilities scoring 9.2 out of 10. Details and fixed versions will be published with the release. The point that matters: the fix is applied on the server, not in your store's code.
What we know so far
What the PHP team has announced on its official site:
- two critical vulnerabilities, both scoring 9.2 out of 10 (CVSS v4.0);
- release announced for October 21 at 14:00 UTC, which can be brought forward if details become public or attacks in the wild appear;
- PHP users are asked to prepare in advance, so they can upgrade as soon as the release is out.
According to information found on the web, still to be confirmed by the official announcement, the details leaked on October 20, the flaws would allow remote code execution on the server, and they would affect all PHP versions from 5.4 onwards. Some security researchers fear mass attacks right after publication.
What it means for your store
If your store runs on PHP, this fix concerns you too. And it is not solved by updating the store: it has to be installed on the server where PHP runs. So the right question is: who manages my server?
- Managed hosting: ask your provider right away whether they will apply the update as soon as it is out, and when.
- Your own or dedicated server: you need whoever administers it, your sysadmin or me through the maintenance service.
- Managed cloud: ask the provider how and when they will apply the update.
What to do, in order
- Write to your hosting provider right away and ask them to be ready to apply the PHP update as soon as it is published.
- Check the PHP version your store uses (your host or whoever looks after it can tell you).
- When it is published, read the announcement on php.net: the fixed versions will be there.
- Have the update applied on every environment, including the test one.
- Check that the store works: cart, checkout, customer area, admin and background tasks.
- After the update, watch for unusual signs, such as unexpected files or access.
If you use an old version of PHP
Again according to information found on the web, PHP officially supports only version 8.2 and later: no official fix is planned for 8.1 and earlier. In that case ask your provider to apply the fix to your version or move to a supported version, after checking that your store is compatible. It is a move to plan, not to improvise: if your store runs an old Magento version, it may be the moment to look at replatforming and migrations.
The timeline
| When | What |
|---|---|
| October 20 | The details leak and PHP announces the critical release |
| October 21, 14:00 UTC (16:00 in Italy) | Release scheduled, can be brought forward |
Security updates without the worry
After Adobe's October 13 patch comes another critical fix. Following the alerts, coordinating the hosting, testing updates and verifying the store is recurring work: with the maintenance and support service I take care of it.
Want to know whether your store and your server are ready? Request a security audit and a free quote.
Informative article, written on October 21, 2026 before the release was published: fixed versions and details are those of the official announcement on php.net, to be consulted first. The situation is evolving and unofficial information may change.