PHP 计划于10月21日发布关键安全更新

此次发布修复了两个严重漏洞，均被评为 CVSS v4.0 9.2。PHP 正在敦促用户准备升级。

By · Published · Updated

Primary source: X

为何重要

PHP 已确认存在两个关键漏洞，并即将发布安全更新。管理员应准备升级，然后利用该发布公告确定哪些部署受到影响。

watchTowr (@watchtowrcyber): We were all supposed to wait until Thursday at 11am ET. Information has leaked wrt zero-day embargoed RCE vulns in PHP.
PHP scheduled release for two critical RCEs, prepare to upgrade

PHP confirmed it is addressing two critical remote-code-execution vulnerabilities and scheduled a security release for October 21, 2026 at 14:00 UTC. The PHP security team says it will publish affected and fixed versions with the release and may release earlier if details leak or exploitation appears. Social-media claims about CVSS 10.0 scores, specific CVE identifiers, or patch coverage remain unverified; administrators should monitor PHP's official archive and be ready to upgrade when fixes are published.

PHP 的安全团队在星期二宣布，PHP 将于星期三（10 月 21 日）14:00 UTC 发布针对两个严重漏洞的修复。

该团队在其公告中表示，这两个漏洞被评为 9.2（基于 CVSS v4.0）。它敦促 PHP 用户做好准备，以便在发布可用时尽快升级。

根据[PHP…

When you purchase through links in our articles, we may earn a small commission. This doesn’t affect our editorial independence.

Reader comments

Conversation for this story loads after sign-in.