PHP Critical CVEs: What to Update Now

On 21 October 2026, the PHP project published a security advisory for two critical vulnerabilities that can allow unauthenticated remote code execution. The source of record is php.net, not a vendor blog or a social-media summary.