PHP Announces Critical Security Release for Two Vulnerabilities
2026-10-21T08:51:43Z•addaa622eb11fed73e51910ed0894908a04efe9fb01661473ae5517aa49016bb
CVE-2025-39682CVE-2025-39964CVE-2026-53266CISA KEVCVSS v4.0Linux kernelMicrosoft Patch TuesdayPHPactively exploitedcritical vulnerabilitiespatchingvulnerability management
What happened
Qualys reports that PHP announced an upcoming security release for two critical vulnerabilities, each rated CVSS v4.0 9.2, scheduled for October 21, 2026 at 14:00 UTC and potentially earlier if details are disclosed or exploitation is observed. The feed also highlights Microsoft October 2026 security updates and three actively exploited Linux kernel vulnerabilities added to CISA's KEV Catalog: CVE-2025-39682, CVE-2026-53266, and CVE-2025-39964.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- qualys_blog
- Record identifier
- addaa622eb11fed73e51910ed0894908a04efe9fb01661473ae5517aa49016bb
- Enrichment time
- 2026-10-21T08:51:43Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.