Two critical flaws, four releases
Digitale Profis reports on security updates released for PHP on October 21, 2026. The releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 addressed two critical vulnerabilities that could allow remote code execution without authentication. PHP runs many websites and web applications, so the response involved more than publishing a research finding. Fixes had to reach the software branches and services through which operators actually run their sites.
Different paths to discovery
The Calif research team used GPT-5.6 Sol to identify one of the vulnerabilities. Security company Wiz independently found and reported both. The channel describes AI as part of the research process, while preserving the distinction between those findings. PHP’s maintainers led the fixes and releases; research teams and infrastructure providers contributed technical work and preparation before the findings became public.
Coordinating the response
The coordinated disclosure gave participating organisations time to prepare corrections and protections before publication. Digitale Profis connects that process to the practical question of whether a site’s PHP installation received the October 21 update. The channel recommends checking that point with the hosting provider. Its report concerns these two disclosed flaws and their corresponding releases, with the update status of each installation remaining a separate operational question.
