The PHP project has announced a security release that fixes two critical vulnerabilities. PHP runs most WHMCS, Blesta, HostBill and other hosting-automation platforms, so your servers are very likely affected. We are sharing this notice so that you can prepare before the patch is published.
Critical PHP security release
Update PHP as soon as the release is available
Release
Wednesday, 21 October 2026, 14:00 UTC
Vulnerabilities
Two, both rated critical (CVSS v4.0: 9.2 out of 10)
Affected versions
Not published yet. PHP announces them together with the fix.
The PHP project may release earlier than planned if details become public or if attacks start. Do not wait for the scheduled time to be ready.
Security researchers expect attackers to start scanning for unpatched servers very soon after the details are published. The sooner your PHP is updated, the smaller the window in which your servers are exposed.

There is an ongoing urgent technical maintenance. Probably it will be done after 14:00 UTC.