The PHP project has warned that a security release rated critical is on the way, giving server operators notice before any patch ships.
The warning appeared on the project's announcement mailing list. The listing itself carries no release date, no affected versions and no CVE number (the identifier used to track a specific vulnerability). It does not describe the flaw either. A discussion thread about the notice had gathered 112 points and 25 comments at the time of writing.
A pre-announcement is a deliberate choice. Projects that give advance warning are usually trying to let administrators clear their calendars while keeping the technical details private until a fix is ready, so attackers have nothing to work from. OpenSSL did the same in 2022, flagging a critical fix ahead of version 3.0.7. The bug was rated high severity by the time the patch landed, a reminder that a label announced in advance can change.
PHP's reach is why even a vague notice gets attention. It runs WordPress and a large share of the server-side code behind the web, and plenty of sites sit on PHP versions that no longer receive security fixes. A critical bug in a language that widely deployed is a patching problem long before it is a technical one.
Our advice, not the project's: work out now which PHP versions you run, including the ones buried in containers and hosting control panels, and decide who can approve an emergency update on short notice.
The open question is what "critical" means in practice. A flaw in the core engine that can be triggered remotely without a login would warrant the word. A bug in an optional extension would affect far fewer servers. Until the release names versions and a CVE, the notice works as a scheduling signal, not a diagnosis.