[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-php-maintainers-flag-a-critical-security-release-is-coming":10,"sections":44},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":36,"feedback":43,"feedback_at":22,"cost_usd":43,"total_tokens":43},11977,"php-maintainers-flag-a-critical-security-release-is-coming","PHP Maintainers Flag a Critical Security Release Is Coming","PHP has pre-announced a critical security fix, but the listing names no versions, date or CVE, leaving admins to prepare blind.","The PHP project has warned that a security release rated critical is on the way, giving server operators notice before any patch ships.\n\nThe warning appeared on the project's announcement mailing list. The listing itself carries no release date, no affected versions and no CVE number (the identifier used to track a specific vulnerability). It does not describe the flaw either. A discussion thread about the notice had gathered 112 points and 25 comments at the time of writing.\n\nA pre-announcement is a deliberate choice. Projects that give advance warning are usually trying to let administrators clear their calendars while keeping the technical details private until a fix is ready, so attackers have nothing to work from. OpenSSL did the same in 2022, flagging a critical fix ahead of version 3.0.7. The bug was rated high severity by the time the patch landed, a reminder that a label announced in advance can change.\n\nPHP's reach is why even a vague notice gets attention. It runs WordPress and a large share of the server-side code behind the web, and plenty of sites sit on PHP versions that no longer receive security fixes. A critical bug in a language that widely deployed is a patching problem long before it is a technical one.\n\nOur advice, not the project's: work out now which PHP versions you run, including the ones buried in containers and hosting control panels, and decide who can approve an emergency update on short notice.\n\nThe open question is what \"critical\" means in practice. A flaw in the core engine that can be triggered remotely without a login would warrant the word. A bug in an optional extension would affect far fewer servers. Until the release names versions and a CVE, the notice works as a scheduling signal, not a diagnosis.","[\"php\",\"security-release\",\"vulnerabilities\",\"open-source\"]","2026-10-20T20:15:50.000Z","2026-10-21T03:04:27.862Z","2026-10-21T03:04:30.281Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"Remove the drafting note \"The source material is thin\" and rewrite it as plain reporting (for example, the notice gives no date, versions or CVE). Also drop the October 20 date unless it can be verified, since the source does not give it. Stop saying the notice tells administrators to get ready, because the advice is yours and should be framed that way. Then end on a real closing paragraph.","resolved","security",[32,33,34,35],"php","security-release","vulnerabilities","open-source",[37,40],{"name":38,"url":39},"Hacker News","https:\u002F\u002Fnews-web.php.net\u002Fphp.announce\u002F509",{"name":41,"url":42},"Ars Technica","https:\u002F\u002Farstechnica.com\u002Fsecurity\u002F2026\u002F10\u002Fphp-maintainers-tell-web-devs-to-prepare-themselves-for-critical-security-patches\u002F",0,{"sections":45},[46,51,55,60,65,70,75,80,85,90,95,100,105,110],{"name":47,"slug":48,"count":49,"latest_published_at":50},"AI","ai",7045,"2026-10-20T21:25:22.000Z",{"name":52,"slug":30,"count":53,"latest_published_at":54},"Security",1022,"2026-10-20T20:25:00.000Z",{"name":56,"slug":57,"count":58,"latest_published_at":59},"Policy","policy",555,"2026-10-21T04:57:09.000Z",{"name":61,"slug":62,"count":63,"latest_published_at":64},"Deals","deals",538,"2026-10-20T20:17:07.000Z",{"name":66,"slug":67,"count":68,"latest_published_at":69},"Hardware","hardware",272,"2026-10-20T22:38:24.000Z",{"name":71,"slug":72,"count":73,"latest_published_at":74},"Consumer Tech","consumer-tech",257,"2026-10-20T22:30:00.000Z",{"name":76,"slug":77,"count":78,"latest_published_at":79},"Science","science",209,"2026-10-20T21:02:53.000Z",{"name":81,"slug":82,"count":83,"latest_published_at":84},"Startups","startups",137,"2026-10-20T22:24:15.000Z",{"name":86,"slug":87,"count":88,"latest_published_at":89},"Software","software",134,"2026-10-20T14:57:15.000Z",{"name":91,"slug":92,"count":93,"latest_published_at":94},"Dev Tools","dev-tools",119,"2026-10-20T13:00:00.000Z",{"name":96,"slug":97,"count":98,"latest_published_at":99},"General","general",91,"2026-10-20T23:04:19.000Z",{"name":101,"slug":102,"count":103,"latest_published_at":104},"Gaming","gaming",84,"2026-10-21T02:56:30.000Z",{"name":106,"slug":107,"count":108,"latest_published_at":109},"Reviews","reviews",38,"2026-10-20T12:00:00.000Z",{"name":111,"slug":112,"count":113,"latest_published_at":114},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]