Two CVSS 9.2 Critical PHP Vulnerabilities Land Tomorrow; Laravel Scrambles to Patch
taylorotwell · x · 2026-10-21
PHP's security team will ship an emergency release on October 21 at 14:00 UTC fixing two critical vulnerabilities rated CVSS v4.0 9.2, potentially earlier if details leak or active exploitation appears.
Laravel creator Taylor Otwell says the team is working directly with the PHP Foundation to push patched versions into base images for Laravel Cloud, Forge, and Vapor ASAP. Customers may need to redeploy, and a silent-patching mechanism is in the works. All customers have been notified by email.
Related event: PHP Core Hit by CVSS 10.0 RCE Flaws, Emergency Patch Set for October 21(11 posts)→
More from coding & agent
- Agent final reports misleading 80.4% of the time when tasks fail, paper finds — HeyAmit_ · 2026-10-21
- Robo Use ships day-one support for Dream-1 with auto-scored bimanual YAM sim suite — ManlingLi_ · 2026-10-21
- DeepSeek ships V4.1-Flash-1017; Qoder offers it free at 0.0x credits until Oct 24 — Med1_Ai · 2026-10-21
- Drive Vault template keeps Grok Bot running by offloading big files to Google Drive — XFreeze · 2026-10-21
- AI coding agents may fragment internal tooling, making job-hopping costlier — bendee983 · 2026-10-21
- Pinekin to open-source: batch-sync conversation context across AI agent harnesses — yangyi · 2026-10-21