Critical PHP security update scheduled today : 21 October, 14:00 UTC

Hello mates,

You may already have seen this, but just in case: the PHP security team has announced an update addressing two critical vulnerabilities, both rated 9.2 under CVSS v4.0.

The release is scheduled for today, Wednesday, 21 October 2026, at 14:00 UTC (16:00 CEST / mainland Spain). It may arrive earlier if vulnerability details become public or evidence of active exploitation appears.

Full technical details, affected versions and fixed versions will be published with the release, so please check the official announcement rather than assuming your current version is covered.

If you manage your own server, prepare to apply the appropriate security update... as soon as it becomes available. If your hosting provider manages PHP, contact them to confirm their patching plans and whether you need to take any action.

For WordPress site owners: this announcement concerns PHP itself. Updating WordPress or your plugins alone does not update the PHP runtime on your server.

One of the things I love about the Fluent ecosystem is that we get to keep control of our own data. That freedom also comes with responsibility: when your site holds CRM contacts, customer details, purchase histories and support conversations, a server breach could expose much more than the website itself. Keeping the underlying server software patched is part of looking after the people who trust us with their information.

Official PHP announcement:
https://www.php.net/archive/2026.php#2026-10-20-1

Sharing this as a heads-up for anyone running WordPress and the Fluent plugins. Stay safe!