Critical PHP security update on 21 October 2026: what Joomla site owners should do now

The PHP team has announced a security release for Wednesday, 21 October 2026, at 14:00 UTC. It closes two critical vulnerabilities, both rated CVSS 9.2. Joomla runs on PHP – so every Joomla website is affected as soon as its PHP version is among the affected ones. What is known so far and what you should do now.

What is known (as of the morning of 21 October 2026)

• Date: 21 October 2026, 14:00 UTC. The PHP team reserves the right to release earlier if details become public or attacks appear (php.net).
• Severity: two vulnerabilities, both "critical" with CVSS v4.0 9.2.
• Details – which versions are affected, which functions and the fixed versions – PHP will only publish with the release.
• Careful with rumours: CVE numbers and attack scenarios are already circulating online. So far only the announcement is confirmed.

Which PHP versions still receive updates

Security updates are only provided for PHP 8.2 (until 31 December 2026), 8.3 (until 31 December 2027), 8.4 (until 31 December 2028) and 8.5 (until 31 December 2029) (php.net). Current are 8.2.34, 8.3.35, 8.4.26 and 8.5.11. PHP 8.1 and older get no fix – more on that below.

What you should do now

1. Check your PHP version: in the Joomla backend under System → System Information, or in your host's control panel.
2. Keep an eye on your host: on regular web hosting the host installs the PHP update. After 21 October, check whether your version carries the new number, and ask if in doubt.
3. Your own server: if you run PHP yourself, plan the update for the afternoon of 21 October.
4. Test briefly afterwards: home page, forms, backend login. If the website shows an error 500, our post error 500 after a PHP update helps.

Joomla 3 on old PHP: no fix

Joomla 3 is built for PHP up to 8.0, for 8.1 only a few adjustments followed. These PHP versions no longer receive security updates – not for the vulnerabilities announced now either. Many hosts only offer them for a surcharge (what that costs). The lasting way is the switch to Joomla 6 with a current PHP version: Joomla 3 to 6 migration.

And the extensions?

A current PHP does not help against vulnerabilities in Joomla extensions. There were unusually many of them in 2026 – the list with all affected versions is in the post Vulnerabilities in Joomla extensions 2026.

Sources: announcement of the PHP team of 20 October 2026 on php.net, supported versions on php.net. As of 21 October 2026, before the release. We will add to this post as soon as PHP has published the details.