Security
Critical PHP fixes will affect Joomla hosting environments
PHP is due to publish two critical security fixes on 21 October 2026, and Joomla administrators will depend on their hosting providers to receive them.
mySites.guru reports that both vulnerabilities carry a CVSS v4.0 score of 9.2. PHP has not yet disclosed the vulnerability class, CVE identifiers, affected versions or exact fixed versions. It has also not reported active exploitation; the release could be brought forward if exploitation evidence emerges.
The fixes are expected in point releases for PHP 8.2, 8.3, 8.4 and 8.5. PHP 8.1 and older branches are end of life and will not receive patches. PHP 8.6 is still in release-candidate testing and is not the production target for this update.
- Check the PHP branch serving each Joomla site.
- If it runs
8.2through8.5, ask the host when the patched build will be deployed. - If it runs
8.1or earlier, plan a supported PHP upgrade, checking Joomla and extension compatibility first.
Because PHP is controlled by the host, administrators generally cannot apply this runtime patch themselves. The final technical details should become available with the scheduled release at 14:00 UTC on 21 October.
Originally reported by mySites.guru.