The PHP project will publish a critical security release today, 21 October 2026, at 14:00 UTC (16:00 CEST). The Drupal Security Team has issued a related advisory (PSA-2026-10-20). Once the release is out, we will upgrade PHP across our server infrastructure.
We don’t expect any downtime. We’ll post another update here when all servers are patched.
Update 13:45: Cloudflare or Bunny customers will face a tightened configuration, which could reported as downtimes by our uptime monitoring notification.
Update 15:35: PHP has released the security updates 8.5.12, 8.4.27, 8.3.36 and 8.2.35 (CVE-2026-109618, CVE-2026-109619). We are rolling out the updated packages across our infrastructure. Protective measures are active until the rollout is complete. No downtime is expected. We will post an update here once all servers are patched.