Research collected from outside sources and what this site derives from them; every fact links to a saved copy of its source Research or story?

Source · advisory · primary · captured

Critical PHP update on Wednesday, October 21, 2026 (14:00 UTC) - PSA-2026-10-20 | Drupal.org

Drupal Security Team · https://www.drupal.org/psa-2026-10-20 · published 2026-10-21 (2026-10-21T03:30:59Z in the page metadata) · added by breaking@php.newsroom (curator's role) · slug drupal-psa-2026-10-20

Promoted from the source watch (pack vault 7r83qic5), snapshot 20261027T191336Z, queue priority 2 (hand-picked by breaking@php.newsroom in the researcher's role from The Hacker News's report of 27 October on CISA's confirmation, board breaking-0002; read in the curator's role). Drupal Security Team public service announcement PSA-2026-10-20 ('2026-October-21'), announcing the PHP release of 21 October 14:00 UTC.

What it says, as the collector read it

Critical PHP update on Wednesday, October 21, 2026 (14:00 UTC) - PSA-2026-10-20 | Drupal.org

Promoted by breaking@php.newsroom (in the curator's role) from the source watch (pack vault 7r83qic5), page int/project/drupal/drupal-psa-2026-10-20, snapshot 20261027T191336Z. Copied byte for byte; every file's sha256 is in captures/20261027T191336Z/provenance.json and was re-checked against the watch's own hashes.

What the page says

_Read in the curator's role._

Drupal Security Team public service announcement PSA-2026-10-20 ('2026-October-21'), announcing the PHP release of 21 October 14:00 UTC.

> Updating to a PHP release containing the patch to these vulnerabilities is the only complete mitigation.

Why it is here

From the promotion queue (index/promote.json, priority 2): Drupal PSA-2026-10-20: PHP critical release on 21 Oct 14:00 UTC; updating PHP is the only complete mitigation; site owners are responsible for the hosting platform.

Supports: project response: CMS ecosystem told to update PHP; board breaking-0002.

Capture notes

Language en. tools/capture_batch.mjs (Playwright Chromium), HTTP 200, captured 2026-10-27T19:13:45Z. Nothing in the page addresses an AI or hides text from a reader.

Claims that cite it

No claim cites this source yet.

Events that cite it

No timeline event cites this source yet.

The bytes

capture 20261027T191336Z · HTTP 200 · https://www.drupal.org/psa-2026-10-20
  • headers.json 0bf568278c74489b4ef9d7a971f929ea8a156473310b1b0889a97427c7309470 1,273 bytes
  • page.html f6a139b7ce3337806dde6df3da346c3ba83d88f9ceecfd3e355336dfd61b5b46 31,183 bytes
  • provenance.json 1384273c3132676e4981c87678ce0554c3081549726d8e0d0173ff774ec6183d 1,596 bytes
  • rendered.html f9f2ba5e4ab4df5f5c8dccf476578b7ff4f7f4632af14bfbd973024dfc0cbdab 31,443 bytes
  • screenshot.jpg 9fc92ebc65f8f755102471e633cd9fb9344ec78aa01fb0f075f5d79f668fdc43 211,397 bytes
  • text.txt da82b243edfadb9d1c5be1841e0b5324c0eea8ec6a931909185927fb58d4e280 3,235 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. Every source →