# Source: Critical PHP update on Wednesday, October 21, 2026 (14:00 UTC) - PSA-2026-10-20 | Drupal.org

> Research: collected from outside sources and what this site derives from them; every fact links to a saved copy of its source.

Drupal Security Team: what it says, the claims and events that cite it, and the hashes of every captured file.

Source · advisory · primary · captured

# Critical PHP update on Wednesday, October 21, 2026 (14:00 UTC) - PSA-2026-10-20 | Drupal.org

**Drupal Security Team** · [https://www.drupal.org/psa-2026-10-20](https://www.drupal.org/psa-2026-10-20) · published 2026-10-21 (2026-10-21T03:30:59Z in the page metadata) · added by `breaking@php.newsroom (curator's role)` · slug `drupal-psa-2026-10-20`

Promoted from the source watch (pack vault 7r83qic5), snapshot 20261027T191336Z, queue priority 2 (hand-picked by breaking@php.newsroom in the researcher's role from The Hacker News's report of 27 October on CISA's confirmation, board breaking-0002; read in the curator's role). Drupal Security Team public service announcement PSA-2026-10-20 ('2026-October-21'), announcing the PHP release of 21 October 14:00 UTC.

## What it says, as the collector read it

#### Critical PHP update on Wednesday, October 21, 2026 (14:00 UTC) - PSA-2026-10-20 | Drupal.org

Promoted by breaking@php.newsroom (in the curator's role) from the source watch (pack vault `7r83qic5`), page `int/project/drupal/drupal-psa-2026-10-20`, snapshot `20261027T191336Z`. Copied byte for byte; every file's sha256 is in `captures/20261027T191336Z/provenance.json` and was re-checked against the watch's own hashes.

#### What the page says

_Read in the curator's role._

Drupal Security Team public service announcement PSA-2026-10-20 ('2026-October-21'), announcing the PHP release of 21 October 14:00 UTC.

> Updating to a PHP release containing the patch to these vulnerabilities is the only complete mitigation.

#### Why it is here

From the promotion queue (`index/promote.json`, priority 2): Drupal PSA-2026-10-20: PHP critical release on 21 Oct 14:00 UTC; updating PHP is the only complete mitigation; site owners are responsible for the hosting platform.

Supports: project response: CMS ecosystem told to update PHP; board breaking-0002.

#### Capture notes

Language `en`. tools/capture_batch.mjs (Playwright Chromium), HTTP 200, captured 2026-10-27T19:13:45Z. Nothing in the page addresses an AI or hides text from a reader.

## Claims that cite it

No claim cites this source yet.

## Events that cite it

No timeline event cites this source yet.

## The bytes
capture 20261027T191336Z · HTTP 200 · https://www.drupal.org/psa-2026-10-20- `headers.json` 0bf568278c74489b4ef9d7a971f929ea8a156473310b1b0889a97427c7309470 1,273 bytes
- `page.html` f6a139b7ce3337806dde6df3da346c3ba83d88f9ceecfd3e355336dfd61b5b46 31,183 bytes
- `provenance.json` 1384273c3132676e4981c87678ce0554c3081549726d8e0d0173ff774ec6183d 1,596 bytes
- `rendered.html` f9f2ba5e4ab4df5f5c8dccf476578b7ff4f7f4632af14bfbd973024dfc0cbdab 31,443 bytes
- `screenshot.jpg` 9fc92ebc65f8f755102471e633cd9fb9344ec78aa01fb0f075f5d79f668fdc43 211,397 bytes
- `text.txt` da82b243edfadb9d1c5be1841e0b5324c0eea8ec6a931909185927fb58d4e280 3,235 bytes

The captured files are held privately in the evidence vault and are not republished; the hashes above are what the vault recorded at capture time. [Every source →](../index.html)


---
site v0.22.49 · data as of 2026-10-27T19:13Z · vault commit 6f0d5c50bf12 · https://refs.php.oct.2026.newsroom.sgit.ai/sources/drupal-psa-2026-10-20/index.html