On Tuesday, two numbers started going around online, a pair of CVE IDs for PHP, with the wrong score and the wrong release time attached. Within a day, every supported version of PHP had an emergency release out, a day ahead of schedule, and by the release, government websites in four countries had gone dark on purpose. A bug first glimpsed in 2024, that nobody could prove was exploitable, until a few months ago, somebody did.

Hello world, it's Thursday, October 22, 2026, and here's what happened This Week in PHP Internals. There was no episode last week. I was in Austin for Longhorn PHP, and it never got recorded, so I'm sorry about that. This one covers both weeks. 18 stories, so let's get into it. But first,

What does your team pay every month to get a PDF signed, or to keep every app's logs somewhere you can search them? Scalpels replaces subscriptions like those with open source apps you host yourself.…