🚨 PHP developers: Check your production PHP version. A critical security update is out.

#cybersecurity #php #security

On October 21, the PHP team released security updates for PHP 8.5, 8.4, 8.3 and 8.2.

The patched versions are:

🔹 PHP 8.5.12

🔹 PHP 8.4.27

🔹 PHP 8.3.36

🔹 PHP 8.2.35

These releases address two critical vulnerabilities:

• CVE-2026-109618 — related to out-of-memory handling

• CVE-2026-109619 — related to stale internal state

Both can potentially lead to remote code execution without authentication. That means the issue isn't limited to application-level bugs.

Here's what I'd check as a backend engineer:

✅ Identify the PHP versions running across production servers, containers and CI/CD environments.

✅ Check whether your hosting provider or Linux distribution has supplied patched packages.

✅ Update to a fixed version and restart PHP workers or services where required.

✅ Verify the running version after deployment.

✅ Review your upgrade plan if you're still using an unsupported PHP branch.

One more important detail: PHP 8.2 reaches end of life on December 31, 2026, so teams using it should also plan their next upgrade.

Modern frameworks, clean architecture and automated tests are important—but keeping the underlying runtime secure is equally important.

When was the last time you checked the PHP version running in your production environment?

DEV Community