On 21 October 2026 PHP published four releases tagged "security": 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They fix two critical remote-code-execution flaws, CVE-2026-109618 and CVE-2026-109619 (the OSV database lists the same four versions as fixed). PHP 8.1 and older got no official fixed release.
| Branch | Fixed in | Support ends (endoflife.date, read 22 Oct 2026) |
|---|---|---|
| 8.5 | 8.5.12 | 2029-12-31 |
| 8.4 | 8.4.27 | 2028-12-31 |
| 8.3 | 8.3.36 | 2027-12-31 |
| 8.2 | 8.2.35 | 2026-12-31 |
| 8.1 and older | no official fix | 8.1 ended 2025-12-31 |
What the sources say about exploitation: Rapid7 (21 October) says a viable exploit is expected to be made public soon, exploitation in the wild is expected, and it recommends updating on an emergency basis. Tenable reports that Amazon Threat Intelligence observed an exploitation attempt on 17 October and more on 21 October, and that Amazon says it is unclear whether those attempts would have succeeded against real systems. Reports differ between sources and change quickly, so check php.net and your host's notices for the current status.
Two practical points when you check your own servers:
- Read the version from the PHP that serves the site. The command-line
php -vcan differ from PHP-FPM, and FPM must be restarted after an update. - Linux distribution packages can include a fix without changing the version number, so check your distribution's security notice before you decide a server is behind.
If it helps: I made a small free page where you type a version and it says whether it is at or above the fixed release and when its branch ends: https://samaanmohammed-art.github.io/php-patch-check/ . It only compares the number you type; it connects to nothing and does not scan or protect anything. For agencies with many sites I also made a $19 spreadsheet-and-email kit (disclosure: both are mine): https://samaanmohammed.gumroad.com/l/xvsyxe . Data as of 22 October 2026; no security or legal advice.
Top comments (0)