PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 out

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two crucial vulnerabilities that can authorize unauthenticated distant code execution. All PHP users are powerfully encouraged to update immediately.

Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache alongside mod_php, php-cgi, FrankenPHP and LiteSpeed. We regard the hazard highest for mod_php, alongside a demonstrated utilize anywhere an unauthenticated petition can trigger the assault before any use code runs.

The vulnerabilities:

• RCE via OOM corruption, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory handling can interrupt PHP during inner petition data is lone partially initialized. Request cleanup may afterward treat the invalid data as valid.
• RCE via old earth state, CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): request-owned internal province can last following its assistance recollection has been freed. A afterward petition handled by the identical employee may use that old province before normal initialization resets it.

How to update:

• Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Source downloads are on our downloads page. Windows origin and binaries are on the identical page.
• Linux distributions and LTS vendors received the patches in advance, so inspect your vendor for updated packages.
• PHP 8.1 and older no longer obtain updates from the PHP project. Some distributions and LTS vendors provision backported fixes, so communication your vendor for details, or upgrade to a supported version.
• If you depend on the volunteer-maintained rpms.remirepo.net, we encourage you to toggle to allocation packages or build from source, so you can immediately use updates. The repo volition not have updates today.
• Given the severity of these vulnerabilities, the PHP safety squad provided minimal source-backports for PHP 7.4, PHP 8.0, and PHP 8.1 to assistance group construction from origin or without admission to an LTS vendor.

If you cannot update immediately: during lone an update is a complete solution, the following measures decrease visibility to particular assault paths but do not create an facility safe.

RCE via OOM misconduct (CVE-2026-109618):

• Set memory_limit=-1, preferably in a way applications can't override, specified as php_admin_value in the FPM pond or Apache configuration, and inspect that no pool, directory or use environment puts a finite bounds back. This removes the controllable PHP recollection bounds failure, but an underlying allocation nonaccomplishment can motionless attain the susceptible path.
• Set a low post_max_size. For applications that don't necessitate document uploads, set post_max_size = 8M. If document uploads are necessary, set post_max_size = 32M. Keep upload_max_filesize below post_max_size. Consider enforcing limits at the web server or proxy flat for decoded petition size, input site count, multipart part count, header count, and nesting depth. These limits must additionally shield requests without a usable Content-Length.
• Use a receptacle or cgroup bounds as an preparedness boundary, preferably alongside a guideline that kills lone the affected worker. Do not substitute RLIMIT_AS or RLIMIT_DATA, as these can logic the susceptible allocation failure.

RCE via old earth province (CVE-2026-109619):

• Set session.upload_progress.enabled=0 and restart all worker. Use php.ini, an FPM pond or server configuration that applies before petition parsing. Do not depend on ini_set() or FPM .user.ini. This blocks the confirmed meeting paths but not another variants.
• On PHP 8.5, set fatal_error_backtraces=0 and restart all worker. This blocks the confirmed fatal backtrace way only.
• Remove invalid or deprecated settings applied per petition that emit diagnostics before initialization. Hiding diagnostics alongside error_reporting, display_errors or @ does not help.
• Fix attacker-reachable fatal errors and implementation timeouts, including failures in callbacks, upload or import handling and cleanup.

The advisories connected complete have the complete specialized details.

The PHP betterment squad announces the contiguous preparedness of PHP 8.5.12. This is a safety publish fixing two crucial vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can authorize unauthenticated remote code execution. All PHP 8.5 users are powerfully encouraged to update immediately.

There are no complete mitigations, updating is the lone harmless choice. See the security advisory for details.

For origin downloads of PHP 8.5.12 delight sojourn our downloads page, Windows origin and binaries can additionally be established there. The catalog of changes is recorded in the ChangeLog.

The PHP betterment squad announces the contiguous preparedness of PHP 8.4.27. This is a safety publish fixing two crucial vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can authorize unauthenticated remote code execution. All PHP 8.4 users are powerfully encouraged to update immediately.

There are no complete mitigations, updating is the lone harmless choice. See the security advisory for details.

For origin downloads of PHP 8.4.27 delight sojourn our downloads page, Windows origin and binaries can additionally be established there. The catalog of changes is recorded in the ChangeLog.

The PHP betterment squad announces the contiguous preparedness of PHP 8.3.36. This is a safety publish fixing two crucial vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can authorize unauthenticated remote code execution. All PHP 8.3 users are powerfully encouraged to update immediately.

There are no complete mitigations, updating is the lone harmless choice. See the security advisory for details.

For origin downloads of PHP 8.3.36 delight sojourn our downloads page, Windows origin and binaries can additionally be established there. The catalog of changes is recorded in the ChangeLog.

The PHP betterment squad announces the contiguous preparedness of PHP 8.2.35. This is a safety publish fixing two crucial vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can authorize unauthenticated remote code execution. All PHP 8.2 users are powerfully encouraged to update immediately.

There are no complete mitigations, updating is the lone harmless choice. See the security advisory for details.

PHP 8.2 reaches end of existence on 31 December 2026 and volition obtain no further safety fixes following that date. Please scheme your upgrade to a supported version.

For origin downloads of PHP 8.2.35 delight sojourn our downloads page, Windows origin and binaries can additionally be established there. The catalog of changes is recorded in the ChangeLog.

The PHP safety squad would akin to provision advancement notice of an upcoming safety release.

It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.

It addresses two crucial vulnerabilities, the two rated CVSS v4.0 9.2.

All PHP users are encouraged to prepared now so they can upgrade as shortly as the publish is available.

We reserve the correct to publish before should particulars of either exposure rotate into public, or should evidence of energetic exploitation appear in the wild.

Full details, affected versions, and the fixed versions volition be published alongside the release.

Thank you for assisting us keep PHP secure.

The PHP squad is pleased to province the archetypal publish applicant of PHP 8.6.0, RC3. This continues the PHP 8.6 publish cycle, whose coarse outline is stated in the PHP Wiki.

Source downloads of PHP 8.6.0 RC3 are accessible on the download page.

Please carefully test this type and study any issues established in the GitHub Issues.

Please DO NOT use this type in production, it is an first test version.

For additional data on the new features and another changes, you can peruse the NEWS file, or the UPGRADING document for a complete catalog of upgrading notes. These records can additionally be established in the publish archive.

The next publish volition be RC4, planned for 22 October 2026.

The signatures for the publish can be established in the manifest or on the pre-release builds page.

Thank you for assisting us create PHP better.

The PHP betterment squad announces the contiguous preparedness of PHP 8.4.26. This is a safety release.

All PHP 8.4 users are encouraged to upgrade to this version.

For origin downloads of PHP 8.4.26 delight sojourn our downloads page, Windows origin and binaries can additionally be established there. The catalog of changes is recorded in the ChangeLog.

The PHP betterment squad announces the contiguous preparedness of PHP 8.2.34. This is a safety release.

All PHP 8.2 users are encouraged to upgrade to this version.

For origin downloads of PHP 8.2.34 delight sojourn our downloads page, Windows origin and binaries can additionally be established there. The catalog of changes is recorded in the ChangeLog.

The PHP betterment squad announces the contiguous preparedness of PHP 8.5.11. This is a safety release.

All PHP 8.5 users are encouraged to upgrade to this version.

For origin downloads of PHP 8.5.11 delight sojourn our downloads page, Windows origin and binaries can additionally be established there. The catalog of changes is recorded in the ChangeLog.

The PHP betterment squad announces the contiguous preparedness of PHP 8.3.35. This is a safety release.

All PHP 8.3 users are encouraged to upgrade to this version.

For origin downloads of PHP 8.3.35 delight sojourn our downloads page, Windows origin and binaries can additionally be established there. The catalog of changes is recorded in the ChangeLog.

The PHP squad is pleased to province the archetypal publish applicant of PHP 8.6.0, RC2. It is not a typo: a error was made during packaging RC1, so RC2 was released instead. For a complete explanation, delight see this blog post. This continues the PHP 8.6 publish cycle, whose coarse outline is stated in the PHP Wiki.

Source downloads of PHP 8.6.0 RC2 are accessible on the download page.

Please carefully test this type and study any issues established in the GitHub Issues.

Please DO NOT use this type in production, it is an first test version.

For additional data on the new features and another changes, you can peruse the NEWS file, or the UPGRADING document for a complete catalog of upgrading notes. These records can additionally be established in the publish archive.

The next publish volition be RC3, planned for 8 October 2026.

The signatures for the publish can be established in the manifest or on the pre-release builds page.

Thank you for assisting us create PHP better.

The PHP squad is pleased to province the third beta publish of PHP 8.6.0, Beta 3. This continues the PHP 8.6 publish cycle, the coarse outline of which is stated in the PHP Wiki.

For origin downloads of PHP 8.6.0 Beta 3 delight sojourn the download page.

Please carefully test this type and study any issues established on GitHub.

Please DO NOT use this type in production, it is an first test version.

For additional data on the new features and another changes, you can peruse the NEWS file, or the UPGRADING document for a complete catalog of upgrading notes. These records can additionally be established in the publish archive.

The next publish volition be RC 1, planned for 24 September 2026.

The signatures for the publish can be established in the manifest or on the Release Candidates page.

Thank you for assisting us create PHP better.

The PHP betterment squad announces the contiguous preparedness of PHP 8.5.10. This is a bug fix release.

All PHP 8.5 users are encouraged to upgrade to this version.

For origin downloads of PHP 8.5.10 delight sojourn our downloads page, Windows origin and binaries can additionally be established there. The catalog of changes is recorded in the ChangeLog.

The PHP betterment squad announces the contiguous preparedness of PHP 8.4.25. This is a bug fix release.

All PHP 8.4 users are encouraged to upgrade to this version.

For origin downloads of PHP 8.4.25 delight sojourn our downloads page, Windows origin and binaries can additionally be established there. The catalog of changes is recorded in the ChangeLog.

The PHP squad is pleased to province a new beta publish of PHP 8.6.0, Beta 2. This continues the PHP 8.6 publish cycle, the coarse outline of which is stated in the PHP Wiki.

For origin downloads of PHP 8.6.0 Beta 2 delight sojourn the download page.

Please carefully test this type and study any issues established on GitHub.

Please DO NOT use this type in production, it is an first test version.

For additional data on the new features and another changes, you can peruse the NEWS file, or the UPGRADING document for a complete catalog of upgrading notes. These records can additionally be established in the publish archive.

The next publish volition be Beta 3, planned for 10 Sep 2026.

The signatures for the publish can be established in the manifest or on the Release Candidates page.

Thank you for assisting us create PHP better.

The State of PHP survey is motionless open, but not for much longer. It asks how PHP is operating for you: what you build with, what is painful, and what you think PHP should concentration on next. It takes about 15 minutes.

The study is run by The PHP Foundation in alliance alongside PhpStorm by JetBrains.

The aggregated results volition be published afterward this twelvemonth as the State of PHP 2026 report. The anonymized raw dataset volition be released alongside alongside it, so anyone in the community can inspect the numbers or run their own analysis.

More responses average a improved image of what matters to PHP users. If you have not filled it in yet, delight do, and portion it alongside your colleagues and person groups.

The PHP squad is pleased to province the archetypal beta publish of PHP 8.6.0, Beta 1. This continues the PHP 8.6 publish cycle, the coarse outline of which is stated in the PHP Wiki.

For origin downloads of PHP 8.6.0 Beta 1 delight sojourn the download page.

Please carefully test this type and study any issues established on GitHub.

Please DO NOT use this type in production, it is an first test version.

For additional data on the new features and another changes, you can peruse the NEWS file, or the UPGRADING document for a complete catalog of upgrading notes. These records can additionally be established in the publish archive.

The next publish volition be Beta 2, planned for 27 Aug 2026.

The signatures for the publish can be established in the manifest or on the Release Candidates page.

Thank you for assisting us create PHP better.

The PHP betterment squad announces the contiguous preparedness of PHP 8.4.24. This is a safety release.

All PHP 8.4 users are encouraged to upgrade to this version.

For origin downloads of PHP 8.4.24 delight sojourn our downloads page, Windows origin and binaries can additionally be established there. The catalog of changes is recorded in the ChangeLog.

The PHP betterment squad announces the contiguous preparedness of PHP 8.3.33. This is a safety release.

All PHP 8.3 users are encouraged to upgrade to this version.

For origin downloads of PHP 8.3.33 delight sojourn our downloads page, Windows origin and binaries can additionally be established there. The catalog of changes is recorded in the ChangeLog.

The PHP squad is pleased to province the second evaluation publish of PHP 8.6.0, Alpha 3. This continues the PHP 8.6 publish cycle, the coarse outline of which is stated in the PHP Wiki.

For origin downloads of PHP 8.6.0 Alpha 3 delight sojourn the download page.

Please carefully test this type and study any issues established in the GitHub Issues.

Please DO NOT use this type in production, it is an first test version.

For additional data on the new features and another changes, you can peruse the NEWS file, or the UPGRADING document for a complete catalog of upgrading notes. These records can additionally be established in the publish archive.

The next publish volition be Beta 1, planned for 13 August 2026.

The signatures for the publish can be established in the manifest or on the pre-release builds page.

Thank you for assisting us create PHP better.

The PHP betterment squad announces the contiguous preparedness of PHP 8.5.9. This is a safety release.

All PHP 8.5 users are encouraged to upgrade to this version.

For origin downloads of PHP 8.5.9 delight sojourn our downloads page, Windows origin and binaries can additionally be established there. The catalog of changes is recorded in the ChangeLog.

The PHP betterment squad announces the contiguous preparedness of PHP 8.2.33. This is a safety release.

All PHP 8.2 users are encouraged to upgrade to this version.

For origin downloads of PHP 8.2.33 delight sojourn our downloads page, Windows origin and binaries can additionally be established there. The catalog of changes is recorded in the ChangeLog.

The PHP squad is pleased to province the second evaluation publish of PHP 8.6.0, Alpha 2. This continues the PHP 8.6 publish cycle, the coarse outline of which is stated in the PHP Wiki.

For origin downloads of PHP 8.6.0 Alpha 2 delight sojourn the download page.

Please carefully test this type and study any issues established in the GitHub Issues.

Please DO NOT use this type in production, it is an first test version.

For additional data on the new features and another changes, you can peruse the NEWS file, or the UPGRADING document for a complete catalog of upgrading notes. These records can additionally be established in the publish archive.

The next publish volition be Alpha 3, planned for 30 July 2026.

The signatures for the publish can be established in the manifest or on the pre-release builds page.

Thank you for assisting us create PHP better.

The PHP betterment squad announces the contiguous preparedness of PHP 8.5.8. This is a safety release.

All PHP 8.5 users are encouraged to upgrade to this version.

For origin downloads of PHP 8.5.8 delight sojourn our downloads page, Windows origin and binaries can additionally be established there. The catalog of changes is recorded in the ChangeLog.