PHP 8.2.35 Released!
Critical · CVSS 9.2
The PHP development team announces the immediate availability of PHP 8.2.35. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.2 users are strongly encouraged to update immediately. There are no complete mitigations, updating is the only safe choice. See the security advisory for details. PHP 8.2 reaches end of life on 31 December 2026 and will receive no further security fixes after that date. Please plan your upgrade to a supported version.
Remediation
Update PHP to the fixed release for your branch (8.2.35, 8.3.36, 8.4.27, 8.5.12). Branches below 8.2 have no fixed release — upgrade the branch or take the site offline.
Affected PHP branches
{'branch': '8.2', 'fixed_in': '8.2.35', 'status': 'patched release available'}, {'branch': '8.3', 'fixed_in': '8.3.36', 'status': 'patched release available'}, {'branch': '8.4', 'fixed_in': '8.4.27', 'status': 'patched release available'}, {'branch': '8.5', 'fixed_in': '8.5.12', 'status': 'patched release available'}, {'branch': '<8.2', 'fixed_in': None, 'status': 'end-of-life — no fixed release; branch upgrade required'}
Source: PHP.net News · retrieved 2026-10-22T10:19:14-04:00 · https://www.php.net/index.php#2026-10-21-1