PHP 8.5.12 Released!
Critical · CVSS 9.2
The PHP development team announces the immediate availability of PHP 8.5.12. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.5 users are strongly encouraged to update immediately. There are no complete mitigations, updating is the only safe choice. See the security advisory for details. For source downloads of PHP 8.5.12 please visit our downloads page , Windows source and binaries can also be found there . The list of changes is recorded in the ChangeLog .
Remediation
Update PHP to the fixed release for your branch (8.2.35, 8.3.36, 8.4.27, 8.5.12). Branches below 8.2 have no fixed release — upgrade the branch or take the site offline.
Affected PHP branches
{'branch': '8.2', 'fixed_in': '8.2.35', 'status': 'patched release available'}, {'branch': '8.3', 'fixed_in': '8.3.36', 'status': 'patched release available'}, {'branch': '8.4', 'fixed_in': '8.4.27', 'status': 'patched release available'}, {'branch': '8.5', 'fixed_in': '8.5.12', 'status': 'patched release available'}, {'branch': '<8.2', 'fixed_in': None, 'status': 'end-of-life — no fixed release; branch upgrade required'}
Source: PHP.net News · retrieved 2026-10-22T10:19:14-04:00 · https://www.php.net/index.php#2026-10-21-4