PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.
\nWho is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.
\nThe vulnerabilities:
\nHow to update:
\nIf you cannot update immediately: while only an update is a complete solution, the following measures reduce exposure to specific attack paths but do not make an installation safe.
\nRCE via OOM corruption (CVE-2026-109618):
\nmemory_limit=-1, preferably in a way applications can't override, such as php_admin_value in the FPM pool or Apache configuration, and check that no pool, directory or application setting puts a finite limit back. This removes the controllable PHP memory limit failure, but an underlying allocation failure can still reach the vulnerable path.post_max_size. For applications that don't require file uploads, set post_max_size = 8M. If file uploads are necessary, set post_max_size = 32M. Keep upload_max_filesize below post_max_size. Consider enforcing limits at the web server or proxy level for decoded request size, input field count, multipart part count, header count, and nesting depth. These limits must also cover requests without a usable Content-Length.RLIMIT_AS or RLIMIT_DATA, as these can cause the vulnerable allocation failure.RCE via stale global state (CVE-2026-109619):
\nsession.upload_progress.enabled=0 and restart every worker. Use php.ini, an FPM pool or server configuration that applies before request parsing. Do not rely on ini_set() or FPM .user.ini. This blocks the confirmed session paths but not other variants.fatal_error_backtraces=0 and restart every worker. This blocks the confirmed fatal backtrace path only.error_reporting, display_errors or @ does not help.The advisories linked above have the full technical details.
\n21 Oct 2026
\nThe PHP development team announces the immediate availability of PHP 8.5.12. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.5 users are strongly encouraged to update immediately.
\nThere are no complete mitigations, updating is the only safe choice. See the security advisory for details.
\nFor source downloads of PHP 8.5.12 please visit our downloads page, Windows source and binaries can also be found there. The list of changes is recorded in the ChangeLog.
\n21 Oct 2026
\nThe PHP development team announces the immediate availability of PHP 8.4.27. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.4 users are strongly encouraged to update immediately.
\nThere are no complete mitigations, updating is the only safe choice. See the security advisory for details.
\nFor source downloads of PHP 8.4.27 please visit our downloads page, Windows source and binaries can also be found there. The list of changes is recorded in the ChangeLog.
\n21 Oct 2026
\nThe PHP development team announces the immediate availability of PHP 8.3.36. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.3 users are strongly encouraged to update immediately.
\nThere are no complete mitigations, updating is the only safe choice. See the security advisory for details.
\nFor source downloads of PHP 8.3.36 please visit our downloads page, Windows source and binaries can also be found there. The list of changes is recorded in the ChangeLog.
\n21 Oct 2026
\nThe PHP development team announces the immediate availability of PHP 8.2.35. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.2 users are strongly encouraged to update immediately.
\nThere are no complete mitigations, updating is the only safe choice. See the security advisory for details.
\nPHP 8.2 reaches end of life on 31 December 2026 and will receive no further security fixes after that date. Please plan your upgrade to a supported version.
\nFor source downloads of PHP 8.2.35 please visit our downloads page, Windows source and binaries can also be found there. The list of changes is recorded in the ChangeLog.
\n20 Oct 2026
\nThe PHP security team would like to give advance notice of an upcoming security release.
\nIt is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.
\nIt addresses two critical vulnerabilities, both rated CVSS v4.0 9.2.
\nAll PHP users are encouraged to prepare now so they can upgrade as soon as the release is available.
\nWe reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.
\nFull details, affected versions, and the fixed versions will be published with the release.
\nThank you for helping us keep PHP secure.
\n08 Oct 2026
\nThe PHP team is pleased to announce the first release candidate of PHP 8.6.0, RC3. This continues the PHP 8.6 release cycle, whose rough outline is specified in the PHP Wiki.
\nSource downloads of PHP 8.6.0 RC3 are available on the download page.
\nPlease carefully test this version and report any issues found in the GitHub Issues.
\nPlease DO NOT use this version in production, it is an early test version.
\nFor more information on the new features and other changes, you can read the NEWS file, or the UPGRADING file for a complete list of upgrading notes. These files can also be found in the release archive.
\nThe next release will be RC4, planned for 22 October 2026.
\nThe signatures for the release can be found in the manifest or on the pre-release builds page.
\nThank you for helping us make PHP better.
\n24 Sep 2026
\nThe PHP development team announces the immediate availability of PHP 8.4.26. This is a security release.
\nAll PHP 8.4 users are encouraged to upgrade to this version.
\nFor source downloads of PHP 8.4.26 please visit our downloads page, Windows source and binaries can also be found there. The list of changes is recorded in the ChangeLog.
\n24 Sep 2026
\nThe PHP development team announces the immediate availability of PHP 8.2.34. This is a security release.
\nAll PHP 8.2 users are encouraged to upgrade to this version.
\nFor source downloads of PHP 8.2.34 please visit our downloads page, Windows source and binaries can also be found there. The list of changes is recorded in the ChangeLog.
\n24 Sep 2026
\nThe PHP development team announces the immediate availability of PHP 8.5.11. This is a security release.
\nAll PHP 8.5 users are encouraged to upgrade to this version.
\nFor source downloads of PHP 8.5.11 please visit our downloads page, Windows source and binaries can also be found there. The list of changes is recorded in the ChangeLog.
\n24 Sep 2026
\nThe PHP development team announces the immediate availability of PHP 8.3.35. This is a security release.
\nAll PHP 8.3 users are encouraged to upgrade to this version.
\nFor source downloads of PHP 8.3.35 please visit our downloads page, Windows source and binaries can also be found there. The list of changes is recorded in the ChangeLog.
\n24 Sep 2026
\nThe PHP team is pleased to announce the first release candidate of PHP 8.6.0, RC2. It is not a typo: a mistake was made while packaging RC1, so RC2 was released instead. For a full explanation, please see this blog post. This continues the PHP 8.6 release cycle, whose rough outline is specified in the PHP Wiki.
\nSource downloads of PHP 8.6.0 RC2 are available on the download page.
\nPlease carefully test this version and report any issues found in the GitHub Issues.
\nPlease DO NOT use this version in production, it is an early test version.
\nFor more information on the new features and other changes, you can read the NEWS file, or the UPGRADING file for a complete list of upgrading notes. These files can also be found in the release archive.
\nThe next release will be RC3, planned for 8 October 2026.
\nThe signatures for the release can be found in the manifest or on the pre-release builds page.
\nThank you for helping us make PHP better.
\n10 Sep 2026
\nThe PHP team is pleased to announce the third beta release of PHP 8.6.0, Beta 3. This continues the PHP 8.6 release cycle, the rough outline of which is specified in the PHP Wiki.
\nFor source downloads of PHP 8.6.0 Beta 3 please visit the download page.
\nPlease carefully test this version and report any issues found on GitHub.
\nPlease DO NOT use this version in production, it is an early test version.
\nFor more information on the new features and other changes, you can read the NEWS file, or the UPGRADING file for a complete list of upgrading notes. These files can also be found in the release archive.
\nThe next release will be RC 1, planned for 24 September 2026.
\nThe signatures for the release can be found in the manifest or on the Release Candidates page.
\nThank you for helping us make PHP better.
\n27 Aug 2026
\nThe PHP development team announces the immediate availability of PHP 8.5.10. This is a bug fix release.
\nAll PHP 8.5 users are encouraged to upgrade to this version.
\nFor source downloads of PHP 8.5.10 please visit our downloads page, Windows source and binaries can also be found there. The list of changes is recorded in the ChangeLog.
\n27 Aug 2026
\nThe PHP development team announces the immediate availability of PHP 8.4.25. This is a bug fix release.
\nAll PHP 8.4 users are encouraged to upgrade to this version.
\nFor source downloads of PHP 8.4.25 please visit our downloads page, Windows source and binaries can also be found there. The list of changes is recorded in the ChangeLog.
\n27 Aug 2026
\nThe PHP team is pleased to announce a new beta release of PHP 8.6.0, Beta 2. This continues the PHP 8.6 release cycle, the rough outline of which is specified in the PHP Wiki.
\nFor source downloads of PHP 8.6.0 Beta 2 please visit the download page.
\nPlease carefully test this version and report any issues found on GitHub.
\nPlease DO NOT use this version in production, it is an early test version.
\nFor more information on the new features and other changes, you can read the NEWS file, or the UPGRADING file for a complete list of upgrading notes. These files can also be found in the release archive.
\nThe next release will be Beta 3, planned for 10 Sep 2026.
\nThe signatures for the release can be found in the manifest or on the Release Candidates page.
\nThank you for helping us make PHP better.
\n25 Aug 2026
\nThe State of PHP survey is still open, but not for much longer. It asks how PHP is working for you: what you build with, what is painful, and what you think PHP should focus on next. It takes around 15 minutes.
\nThe survey is run by The PHP Foundation in partnership with PhpStorm by JetBrains.
\nThe aggregated results will be published later this year as the State of PHP 2026 report. The anonymized raw dataset will be released along with it, so anyone in the community can check the numbers or run their own analysis.
\nMore responses mean a better picture of what matters to PHP users. If you have not filled it in yet, please do, and share it with your colleagues and user groups.
\n13 Aug 2026
\nThe PHP team is pleased to announce the first beta release of PHP 8.6.0, Beta 1. This continues the PHP 8.6 release cycle, the rough outline of which is specified in the PHP Wiki.
\nFor source downloads of PHP 8.6.0 Beta 1 please visit the download page.
\nPlease carefully test this version and report any issues found on GitHub.
\nPlease DO NOT use this version in production, it is an early test version.
\nFor more information on the new features and other changes, you can read the NEWS file, or the UPGRADING file for a complete list of upgrading notes. These files can also be found in the release archive.
\nThe next release will be Beta 2, planned for 27 Aug 2026.
\nThe signatures for the release can be found in the manifest or on the Release Candidates page.
\nThank you for helping us make PHP better.
\n30 Jul 2026
\nThe PHP development team announces the immediate availability of PHP 8.4.24. This is a security release.
\nAll PHP 8.4 users are encouraged to upgrade to this version.
\nFor source downloads of PHP 8.4.24 please visit our downloads page, Windows source and binaries can also be found there. The list of changes is recorded in the ChangeLog.
\n30 Jul 2026
\nThe PHP development team announces the immediate availability of PHP 8.3.33. This is a security release.
\nAll PHP 8.3 users are encouraged to upgrade to this version.
\nFor source downloads of PHP 8.3.33 please visit our downloads page, Windows source and binaries can also be found there. The list of changes is recorded in the ChangeLog.
\n30 Jul 2026
\nThe PHP team is pleased to announce the second testing release of PHP 8.6.0, Alpha 3. This continues the PHP 8.6 release cycle, the rough outline of which is specified in the PHP Wiki.
\nFor source downloads of PHP 8.6.0 Alpha 3 please visit the download page.
\nPlease carefully test this version and report any issues found in the GitHub Issues.
\nPlease DO NOT use this version in production, it is an early test version.
\nFor more information on the new features and other changes, you can read the NEWS file, or the UPGRADING file for a complete list of upgrading notes. These files can also be found in the release archive.
\nThe next release will be Beta 1, planned for 13 August 2026.
\nThe signatures for the release can be found in the manifest or on the pre-release builds page.
\nThank you for helping us make PHP better.
\n30 Jul 2026
\nThe PHP development team announces the immediate availability of PHP 8.5.9. This is a security release.
\nAll PHP 8.5 users are encouraged to upgrade to this version.
\nFor source downloads of PHP 8.5.9 please visit our downloads page, Windows source and binaries can also be found there. The list of changes is recorded in the ChangeLog.
\n30 Jul 2026
\nThe PHP development team announces the immediate availability of PHP 8.2.33. This is a security release.
\nAll PHP 8.2 users are encouraged to upgrade to this version.
\nFor source downloads of PHP 8.2.33 please visit our downloads page, Windows source and binaries can also be found there. The list of changes is recorded in the ChangeLog.
\n16 Jul 2026
\nThe PHP team is pleased to announce the second testing release of PHP 8.6.0, Alpha 2. This continues the PHP 8.6 release cycle, the rough outline of which is specified in the PHP Wiki.
\nFor source downloads of PHP 8.6.0 Alpha 2 please visit the download page.
\nPlease carefully test this version and report any issues found in the GitHub Issues.
\nPlease DO NOT use this version in production, it is an early test version.
\nFor more information on the new features and other changes, you can read the NEWS file, or the UPGRADING file for a complete list of upgrading notes. These files can also be found in the release archive.
\nThe next release will be Alpha 3, planned for 30 July 2026.
\nThe signatures for the release can be found in the manifest or on the pre-release builds page.
\nThank you for helping us make PHP better.
\n02 Jul 2026
\nThe PHP development team announces the immediate availability of PHP 8.5.8. This is a security release.
\nAll PHP 8.5 users are encouraged to upgrade to this version.
\nFor source downloads of PHP 8.5.8 please visit our downloads page, Windows source and binaries can also be found there. The list of changes is recorded in the ChangeLog.
\n\n", "content_markdown": "## [Security advisory: Critical remote code execution vulnerabilities, update now](https://www.php.net/archive/2026.php#2026-10-21-5)\n\n**PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.**\n\n**Who is at risk:** all PHP installations serving web requests, including PHP-FPM, Apache with mod\\_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod\\_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.\n\n**The vulnerabilities:**\n\n- **RCE via OOM corruption**, CVE-2026-109618 ([GHSA-w8hw-w9fx-j79w](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w)): out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.\n- **RCE via stale global state**, CVE-2026-109619 ([GHSA-6wmf-4rv5-p3rp](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp)): request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.\n\n**How to update:**\n\n- Update to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Source downloads are on our [downloads page](https://www.php.net/downloads.php?source=Y). Windows source and binaries are [on the same page](https://www.php.net/downloads.php?os=windows).\n- Linux distributions and LTS vendors received the patches in advance, so check your vendor for updated packages.\n- **PHP 8.1 and older** no longer receive updates from the PHP project. Some distributions and LTS vendors provide backported fixes, so contact your vendor for details, or upgrade to a supported version.\n- Given the severity of these vulnerabilities, the PHP security team provided minimal source-backports for [PHP 7.4](https://github.com/php/php-src/tree/PHP-7.4-CVE-2026-109618-109619), [PHP 8.0](https://github.com/php/php-src/tree/PHP-8.0-CVE-2026-109618-109619), and [PHP 8.1](https://github.com/php/php-src/tree/PHP-8.1-CVE-2026-109618-109619) to help people building from source or without access to an LTS vendor.\n\n**If you cannot update immediately:** while only an update is a complete solution, the following measures reduce exposure to specific attack paths but do not make an installation safe.\n\n**RCE via OOM corruption (CVE-2026-109618):**\n\n- Set `memory_limit=-1`, preferably in a way applications can't override, such as `php_admin_value` in the FPM pool or Apache configuration, and check that no pool, directory or application setting puts a finite limit back. This removes the controllable PHP memory limit failure, but an underlying allocation failure can still reach the vulnerable path.\n- Set a low `post_max_size`. For applications that don't require file uploads, set `post_max_size = 8M`. If file uploads are necessary, set `post_max_size = 32M`. Keep `upload_max_filesize` below `post_max_size`. Consider enforcing limits at the web server or proxy level for decoded request size, input field count, multipart part count, header count, and nesting depth. These limits must also cover requests without a usable `Content-Length`.\n- Use a container or cgroup limit as an availability boundary, preferably with a policy that kills only the affected worker. Do not substitute `RLIMIT_AS` or `RLIMIT_DATA`, as these can cause the vulnerable allocation failure.\n\n**RCE via stale global state (CVE-2026-109619):**\n\n- Set `session.upload_progress.enabled=0` and restart every worker. Use `php.ini`, an FPM pool or server configuration that applies before request parsing. Do not rely on `ini_set()` or FPM `.user.ini`. This blocks the confirmed session paths but not other variants.\n- On PHP 8.5, set `fatal_error_backtraces=0` and restart every worker. This blocks the confirmed fatal backtrace path only.\n- Remove invalid or deprecated settings applied per request that emit diagnostics before initialization. Hiding diagnostics with `error_reporting`, `display_errors` or `@` does not help.\n- Fix attacker-reachable fatal errors and execution timeouts, including failures in callbacks, upload or import processing and cleanup.\n\nThe advisories linked above have the full technical details.\n\n21 Oct 2026\n\n## [PHP 8.5.12 Released!](https://www.php.net/archive/2026.php#2026-10-21-4)\n\nThe PHP development team announces the immediate availability of PHP 8.5.12. **This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.5 users are strongly encouraged to update immediately.**\n\nThere are no complete mitigations, updating is the only safe choice. See the [security advisory](https://www.php.net/archive/2026.php#2026-10-21-5) for details.\n\nFor source downloads of PHP 8.5.12 please visit our [downloads page](https://www.php.net/downloads.php), Windows source and binaries can also be found [there](https://www.php.net/downloads.php?os=windows&version=8.5). The list of changes is recorded in the [ChangeLog](https://www.php.net/ChangeLog-8.php#8.5.12).\n\n21 Oct 2026\n\n## [PHP 8.4.27 Released!](https://www.php.net/archive/2026.php#2026-10-21-3)\n\nThe PHP development team announces the immediate availability of PHP 8.4.27. **This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.4 users are strongly encouraged to update immediately.**\n\nThere are no complete mitigations, updating is the only safe choice. See the [security advisory](https://www.php.net/archive/2026.php#2026-10-21-5) for details.\n\nFor source downloads of PHP 8.4.27 please visit our [downloads page](https://www.php.net/downloads.php), Windows source and binaries can also be found [there](https://www.php.net/downloads.php?os=windows&version=8.4). The list of changes is recorded in the [ChangeLog](https://www.php.net/ChangeLog-8.php#8.4.27).\n\n21 Oct 2026\n\n## [PHP 8.3.36 Released!](https://www.php.net/archive/2026.php#2026-10-21-2)\n\nThe PHP development team announces the immediate availability of PHP 8.3.36. **This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.3 users are strongly encouraged to update immediately.**\n\nThere are no complete mitigations, updating is the only safe choice. See the [security advisory](https://www.php.net/archive/2026.php#2026-10-21-5) for details.\n\nFor source downloads of PHP 8.3.36 please visit our [downloads page](https://www.php.net/downloads.php), Windows source and binaries can also be found [there](https://www.php.net/downloads.php?os=windows&version=8.3). The list of changes is recorded in the [ChangeLog](https://www.php.net/ChangeLog-8.php#8.3.36).\n\n21 Oct 2026\n\n## [PHP 8.2.35 Released!](https://www.php.net/archive/2026.php#2026-10-21-1)\n\nThe PHP development team announces the immediate availability of PHP 8.2.35. **This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.2 users are strongly encouraged to update immediately.**\n\nThere are no complete mitigations, updating is the only safe choice. See the [security advisory](https://www.php.net/archive/2026.php#2026-10-21-5) for details.\n\nPHP 8.2 reaches end of life on 31 December 2026 and will receive no further security fixes after that date. Please plan your upgrade to a supported version.\n\nFor source downloads of PHP 8.2.35 please visit our [downloads page](https://www.php.net/downloads.php), Windows source and binaries can also be found [there](https://www.php.net/downloads.php?os=windows&version=8.2). The list of changes is recorded in the [ChangeLog](https://www.php.net/ChangeLog-8.php#8.2.35).\n\n20 Oct 2026\n\n## [Upcoming Critical PHP Security Release](https://www.php.net/archive/2026.php#2026-10-20-1)\n\nThe PHP security team would like to give advance notice of an **upcoming security release**.\n\n**It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.**\n\nIt addresses two critical vulnerabilities, both rated CVSS v4.0 9.2.\n\nAll PHP users are encouraged to prepare now so they can upgrade as soon as the release is available.\n\nWe reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.\n\nFull details, affected versions, and the fixed versions will be published with the release.\n\nThank you for helping us keep PHP secure.\n\n08 Oct 2026\n\n## [PHP 8.6.0 RC3 available for testing](https://www.php.net/archive/2026.php#2026-10-08-1)\n\nThe PHP team is pleased to announce the first release candidate of PHP 8.6.0, RC3. This continues the PHP 8.6 release cycle, whose rough outline is specified in the [PHP Wiki](https://wiki.php.net/todo/php86).\n\nSource downloads of PHP 8.6.0 RC3 are available on the [download page](https://downloads.php.net/~svpernova09/).\n\nPlease carefully test this version and report any issues found in the [GitHub Issues](https://github.com/php/php-src/issues/new?template=bug_report.yml).\n\n**Please DO NOT use this version in production, it is an early test version.**\n\nFor more information on the new features and other changes, you can read the [NEWS](https://github.com/php/php-src/blob/php-8.6.0RC3/NEWS) file, or the [UPGRADING](https://github.com/php/php-src/blob/php-8.6.0RC3/UPGRADING) file for a complete list of upgrading notes. These files can also be found in the release archive.\n\nThe next release will be RC4, planned for 22 October 2026.\n\nThe signatures for the release can be found in the [manifest](https://gist.github.com/svpernova09/f10879c681a9b7a74116294f3c48c01e) or on the [pre-release builds page](https://www.php.net/pre-release-builds.php).\n\nThank you for helping us make PHP better.\n\n24 Sep 2026\n\n## [PHP 8.4.26 Released!](https://www.php.net/archive/2026.php#2026-09-24-5)\n\nThe PHP development team announces the immediate availability of PHP 8.4.26. This is a security release.\n\nAll PHP 8.4 users are encouraged to upgrade to this version.\n\nFor source downloads of PHP 8.4.26 please visit our [downloads page](https://www.php.net/downloads.php), Windows source and binaries can also be found [there](https://www.php.net/downloads.php?os=windows&version=8.4). The list of changes is recorded in the [ChangeLog](https://www.php.net/ChangeLog-8.php#8.4.26).\n\n24 Sep 2026\n\n## [PHP 8.2.34 Released!](https://www.php.net/archive/2026.php#2026-09-24-4)\n\nThe PHP development team announces the immediate availability of PHP 8.2.34. This is a security release.\n\nAll PHP 8.2 users are encouraged to upgrade to this version.\n\nFor source downloads of PHP 8.2.34 please visit our [downloads page](https://www.php.net/downloads.php), Windows source and binaries can also be found [there](https://www.php.net/downloads.php?os=windows&version=8.2). The list of changes is recorded in the [ChangeLog](https://www.php.net/ChangeLog-8.php#8.2.34).\n\n24 Sep 2026\n\n## [PHP 8.5.11 Released!](https://www.php.net/archive/2026.php#2026-09-24-3)\n\nThe PHP development team announces the immediate availability of PHP 8.5.11. This is a security release.\n\nAll PHP 8.5 users are encouraged to upgrade to this version.\n\nFor source downloads of PHP 8.5.11 please visit our [downloads page](https://www.php.net/downloads.php), Windows source and binaries can also be found [there](https://www.php.net/downloads.php?os=windows&version=8.5). The list of changes is recorded in the [ChangeLog](https://www.php.net/ChangeLog-8.php#8.5.11).\n\n24 Sep 2026\n\n## [PHP 8.3.35 Released!](https://www.php.net/archive/2026.php#2026-09-24-2)\n\nThe PHP development team announces the immediate availability of PHP 8.3.35. This is a security release.\n\nAll PHP 8.3 users are encouraged to upgrade to this version.\n\nFor source downloads of PHP 8.3.35 please visit our [downloads page](https://www.php.net/downloads.php), Windows source and binaries can also be found [there](https://www.php.net/downloads.php?os=windows&version=8.3). The list of changes is recorded in the [ChangeLog](https://www.php.net/ChangeLog-8.php#8.3.35).\n\n24 Sep 2026\n\n## [PHP 8.6.0 RC2 available for testing](https://www.php.net/archive/2026.php#2026-09-24-1)\n\nThe PHP team is pleased to announce the first release candidate of PHP 8.6.0, RC2. It is not a typo: a mistake was made while packaging RC1, so RC2 was released instead. For a full explanation, please see this [blog post](https://scherzer.dev/Blog/20260923-no-php86-rc-1). This continues the PHP 8.6 release cycle, whose rough outline is specified in the [PHP Wiki](https://wiki.php.net/todo/php86).\n\nSource downloads of PHP 8.6.0 RC2 are available on the [download page](https://downloads.php.net/~mbeccati/).\n\nPlease carefully test this version and report any issues found in the [GitHub Issues](https://github.com/php/php-src/issues/new?template=bug_report.yml).\n\n**Please DO NOT use this version in production, it is an early test version.**\n\nFor more information on the new features and other changes, you can read the [NEWS](https://github.com/php/php-src/blob/php-8.6.0RC2/NEWS) file, or the [UPGRADING](https://github.com/php/php-src/blob/php-8.6.0RC2/UPGRADING) file for a complete list of upgrading notes. These files can also be found in the release archive.\n\nThe next release will be RC3, planned for 8 October 2026.\n\nThe signatures for the release can be found in the [manifest](https://gist.github.com/mbeccati/cfba591777a21f54badd12bf60bcecc9) or on the [pre-release builds page](https://www.php.net/pre-release-builds.php).\n\nThank you for helping us make PHP better.\n\n10 Sep 2026\n\n## [PHP 8.6.0 Beta 3 is available for testing](https://www.php.net/archive/2026.php#2026-09-10-1)\n\nThe PHP team is pleased to announce the third beta release of PHP 8.6.0, Beta 3. This continues the PHP 8.6 release cycle, the rough outline of which is specified in the [PHP Wiki](https://wiki.php.net/todo/php86).\n\nFor source downloads of PHP 8.6.0 Beta 3 please visit the [download page](https://downloads.php.net/~svpernova09/).\n\nPlease carefully test this version and report any issues found [on GitHub](https://github.com/php/php-src/issues/new?template=bug_report.yml).\n\n**Please DO NOT use this version in production, it is an early test version.**\n\nFor more information on the new features and other changes, you can read the [NEWS](https://github.com/php/php-src/blob/php-8.6.0beta3/NEWS) file, or the [UPGRADING](https://github.com/php/php-src/blob/php-8.6.0beta3/UPGRADING) file for a complete list of upgrading notes. These files can also be found in the release archive.\n\nThe next release will be RC 1, planned for 24 September 2026.\n\nThe signatures for the release can be found in the [manifest](https://gist.github.com/svpernova09/b5dc0b7b2ec231b3a5db54793c7ec1aa) or on the [Release Candidates page](https://www.php.net/release-candidates.php).\n\nThank you for helping us make PHP better.\n\n27 Aug 2026\n\n## [PHP 8.5.10 Released!](https://www.php.net/archive/2026.php#2026-08-27-3)\n\nThe PHP development team announces the immediate availability of PHP 8.5.10. This is a bug fix release.\n\nAll PHP 8.5 users are encouraged to upgrade to this version.\n\nFor source downloads of PHP 8.5.10 please visit our [downloads page](https://www.php.net/downloads.php), Windows source and binaries can also be found [there](https://www.php.net/downloads.php?os=windows&version=8.5). The list of changes is recorded in the [ChangeLog](https://www.php.net/ChangeLog-8.php#8.5.10).\n\n27 Aug 2026\n\n## [PHP 8.4.25 Released!](https://www.php.net/archive/2026.php#2026-08-27-2)\n\nThe PHP development team announces the immediate availability of PHP 8.4.25. This is a bug fix release.\n\nAll PHP 8.4 users are encouraged to upgrade to this version.\n\nFor source downloads of PHP 8.4.25 please visit our [downloads page](https://www.php.net/downloads.php), Windows source and binaries can also be found [there](https://www.php.net/downloads.php?os=windows&version=8.4). The list of changes is recorded in the [ChangeLog](https://www.php.net/ChangeLog-8.php#8.4.25).\n\n27 Aug 2026\n\n## [PHP 8.6.0 Beta 2 available for testing](https://www.php.net/archive/2026.php#2026-08-27-1)\n\nThe PHP team is pleased to announce a new beta release of PHP 8.6.0, Beta 2. This continues the PHP 8.6 release cycle, the rough outline of which is specified in the [PHP Wiki](https://wiki.php.net/todo/php86).\n\nFor source downloads of PHP 8.6.0 Beta 2 please visit the [download page](https://downloads.php.net/~mbeccati/).\n\nPlease carefully test this version and report any issues found [on GitHub](https://github.com/php/php-src/issues/new?template=bug_report.yml).\n\n**Please DO NOT use this version in production, it is an early test version.**\n\nFor more information on the new features and other changes, you can read the [NEWS](https://github.com/php/php-src/blob/php-8.6.0beta2/NEWS) file, or the [UPGRADING](https://github.com/php/php-src/blob/php-8.6.0beta1/UPGRADING) file for a complete list of upgrading notes. These files can also be found in the release archive.\n\nThe next release will be Beta 3, planned for 10 Sep 2026.\n\nThe signatures for the release can be found in the [manifest](https://gist.github.com/mbeccati/52a35ef482b1b73296176ba9176f17b2) or on the [Release Candidates page](https://www.php.net/release-candidates.php).\n\nThank you for helping us make PHP better.\n\n25 Aug 2026\n\n## [Last Call for the State of PHP Survey](https://www.php.net/archive/2026.php#2026-08-25-1)\n\nThe [State of PHP survey](https://surveys.jetbrains.com/s3/phpnet-state-of-php-2026) is still open, but not for much longer. It asks how PHP is working for you: what you build with, what is painful, and what you think PHP should focus on next. It takes around 15 minutes.\n\nThe survey is run by [The PHP Foundation](https://thephp.foundation/) in partnership with [PhpStorm](https://www.jetbrains.com/phpstorm/) by JetBrains.\n\nThe aggregated results will be published later this year as the State of PHP 2026 report. The anonymized raw dataset will be released along with it, so anyone in the community can check the numbers or run their own analysis.\n\nMore responses mean a better picture of what matters to PHP users. If you have not filled it in yet, please do, and share it with your colleagues and user groups.\n\n13 Aug 2026\n\n## [PHP 8.6.0 Beta 1 is available for testing](https://www.php.net/archive/2026.php#2026-08-13-1)\n\nThe PHP team is pleased to announce the first beta release of PHP 8.6.0, Beta 1. This continues the PHP 8.6 release cycle, the rough outline of which is specified in the [PHP Wiki](https://wiki.php.net/todo/php86).\n\nFor source downloads of PHP 8.6.0 Beta 1 please visit the [download page](https://downloads.php.net/~svpernova09/).\n\nPlease carefully test this version and report any issues found [on GitHub](https://github.com/php/php-src/issues/new?template=bug_report.yml).\n\n**Please DO NOT use this version in production, it is an early test version.**\n\nFor more information on the new features and other changes, you can read the [NEWS](https://github.com/php/php-src/blob/php-8.6.0beta1/NEWS) file, or the [UPGRADING](https://github.com/php/php-src/blob/php-8.6.0beta1/UPGRADING) file for a complete list of upgrading notes. These files can also be found in the release archive.\n\nThe next release will be Beta 2, planned for 27 Aug 2026.\n\nThe signatures for the release can be found in the [manifest](https://gist.github.com/svpernova09/c79e500ff918fa7eccd31852bb59746b) or on the [Release Candidates page](https://www.php.net/release-candidates.php).\n\nThank you for helping us make PHP better.\n\n30 Jul 2026\n\n## [PHP 8.4.24 Released!](https://www.php.net/archive/2026.php#2026-07-30-5)\n\nThe PHP development team announces the immediate availability of PHP 8.4.24. This is a security release.\n\nAll PHP 8.4 users are encouraged to upgrade to this version.\n\nFor source downloads of PHP 8.4.24 please visit our [downloads page](https://www.php.net/downloads.php), Windows source and binaries can also be found [there](https://www.php.net/downloads.php?os=windows&version=8.4). The list of changes is recorded in the [ChangeLog](https://www.php.net/ChangeLog-8.php#8.4.24).\n\n30 Jul 2026\n\n## [PHP 8.3.33 Released!](https://www.php.net/archive/2026.php#2026-07-30-4)\n\nThe PHP development team announces the immediate availability of PHP 8.3.33. This is a security release.\n\nAll PHP 8.3 users are encouraged to upgrade to this version.\n\nFor source downloads of PHP 8.3.33 please visit our [downloads page](https://www.php.net/downloads.php), Windows source and binaries can also be found [there](https://www.php.net/downloads.php?os=windows&version=8.3). The list of changes is recorded in the [ChangeLog](https://www.php.net/ChangeLog-8.php#8.3.33).\n\n30 Jul 2026\n\n## [PHP 8.6.0 Alpha 3 available for testing](https://www.php.net/archive/2026.php#2026-07-30-3)\n\nThe PHP team is pleased to announce the second testing release of PHP 8.6.0, Alpha 3. This continues the PHP 8.6 release cycle, the rough outline of which is specified in the [PHP Wiki](https://wiki.php.net/todo/php86).\n\nFor source downloads of PHP 8.6.0 Alpha 3 please visit the [download page](https://downloads.php.net/~mbeccati/).\n\nPlease carefully test this version and report any issues found in the [GitHub Issues](https://github.com/php/php-src/issues/new?template=bug_report.yml).\n\n**Please DO NOT use this version in production, it is an early test version.**\n\nFor more information on the new features and other changes, you can read the [NEWS](https://github.com/php/php-src/blob/php-8.6.0alpha3/NEWS) file, or the [UPGRADING](https://github.com/php/php-src/blob/php-8.6.0alpha3/UPGRADING) file for a complete list of upgrading notes. These files can also be found in the release archive.\n\nThe next release will be Beta 1, planned for 13 August 2026.\n\nThe signatures for the release can be found in the [manifest](https://gist.github.com/mbeccati/a78ae3c3bafa22839c619d1c81d286ae) or on the [pre-release builds](https://www.php.net/pre-release-builds.php) page.\n\nThank you for helping us make PHP better.\n\n30 Jul 2026\n\n## [PHP 8.5.9 Released!](https://www.php.net/archive/2026.php#2026-07-30-2)\n\nThe PHP development team announces the immediate availability of PHP 8.5.9. This is a security release.\n\nAll PHP 8.5 users are encouraged to upgrade to this version.\n\nFor source downloads of PHP 8.5.9 please visit our [downloads page](https://www.php.net/downloads.php), Windows source and binaries can also be found [there](https://www.php.net/downloads.php?os=windows&version=8.5). The list of changes is recorded in the [ChangeLog](https://www.php.net/ChangeLog-8.php#8.5.9).\n\n30 Jul 2026\n\n## [PHP 8.2.33 Released!](https://www.php.net/archive/2026.php#2026-07-30-1)\n\nThe PHP development team announces the immediate availability of PHP 8.2.33. This is a security release.\n\nAll PHP 8.2 users are encouraged to upgrade to this version.\n\nFor source downloads of PHP 8.2.33 please visit our [downloads page](https://www.php.net/downloads.php), Windows source and binaries can also be found [there](https://www.php.net/downloads.php?os=windows&version=8.2). The list of changes is recorded in the [ChangeLog](https://www.php.net/ChangeLog-8.php#8.2.33).\n\n16 Jul 2026\n\n## [PHP 8.6.0 Alpha 2 available for testing](https://www.php.net/archive/2026.php#2026-07-16-1)\n\nThe PHP team is pleased to announce the second testing release of PHP 8.6.0, Alpha 2. This continues the PHP 8.6 release cycle, the rough outline of which is specified in the [PHP Wiki](https://wiki.php.net/todo/php86).\n\nFor source downloads of PHP 8.6.0 Alpha 2 please visit the [download page](https://downloads.php.net/~svpernova09/).\n\nPlease carefully test this version and report any issues found in the [GitHub Issues](https://github.com/php/php-src/issues/new?template=bug_report.yml).\n\n**Please DO NOT use this version in production, it is an early test version.**\n\nFor more information on the new features and other changes, you can read the [NEWS](https://github.com/php/php-src/blob/php-8.6.0alpha2/NEWS) file, or the [UPGRADING](https://github.com/php/php-src/blob/php-8.6.0alpha2/UPGRADING) file for a complete list of upgrading notes. These files can also be found in the release archive.\n\nThe next release will be Alpha 3, planned for 30 July 2026.\n\nThe signatures for the release can be found in the [manifest](https://gist.github.com/svpernova09/9fe74e859313cf4dee4953fae81b558a) or on the [pre-release builds](https://www.php.net/pre-release-builds.php) page.\n\nThank you for helping us make PHP better.\n\n02 Jul 2026\n\n## [PHP 8.5.8 Released!](https://www.php.net/archive/2026.php#2026-07-02-5)\n\nThe PHP development team announces the immediate availability of PHP 8.5.8. This is a security release.\n\nAll PHP 8.5 users are encouraged to upgrade to this version.\n\nFor source downloads of PHP 8.5.8 please visit our [downloads page](https://www.php.net/downloads.php), Windows source and binaries can also be found [there](https://www.php.net/downloads.php?os=windows&version=8.5). The list of changes is recorded in the [ChangeLog](https://www.php.net/ChangeLog-8.php#8.5.8).\n\n[Older News Entries](https://www.php.net/archive/)\n", "dateCreated": "2026-10-21T14:37:58.044590695+00:00", "date_created": "2026-10-21T13:50:05+00:00", "date_modified": "2026-10-21T13:50:05+00:00", "date_published": "2026-10-21T13:50:05+00:00", "description": "Security advisory: Critical remote code execution vulnerabilities, update now PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly…", "external_url": "https://www.php.net/index.php", "git": { "commit": "33e7967b937ef6329f2d9194d87eba92105b7ced", "path": "items/hnrss-org/2026/10/2026-10-21-php-8-5-12-8-4-27-8-3-36-and-8-2-35-out.md", "permalink": "https://github.com/aymericbeaumet/aggr-instance/blob/33e7967b937ef6329f2d9194d87eba92105b7ced/items/hnrss-org/2026/10/2026-10-21-php-8-5-12-8-4-27-8-3-36-and-8-2-35-out.md" }, "id": "urn:aggr:item:714ed69185eed949a201e4c253f29df131d22cba", "isBasedOn": { "@id": "https://www.php.net/index.php" }, "mainEntity": { "@id": "https://www.php.net/index.php", "@type": "CreativeWork", "archivedAt": { "@id": "https://aggr.aymericbeaumet.com/items/hnrss-org/2026-10-21-php-8-5-12-8-4-27-8-3-36-and-8-2-35-out/#webpage" }, "author": [ { "@type": "Person", "name": "timvdalen" } ], "dateModified": "2026-10-21T13:50:05+00:00", "datePublished": "2026-10-21T13:50:05+00:00", "headline": "PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 out", "image": { "@type": "ImageObject", "caption": null, "height": 90, "url": "https://www.php.net/images/meta-image.png", "width": 160 }, "timeRequired": "PT14M", "url": "https://www.php.net/index.php", "wordCount": 3040 }, "name": "Archived snapshot: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 out", "preview": { "alt": null, "color": null, "height": 90, "placeholder": { "data_url": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNk+A8AAQUBAScY42YAAAAASUVORK5CYII=", "hash": "" }, "url": "https://www.php.net/images/meta-image.png", "width": 160 }, "reading_minutes": 14, "replicated_at": null, "source": "hnrss-org", "source_name": "Hacker News: Front Page", "summary": null, "tags": [], "temporalCoverage": "2026-10-21T14:37:58.044590695+00:00", "title": "PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 out", "url": "https://aggr.aymericbeaumet.com/items/hnrss-org/2026-10-21-php-8-5-12-8-4-27-8-3-36-and-8-2-35-out/", "word_count": 3040 }