Running PHP? Check the critical security release
A critical PHP security update was announced this week. Check your server version and your host’s patch status.
What you need to change
Verified 2026-10-23| Your PHP branch | Fixed version from the advisory |
|---|---|
| 8.2.x | 8.2.35 |
| 8.3.x | 8.3.36 |
| 8.4.x | 8.4.27 |
| 8.5.x | 8.5.12 |
- Find the PHP version used by the website, not only the command line.
- Apply the fixed version for your branch, or your distribution’s confirmed security backport.
- For a container deployment, update the PHP base image and rebuild and redeploy it.
- Restart the affected PHP workers, verify the web runtime, and run your application checks.
What changed
PHP published fixes for two critical vulnerabilities on October 21, 2026. The table above records the fixed releases announced that day. Use the current vendor advisory if you are reading this later.
Does application code need changing?
These are PHP runtime vulnerabilities. Updating application code alone does not apply the runtime patch. If your hosting provider supplies backported security fixes, verify the package advisory rather than comparing only its version number.
What to do
Confirm the PHP version used by each application and ask your hosting provider whether the relevant security update is installed. Check the official PHP advisory and vendor instructions for the versions you run.
Before you update
Back up your application and database, test compatibility, and verify the installed runtime after deployment. Keep a record of the patch.
Follow the source
This is a short dated notice, not a live vulnerability feed. Use the linked official notice for current guidance.