PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 patch two critical unauthenticated remote-code-execution flaws; maintainers urge immediate updates for web-serving installations. Partial mitigations do not make systems safe.

PHP’s October 21 official security advisory lists fixed versions and the risk to web-serving installations; original source capture of the urgent patch notice.

Published 21 Oct 2026 · 16:40 UTC

PHP security team ↗ · Source dated 21 Oct 2026

Browse all Live updates · Read Features