PHP's security team published limited source patches for PHP 7.4, 8.0 and 8.1 alongside four releases addressing two critical flaws, expanding the options available to operators of older installations.
Those older versions no longer receive regular security updates from the project. The source patches are an exception for these flaws; some distributions and long-term support providers also offer backported fixes.
The four releases, published Oct. 21, are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each received a 9.2 rating under version 4.0 of the Common Vulnerability Scoring System. They could allow attackers to run code remotely on affected servers.
The flaws involve PHP's handling of memory during and between web requests. PHP warned that installations processing web requests need attention, particularly those using Apache's mod_php configuration.
PHP issued an advance notice Oct. 20 that set a 10 a.m. ET (14:00 UTC) target for the Oct. 21 release. The vulnerabilities also prompted precautionary shutdowns of some government services in the Netherlands and Finland, temporarily interrupting access for users.
PHP says security support for version 8.2 ends Dec. 31, 2026.
