PHP Security Update 2026 Fixed Versions: What to Do Now
The PHP security update 2026 fixed versions list is out. On Oct 21, 2026, the PHP team fixed two severe flaws. These flaws let hackers run code on a server. They need no login. So, check your PHP version today. First, this guide shows which versions are safe. Then, it shows how to update.
Here are the key facts:
- Release date: Oct 21, 2026.
- Flaws: CVE-2026-109618 and CVE-2026-109619.
- Score: 9.2 out of 10 on the CVSS v4.0 scale.
- Risk: Hackers can run code from afar.
- Fix: Update PHP. PHP says no full workaround exists.
What Happened in This PHP Security Update
PHP warned users on Oct 20. A day later, the team shipped the fixes. The flaws sit in PHP core. So, any PHP that serves web pages is at risk. That includes PHP-FPM, mod_php, php-cgi, FrankenPHP and LiteSpeed.
Time matters here. A security firm saw attack tries on Oct 21. Plus, test attack code is public. Thus, delay is risky. In fact, CISA urged teams to patch right away.
Who Should Act First
Some sites face more risk than others. So, start with these:
- Public sites and web stores.
- Sites that take file uploads.
- Servers that run Apache with mod_php.
- Shared hosts with many sites on one box.
Next, patch the rest. Even tools inside your network need the fix. Hackers often move from one weak spot to the next.
PHP Security Update 2026 Fixed Versions at a Glance
Four builds carry the fix. Here is the list:
| PHP Branch | Fixed Version | Security Support Ends |
|---|---|---|
| 8.5 | 8.5.12 | Dec 31, 2029 |
| 8.4 | 8.4.27 | Dec 31, 2028 |
| 8.3 | 8.3.36 | Dec 31, 2027 |
| 8.2 | 8.2.35 | Dec 31, 2026 |
| 8.1 and older | No new release | Already ended |
Every build before these is hit. For instance, PHP 8.5.11 is not safe. So, move to the fixed number for your branch.
PHP 8.5.12 Security Update: What Changed
The PHP 8.5.12 security update is the fix for the 8.5 line. It closes both flaws.
One flaw comes from low-RAM errors. If PHP runs out of RAM, it can stop a task half way. Then, the cleanup trusts data that was never set up. The other flaw leaves stale state behind. A later request can then reuse it.
The fix also adds a hard cap on RAM. If a task hits it, PHP stops that task. So, you may see exit code 137 in your logs. By default, it is twice your memory_limit, up to 1G. Did you set memory_limit to -1 as a stopgap? Then, set a real cap again.
PHP 8.4.27 Security Fixes: What You Get
The PHP 8.4.27 security fixes cover the same two flaws on the 8.4 line. PHP 8.4 gets safety fixes until 2028. So, it is a solid pick for now.
The fix changes how PHP acts when RAM runs out. Before, PHP jumped out of the request. Now, it stops at a safe point. Then, it resets leftover state before the next request.
Known Issues After Upgrading
No release is perfect. Reports list a few bugs in the new builds. Still, none is a reason to stay unpatched.
- Crash risk: PHP 8.4.27 and 8.5.12 may crash with a heap error. It happens when cleanup runs on SimpleXML objects. PHP fixed it in its source code. So, the next 8.4 and 8.5 builds will have it.
- Exit code 137: Some low-RAM errors now stop the worker.
- Rare logouts: Upload progress can wipe a session. Then, users get logged out.
Note that 8.3.36 and 8.2.35 do not have the crash bug.
PHP 8.3, PHP 8.2 and Older Versions
PHP 8.3.36 and 8.2.35 fix the flaws too. But PHP 8.2 ends security support on Dec 31, 2026. So, plan a move to 8.4 or 8.5.
PHP 8.1 and older got no new release. But PHP posted small source patches for 7.4, 8.0 and 8.1. Plus, some Linux makers patch old versions on their own. For instance, Ubuntu fixed PHP 8.1 on 22.04. Yet these old lines get no fresh review. So, move up soon.
Many Linux makers keep the old version number. Thus, read the package notes, not just php -v.
Why This PHP Security Update Matters
PHP runs a big share of the web. WordPress, many shops and many forums use it. So, one bug in PHP can reach millions of sites. Worse, these flaws need no password. A hacker only needs to send a web request.
What can go wrong if you wait? Hackers could steal data. They could also plant bad files. Next, they could use your server to hit other sites. So, a quick fix saves a lot of pain.
How to Update PHP Safely
Follow these steps:
- Find where your PHP comes from. It may be a distro, a repo, Docker or your host.
- Back up your site and data.
- Install the fixed version from that same source.
- Restart every process that runs PHP.
- Check that nothing still runs the old PHP.
Restarts matter. A live task keeps the old code in RAM. For PHP-FPM, restart the service. For Apache with mod_php, do a full restart. A graceful reload is not enough.
Docker users should pull the new image. Then, rebuild your own images with a fresh pull. Plus, tools with their own PHP copy need a new build. FrankenPHP is one case.
If you cannot patch yet, a stopgap may lower risk. For instance, turn off session.upload_progress.enabled. But it only helps in part. So, undo it only after you patch.
FAQ
Which PHP versions include the latest security fixes?
The PHP security update 2026 fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Older builds are hit. Some Linux makers patch older lines under their own numbers. Still, plan a move to a new branch.
Is PHP 8.5.12 safe to use?
Yes, it is the right choice. It fixes both flaws. Plus, no one had shown a bypass as of Oct 23. But it has a few known bugs. In addition, one expert found a separate, older RAM bug. It has no CVE yet. So, keep an eye on php.net.
What is the latest PHP security update in 2026?
As of Oct 25, 2026, it is the Oct 21 release. It fixes two critical flaws. But news moves fast. So, check php.net for new releases.
How do I update PHP on my WordPress website?
Updating WordPress does not change PHP. PHP runs on your host. So, follow these steps:
- Open Tools, then Site Health, then Info, then Server. Note your PHP version.
- Back up your site.
- Switch PHP in your host panel. Or ask your host to patch it.
- Test your site.
- Look for signs of a break-in. For example, check for unknown admin users.
Conclusion
The PHP security update 2026 fixed versions are clear. Use PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. The PHP 8.5.12 security update closes both flaws. The PHP 8.4.27 security fixes do the same. In short, patch now. Then, restart your servers. Finally, plan to leave old branches.
