PHP 8.2.35

Your PHP applications are now protected against critical remote code execution vulnerabilities.

The PHP development team has released PHP 8.2.35, a critical security update. This release addresses two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which could allow unauthenticated remote code execution. The team strongly advises all users of PHP 8.2 to update immediately, stating that updating is the only safe option as there are no complete mitigations. The advisory provides further details on these security issues. PHP 8.2 is scheduled to reach its end of life on December 31, 2026, after which it will no longer receive security fixes. Users are encouraged to plan their upgrades to a supported version. Source downloads and Windows binaries are available on the official downloads page, with a detailed ChangeLog also provided.

This release highlights the ongoing need for vigilance in maintaining server-side languages, especially as critical vulnerabilities that permit remote code execution are discovered. The urgency with which PHP 8.2.35 is being pushed, coupled with the absence of workarounds beyond updating, underscores the potential impact on a vast number of web applications that rely on this version. Developers and system administrators must act swiftly to patch their environments to prevent exploitation.

The approaching end-of-life for PHP 8.2 in late 2026 also necessitates strategic planning for future upgrades. This security release serves as a stark reminder that unsupported software poses significant risks, prompting a proactive approach to migrating to actively maintained versions of PHP to ensure continued security and functionality of web services.