DE | EN
News October 23, 2026

PHP releases fixes for two critical remote-code-execution flaws

The PHP project has released security updates addressing two critical vulnerabilities that can enable unauthenticated remote code execution. Fixes are available for PHP 8.5, 8.4, 8.3 and 8.2.

PHP releases fixes for two critical remote-code-execution flaws

Key points

  • The vulnerabilities may allow unauthenticated remote code execution.
  • Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
  • Technical details and initial proof-of-concept code are already circulating publicly.

Context

The PHP project announced the upcoming security release on 20 October 2026 and published the fixes on 21 October 2026 at 13:30 UTC. Public discussion of the flaws and initial proof-of-concept code increases the operational relevance for organizations running PHP-based systems, while the source does not confirm active exploitation.

What this means for you

Already in effect

Teams operating PHP-based applications can identify affected installations, compare their versions with the fixed releases and assess the risk to legacy systems.

Who benefits: Developers and technical decision-makers responsible for PHP-based legacy systems benefit from early visibility into the vulnerable versions and available fixes.

Share article: