The PHP development team has announced the immediate availability of PHP 8.2.35. This is a security release that fixes two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which can allow unauthenticated remote code execution.
All PHP 8.2 users are strongly encouraged to update immediately. There are no complete mitigations, so updating is the only safe choice. Administrators should review the security advisory for full details on the affected components and the scope of the risk.
PHP 8.2 reaches end of life on 31 December 2026, after which it will receive no further security fixes. Organizations should plan their upgrade to a supported version of PHP well before that date to avoid running unpatched software in production.
Source downloads for PHP 8.2.35, including Windows source and binaries, are available on the official downloads page. A complete list of changes is recorded in the Change Log for teams that need to review the modifications included in this release.
Source: Hacker News · Summarized by HeadlinesBriefing