PHP 8.4.27, 8.3.36 and 8.5.12: what the 21 October security release means for you
Two critical bugs that allow remote code execution without logging in, fixed in every supported PHP version. What to do today, and what it says about running on an unsupported version.
On 21 October 2026 the PHP project released 8.5.12, 8.4.27, 8.3.36 and 8.2.35. All four fix the same two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, rated 9.2 out of 10. Both can let an unauthenticated request run code on the server. The PHP team wrote that there is no complete mitigation and that updating is the only safe choice.
What to do today
- Check the version your site runs: php -v on the server, or the version shown by your hosting panel.
- If it is 8.2, 8.3, 8.4 or 8.5: update to the patch above. On Debian, Ubuntu and Red Hat the vendor packages were ready on release day.
- If it is 8.1 or older: the PHP project no longer ships updates for it. Some distributions backport fixes; for this one the security team even published minimal source patches for 7.4, 8.0 and 8.1 because of the severity. That is a courtesy, not a plan.
- Restart PHP-FPM or the web server after the update, and check the site.
What it says about older versions
A release like this is the moment the difference between a supported and an unsupported runtime becomes real. On a supported version the fix arrives the same day and takes minutes. On an unsupported one you are waiting for a vendor backport that may never come, or building PHP from source. PHP 8.2 reaches end of life on 31 December 2026; if that is what you run, the upgrade to 8.4 belongs on this year's list.
If you do not know what you run, or who would do the update, that is exactly the question the Health Check answers in two days.
More notes: Why I put an MCP server in front of an API instead of giving the model the database · What two days of Health Check buy you · all posts