Security advisory: Critical remote code execution vulnerabilities, update now
Critical · CVSS 9.2
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately. Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.
Remediation
Update PHP to the fixed release for your branch (8.2.35, 8.3.36, 8.4.27, 8.5.12). Branches below 8.2 have no fixed release — upgrade the branch or take the site offline.
Affected PHP branches
{'branch': '8.2', 'fixed_in': '8.2.35', 'status': 'patched release available'}, {'branch': '8.3', 'fixed_in': '8.3.36', 'status': 'patched release available'}, {'branch': '8.4', 'fixed_in': '8.4.27', 'status': 'patched release available'}, {'branch': '8.5', 'fixed_in': '8.5.12', 'status': 'patched release available'}, {'branch': '<8.2', 'fixed_in': None, 'status': 'end-of-life — no fixed release; branch upgrade required'}
Source: PHP.net News · retrieved 2026-10-22T10:19:14-04:00 · https://www.php.net/index.php#2026-10-21-5