PHP has released critical security updates for its supported PHP 8.x branches, addressing two vulnerabilities that could allow unauthenticated remote code execution. The latest releases include PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, released on October 21, 2026. PHP recommends that users upgrade their installations as soon as possible because there are no complete mitigations for these vulnerabilities.

In this guide, we explain what the latest PHP security update means for website owners, developers, WordPress websites, WooCommerce stores, and businesses running PHP-based applications. We also discuss the affected PHP versions, why keeping PHP updated is important, potential security risks, and practical steps to safely check and upgrade your server.

If your website is running WordPress, WooCommerce, Laravel, custom PHP, or another PHP-based application, maintaining a supported PHP version is an important part of website security, performance, and reliability.

For businesses that need professional website development, WordPress development, PHP development, security updates, or ongoing website maintenance, Cloud Sprint Web provides reliable digital solutions. Learn more about our services as a Web Development Company in Ahmedabad at Cloud Sprint Web.

Important: Before upgrading PHP on a production website, verify compatibility with your WordPress version, themes, plugins, custom code, and hosting environment. A proper backup and testing process can help prevent compatibility issues.

The latest PHP security releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, released on October 21, 2026. These releases fix two critical security vulnerabilities. PHP

The latest security release fixes CVE-2026-109618 and CVE-2026-109619. Both vulnerabilities can potentially allow unauthenticated remote code execution.

PHP describes both vulnerabilities as critical, with a CVSS v4.0 score of 9.2. PHP recommends that users update immediately.

The security fixes apply to supported PHP 8.x branches, with fixed releases available as PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. PHP

PHP 8.2 receives this security update, but it reaches end of life on December 31, 2026. Website owners using PHP 8.2 should plan a migration to a newer supported PHP branch.

You can check the PHP version through your hosting control panel, server configuration, WordPress Site Health, or by asking your hosting provider. Before upgrading, verify that your website and its plugins, themes, and custom code support the target PHP version.