Critical PHP Security Update Recommended
-
Wednesday, 21st October, 2026
-
16:42pm
Critical PHP Security Update Recommended
All customers are strongly advised to update PHP to the latest patch release available for their current version branch to ensure protection against recently disclosed security vulnerabilities.
Recommended PHP Versions
- PHP 8.5 → Update to 8.5.12
- PHP 8.4 → Update to 8.4.27
- PHP 8.3 → Update to 8.3.36
- PHP 8.2 → Update to 8.2.35
PHP maintainers have coordinated the release of these security patches with Linux distributions and Long-Term Support (LTS) vendors. If your server receives PHP packages through your operating system's package repository, please check with your distribution or hosting provider for the availability of updated packages. Version numbers supplied by distribution vendors may differ from the upstream PHP release numbers listed above.
Cloudflare Users
Cloudflare has deployed Web Application Firewall (WAF) protections to help mitigate known attack vectors targeting these vulnerabilities. However, WAF protections do not remove the underlying vulnerability from affected PHP installations. Updating PHP remains the only complete and recommended remediation.
If You Cannot Update Immediately
Customers who are unable to apply updates right away should review the temporary mitigation guidance provided in PHP's official security advisory. While these measures may help reduce exposure, they should only be considered short-term safeguards until a full update can be performed.
We strongly recommend scheduling PHP updates at the earliest opportunity to maintain the security and stability of your websites and applications.
