PHP released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, 2026, to fix two flaws rated 9.2 out of 10 that allow attackers to run code on servers without logging in. Releasing the fixes does not mean websites have installed them. PHP said the risk is highest on servers using Apache’s mod_php setup, where a demonstrated exploit works before a website’s own code runs.
Cloudflare reported early attacks before the fixes shipped and said its emergency firewall rules were only a stopgap. Finland, the Netherlands and France took government websites offline as a precaution. Website owners and hosting companies must apply the fixes; regular users have nothing to install. PHP 8.1 and older have no official release, though PHP published source-code patches for versions 7.4, 8.0 and 8.1, and Linux distributions are backporting fixes.
