The PHP development team announces the immediate availability of PHP 8.2.35. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.2 users are strongly encouraged to update immediately.
There are no complete mitigations, updating is the only safe choice. See the security advisory for details.
PHP 8.2 reaches end of life on 31 December 2026 and will receive no further security fixes after that date. Please plan your upgrade to a supported version.
For source downloads of PHP 8.2.35 please visit our downloads page, Windows source and binaries can also be found there. The list of changes is recorded in the ChangeLog.