| Author |
|
Jan-E
Joined: 09 Mar 2012
Posts: 1315
Location: Amsterdam, NL, EU
|
 Posted: Wed 21 Oct '26 9:04 Post subject: PHP critical updates Wed Oct 21st 2026, 14:00 UTC |
 |
|
https://thehackernews.com/2026/10/php2shell-two-unpatched-critical-php.html
PHP will ship an out-of-cycle security release at 14:00 UTC today, October 21, for two critical vulnerabilities that its security team has rated 9.2 on the CVSS v4.0 scale but has not described.
See https://www.php.net/archive/2026.php#2026-10-20-1 as well.
Upcoming Critical PHP Security Release
The PHP security team would like to give advance notice of an upcoming security release.
It is scheduled for Wednesday, 21 October 2026 at 14:00 UTC.
It addresses two critical vulnerabilities, both rated CVSS v4.0 9.2.
All PHP users are encouraged to prepare now so they can upgrade as soon as the release is available.
We reserve the right to release earlier should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.
Full details, affected versions, and the fixed versions will be published with the release.
Thank you for helping us keep PHP secure.
Last edited by Jan-E on Wed 21 Oct '26 16:39; edited 1 time in total |
|
| Back to top |
|
Jan-E
Joined: 09 Mar 2012
Posts: 1315
Location: Amsterdam, NL, EU
|
|
| Back to top |
|
Jan-E
Joined: 09 Mar 2012
Posts: 1315
Location: Amsterdam, NL, EU
|
|
| Back to top |
|
Materix
Joined: 30 Aug 2012
Posts: 45
|
| Posted: Wed 21 Oct '26 21:31 Post subject: |
|
|
| Jan-E wrote: | https://github.com/remicollet/php-src-security/branches
Backports for PHP 7.4, 8.0 & 8.1 |
Thanks! |
|
| Back to top |
|
Jan-E
Joined: 09 Mar 2012
Posts: 1315
Location: Amsterdam, NL, EU
|
|
| Back to top |
|
jcelle
Joined: 10 Feb 2017
Posts: 7
Location: Nice, France
|
| Posted: Thu 22 Oct '26 16:05 Post subject: Thanks ! |
|
|
| Thanks ! |
|
| Back to top |
|
sambache
Joined: 11 Feb 2014
Posts: 18
Location: Canada, Yorkton, Sk
|
| Posted: Fri 23 Oct '26 3:59 Post subject: Big Thank You! |
|
|
just wanted to thank's Jan for the updated EOL versions.
I was in need for 7.2 & 7.4
Thank you. |
|
| Back to top |
|
CamaroSS
Joined: 24 Jan 2013
Posts: 80
Location: RF, Tver
|
| Posted: Fri 23 Oct '26 8:34 Post subject: |
|
|
Thanks a lot! There is now a backport for 7.0, is it possible to build it as well? I happen to have a project with ionCube'd CMS nailed to PHP 7.0 unfortunately. |
|
| Back to top |
|
CamaroSS
Joined: 24 Jan 2013
Posts: 80
Location: RF, Tver
|
| Posted: Fri 23 Oct '26 12:21 Post subject: |
|
|
| I see 7.0 updated as well. Thanks! |
|
| Back to top |
|
Jan-E
Joined: 09 Mar 2012
Posts: 1315
Location: Amsterdam, NL, EU
|
| Posted: Fri 23 Oct '26 22:16 Post subject: |
|
|
| CamaroSS wrote: |
Thanks a lot! There is now a backport for 7.0, is it possible to build it as well? I happen to have a project with ionCube'd CMS nailed to PHP 7.0 unfortunately. |
I have to recompile the PHP 7.0 builds because of https://github.com/Anton-Barinov/php2shell-patches/issues/6
Which version do you use? I could prioritize that one. |
|
| Back to top |
|
Jan-E
Joined: 09 Mar 2012
Posts: 1315
Location: Amsterdam, NL, EU
|
|
| Back to top |
|
Jamalofski
Joined: 21 Oct 2026
Posts: 1
Location: Bordeaux, France
|
| Posted: Sun 25 Oct '26 19:06 Post subject: |
|
|
In addition to Jan's builds, for Windows users on PHP 7.4, 8.0 or 8.1: I publish builds of Remi's php-src-security backports (linked above), made with the official php-windows-builder: https://github.com/Jamalofski/php-eol-security/releases
Versions 7.4.33-pl2, 8.0.30-pl2 and 8.1.34-pl2, in x64/x86, TS/NTS (TS for mod_php). Every commit of Remi's branches is checked against php-src before the build, and each zip comes with SHA256SUMS, an SBOM and a signed provenance attestation. These are unofficial builds; upgrading remains the real fix. |
|
| Back to top |
|
James Blond
Moderator
Joined: 19 Jan 2006
Posts: 7487
Location: EU, Germany, Next to Hamburg
|
| Posted: Mon 26 Oct '26 10:03 Post subject: |
|
|
| Jamalofski wrote: | In addition to Jan's builds, for Windows users on PHP 7.4, 8.0 or 8.1: I publish builds of Remi's php-src-security backports (linked above), made with the official php-windows-builder: https://github.com/Jamalofski/php-eol-security/releases
Versions 7.4.33-pl2, 8.0.30-pl2 and 8.1.34-pl2, in x64/x86, TS/NTS (TS for mod_php). Every commit of Remi's branches is checked against php-src before the build, and each zip comes with SHA256SUMS, an SBOM and a signed provenance attestation. These are unofficial builds; upgrading remains the real fix. |
Thank you for releasing binaries |
|
| Back to top |
|
