Update PHP now
Written on 2026-10-21The worst security vulnerability in PHP's history has just been announced. Technically it was leaked yesterday but I figured it would only make sense to write about it as soon as the patch for it is live.
tl;dr: every PHP website in the world is vulnerable for a remote code execution attack, and you should update your websites NOW. The fixed versions are:
- 8.5.12
- 8.4.27
- 8.3.36
- 8.2.35
Any other version is affected, including unsupported versions older than PHP 8.2. You can read the in-depth report here.