PHP

A popular general-purpose scripting language that is especially suited to web development.Fast, flexible and pragmatic, PHP powers everything from your blog to the most popular websites in the world.
The PHP team is pleased to announce the fifth release candidate of PHP 8.6.0, RC7. This continues the PHP 8.6 release cycle, whose rough outline is specified in the PHP Wiki.
Source downloads of PHP 8.6.0 RC7 are available on the download page.
Please carefully test this version and report any issues found in the GitHub Issues.
Please DO NOT use this version in production, it is an early test version.
For more information on the new features and other changes, you can read the NEWS file, or the UPGRADING file for a complete list of upgrading notes. These files can also be found in the release archive.
The next release will be the first GA release, PHP 8.6.0, planned for 19 November 2026.
The signatures for the release can be found in the manifest or on the pre-release builds page.
Thank you for helping us make PHP better.
The PHP team is pleased to announce the fourth release candidate of PHP 8.6.0, RC5. This continues the PHP 8.6 release cycle, whose rough outline is specified in the PHP Wiki.
Source downloads of PHP 8.6.0 RC5 are available on the download page.
Please carefully test this version and report any issues found in the GitHub Issues.
Please DO NOT use this version in production, it is an early test version.
For more information on the new features and other changes, you can read the NEWS file, or the UPGRADING file for a complete list of upgrading notes. These files can also be found in the release archive.
The next release will be the first GA release, PHP 8.6.0, planned for 19 November 2026.
The signatures for the release can be found in the manifest or on the pre-release builds page.
Thank you for helping us make PHP better.
The PHP team announces updated Windows builds: PHP 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1. These builds include Brotli 1.2.1, which fixes CVE-2026-111497, an out-of-bounds write vulnerability in Brotli decompression.
In PHP Windows builds, the vulnerable decoder can be reached through the cURL extension when automatic HTTP response decompression is enabled. This is disabled by default in cURL, but applications and HTTP client libraries can enable it.
The -1 suffix identifies a Windows package rebuild with updated dependencies. These builds use the same PHP source releases, and the PHP runtime versions remain unchanged.
The updated packages are available on the downloads page.
We suggest you set session.upload_progress.enabled=0 until the next regular bugfix release, to fully protect from an unlikely RCE vector. This setting was already listed as a mitigation in the GHSA-6wmf-4rv5-p3rp advisory for CVE-2026-109619 published on Oct 21st, 2026. If you applied it then, keep it in place and no further action is needed.
The issue can only occur under an unusual combination of configuration and application code. An application must set session.serialize_handler to php_binary or php_serialize in its configuration and then switch it to php at runtime with ini_set() before calling session_start(). Session upload progress must also still be enabled. Applications that never change the serialize handler at runtime can keep the feature enabled. Since this setup is unlikely in practice, we are handling it in the regular release cycle and will publish a full advisory for CVE-2026-115560 with the next release.
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately.
Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.
The vulnerabilities:
If you cannot update immediately: while only an update is a complete solution, the following measures reduce exposure to specific attack paths but do not make an installation safe.
RCE via OOM corruption (CVE-2026-109618):
RCE via stale global state (CVE-2026-109619):
The advisories linked above have the full technical details.
The PHP team is pleased to announce the third release candidate of PHP 8.6.0, RC4. This continues the PHP 8.6 release cycle, whose rough outline is specified in the PHP Wiki.
Source downloads of PHP 8.6.0 RC4 are available on the download page.
Please carefully test this version and report any issues found in the GitHub Issues.
This version also contains the fixes for two critical vulnerabilities that can allow unauthenticated remote code execution. Everyone running earlier builds of PHP 8.6.0 is strongly encouraged to update immediately.
Please DO NOT use this version in production, it is an early test version.
For more information on the new features and other changes, you can read the NEWS file, or the UPGRADING file for a complete list of upgrading notes. These files can also be found in the release archive.
The next release will be the last release candidate (RC5), planned for 5 November 2026.
The signatures for the release can be found in the manifest or on the pre-release builds page.
Thank you for helping us make PHP better.
The PHP development team announces the immediate availability of PHP 8.5.12. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.5 users are strongly encouraged to update immediately.