Fixes for PHP vulnerabilities rated “Critical” for RCE are scheduled for release. The current response options and discussion around protecting PHP 5/7/8.0/8.1, which are outside the scope of official patches, are summarized.
On 21 October 2026, the PHP development team announced in advance that it expected to release fixes for 2 serious RCE vulnerabilities rated 9.2 under CVSS v4.0. Although official patches will be released, it was also reported that in some end-of-support environments, only minimal patches in backport form may be provided.
Affected versions include PHP 8.2 and later, as well as earlier versions. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Exploitation in production environments has not been confirmed at this time, but information from several security companies indicates that the vulnerabilities have been confirmed and reproduced.
PHP 5.x, 7.x and 8.0/8.1, for which official patches are not provided, are being addressed through backporting. According to estimates by Mallory, approximately 1.9 million of the roughly 2.6 million PHP hosts on the internet are running branches that cannot receive the fixes, highlighting the high level of risk in real-world environments.
Operational factors include compatibility with OS-standard PHP and applications, inclusion in vendor products, and budget and staffing constraints, all of which contribute to the continued use of EOL versions. As a practical approach, the guidance recommends combining short-term isolation and mitigation measures with extended support while proceeding with a planned migration.