PHP: security advisories, deprecations and releases

PHP2Shell Won't Be the Last. Here's Where the Next One Will Show Up First.

PHP2Shell demonstrated how fast an engine-level flaw can expose internet-facing apps. The article stresses outside-in inventory, rapid testing, and repeated checks before the next disclosure.

Updated PHP Windows builds for Brotli security fix

PHP Windows builds for 8.5.12, 8.4.27, 8.3.36 and 8.2.35 have been rebuilt with Brotli 1.2.1 to fix an out-of-bounds write vulnerability reachable via the cURL extension when automatic HTTP decompression is enabled.

CVE-2026-111497

PHP2Shell exploitation attempts and remediation trends

Wiz tracked PHP2Shell attacks after disclosure; no successful exploits observed. Analysis covers attack methods, why they failed, and exposure decline over time.

Informational advisory: Session upload progress

PHP recommends disabling session.upload_progress.enabled until the next bugfix release to mitigate an unlikely RCE vector tied to CVE-2026-115560.

CVE-2026-109619 CVE-2026-115560

PHP2Shell unauthenticated RCE disclosed after 13 years

A remote code execution flaw in PHP present for 13 years became public. Coordinated response by OpenAI, Wiz, Calif, Cloudflare, and PHP maintainers resulted in an emergency patch release.

Cloudflare saw millions of PHP2Shell exploit attempts within hours

Matthew Prince reported thousands of attempts pre-announcement, scaling to millions within two hours after disclosure.

PHP Foundation publishes post-release security update

PHP Foundation details the coordinated disclosure process, patch contents, and ongoing hardening measures for the PHP2Shell vulnerability.

PHP2Shell: How to Protect Vulnerable PHP Workloads While Patching

PHP2Shell vulnerabilities let unauthenticated attackers execute code on affected PHP installs and leak memory data. Exploitation attempts are reported.

PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet

Core PHP engine flaws enable remote code execution and Heartbleed-style memory disclosure across the web.

PHP 8.5.12 Released

Security release fixing two critical unauthenticated remote code execution vulnerabilities in PHP 8.5.

CVE-2026-109618 CVE-2026-109619

Also covered by PHP News , PHP News , PHP News

Upcoming Critical PHP Security Release

PHP security team announces a critical release on 21 October 2026 addressing two CVSS 9.2 vulnerabilities.

GitHub expands malware advisories to eight ecosystems via OpenSSF

GitHub integrated OpenSSF malicious-packages data into its Advisory Database, extending malware detection from npm to PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer.

PHP 8.3.35 Released

Security release for PHP 8.3; all users should upgrade immediately.

PHP 8.4.26 Released

Security release for PHP 8.4 users. All installations should upgrade promptly to the new version.

Symfony 8.1 reaches end of life on 2027-01-31

Symfony 8.1 reaches end of life on 2027-01-31, as listed by endoflife.date.

Composer 2.10 has reached end of life

Composer 2.10 reached end of life on 2026-10-29, as listed by endoflife.date.

Symfony 8.1 reaches end of life on 2027-01-31

Symfony 8.1 reaches end of life on 2027-01-31, as listed by endoflife.date.

PHP 8.2 reaches end of life on 2026-12-31

PHP 8.2 reaches end of life on 2026-12-31, as listed by endoflife.date.

Laravel 12 reaches end of life on 2027-02-24

Laravel 12 reaches end of life on 2027-02-24, as listed by endoflife.date.

Composer 2.2 reaches end of life on 2026-12-31

Composer 2.2 reaches end of life on 2026-12-31, as listed by endoflife.date.

Composer 2.11 released

Composer 2.11 was released on 2026-10-29.

PHP 8.6.0 RC4 available for testing

Third release candidate of PHP 8.6.0 now available. Includes fixes for two critical vulnerabilities allowing unauthenticated remote code execution. Not for production use.

DigitalOcean App Platform buildpack updates 22 Oct 2026

PHP buildpack 298 now ships PHP 8.5.3-8.5.12, 8.4.18-8.4.27, 8.3.31-8.3.36, 8.2.31-8.2.35.

PHP 8.6.0 RC3 available for testing

First release candidate for PHP 8.6.0 is ready for testing. Source downloads and upgrade notes are available.

Laravel 13 now supports MariaDB Vector natively

Laravel 13 integrates MariaDB Vector directly, enabling semantic search in Laravel apps without extra databases or services.

PHP 8.6.0 RC2 available for testing

PHP 8.6.0 RC2, a release candidate, is now available for testing. It is not for production use.

PHP 8.5.11 Released!

PHP 8.5.11 is a security release. All PHP 8.5 users should upgrade immediately.

PHP 8.2.34 Released

Security release for PHP 8.2. Upgrade recommended for all 8.2 users.

KillaBoi/StealMyBitcoin-PoC

Single-file Python exploit achieving RCE on Alpine PHP 8.4.26, complete with Docker lab for local reproduction of the Steal My Bitcoin CTF chain.

Build an "ask the docs" app with Laravel 13 and MariaDB Vector

Tutorial shows how to use Laravel 13 native MariaDB Vector support to build a simple RAG-style documentation chatbot.

OpenAI releases php2shell-checker scanner

Open-source scanner to detect PHP2Shell-vulnerable code patterns before attackers exploit them.

Corelight publishes PHP2Shell detection rules

Open-source detection rules for network and endpoint visibility of PHP2Shell exploitation attempts.