PHP 8.5.12 Released

The PHP development team announces the immediate availability of PHP 8.5.12. This is a security release. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.5 users are encouraged to upgrade to this version. There are no complete mitigations, updating is the only safe choice. See the security advisory for details: https://www.php.net/archive/2026.php#2026-10-21-5 For source downloads of PHP 8.5.12 please visit our downloads page. Windows binaries can be found on the same page. The list of changes is recorded in the ChangeLog. Release Announcement: <https://php.net/releases/8_5_12.php> Downloads: <https://php.net/downloads> Windows downloads: < https://www.php.net/downloads.php?os=windows&version=8.5> Changelog: <https://php.net/ChangeLog-8.php#8.5.12> Release Manifest: < https://gist.github.com/DanielEScherzer/9fce78e81e004f0398e249e1fe0df5b8> Many thanks to all the contributors and supporters! Regards, Daniel Scherzer, Volker Dusch, and Pierrick Charron php-8.5.12.tar.bz2 SHA256 hash: ffb60edc437ced63b5137e4984db379a8111c50049c711510d8b958277efc1a8 PGP signature: -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEE2VwDvHAr6VFTRK4zdORLyQZ3AaUFAmrWUKQACgkQdORLyQZ3 AaU1QRAAj951A3VHXxL+rfVce64T0cCI6bde+BqSWmxMifKN29UkVDOrzxkzNYZK 993NLsmMPMN00FlJsXXlZ8RuOBgTzv8HHnKTjJdxtbXDlaHWiYNZT5hIY9/JpLe8 1pHztBB4GwGxtYqFleg2w0ya52To191dTxqkbE9xMyNGxY6b14K1f+CyWkYlbxjD c/mnsCJ26zzVWfU1ZhEIGjC5ykXQcIZRwMbwdywnvQo63DzxqT5gFwKq2Lkdy0oM /RCXWYBQdXsLbkanC2jzAceubm1Rk1MQHMtbvEkY/IwkGR73ky4q/Yig99K3grID sVYXUVhqxMnPFWMManQPC+aKE9rrtgJkY84rDLFYWTmi7qW81lYBOLWizH5oFhBY fSomfaNNqGuddn9Swrqn07R+gA1JAdiSWq1ViIrE5TN2J6ytey0n4mepThdNq4oZ FN+jmH/MkftDWMgDrt0iSq/Kk4nAcjsBc28YIku29J45J9zE9HkejoEBaTzDXUdC Y5IIjlF8NEzPZJhppM4WmvP1HzcocmtMjzjyBY82Z+sw+oUzh+6thCU4MYIV89YF gQvVhM77r/3MxsA3JNPgF9B6e/vK9JEptlAl9gzLDwJCW+VCWg4wWgTFvW4Eah32 kMwu8qYX/8hrPv4JKvqeADfGWUJvLKGQV9REeA6jBSy9yD+ZvC4= =gNxr -----END PGP SIGNATURE----- php-8.5.12.tar.gz SHA256 hash: 81a0f450349e84b08eb43faa85f8a4c835684f3cc1c50471775d1317a046c525 PGP signature: -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEE2VwDvHAr6VFTRK4zdORLyQZ3AaUFAmrWUKgACgkQdORLyQZ3 AaVyQg//SiL5miUAcCERQkmIpKyk9ZNvTX1NYhs5YEF+eNpUoUAEHUBdmbAqJ17G P6Z8cMurmQqGVX2dc4YSuHqjmFiBzEQpAOqzVg9AJaKFm4L9mQyI3uB/+p+T5Eu7 2biVKD1U4EcJ0AWwsCLB1wOH3zY4FS+flovZLiM8o+VEnJnoM+X8THbF6NuWyjQk 5v8/5xrPFHMycae63gbq+e9P7OKuaMdOXmkdTGzl20sn14M2rmQoqnExBkMb81fV lC7AT9X4X7ATOCkzBNAuY4MGSqJmnPQrh8SSSuEmNqltqCIw56u1lvf7x1QXPQiJ GPHkzfiFf9+03QO95jos1RDPnNNaKJsGc/GR/5KHKzSEbA9nDTPfTBIffQOAiNu5 Ii3Otv4Q0cU7d7lHf0oJ9U/gdU/Ixv6Y8gYs2gEABu4T1v1kumObMSaT4wxSNeJh UQqOX//JCz+x9cAaZSie1qTUObmKDbP4HnOwauY6fVfdYXcVTLB5KekhCrbEULT8 /A2NhOZiQHAigwE6EfI1L9Qwta5/YFLkI9xbY9fLi31HnCUNc70X36FzokVTYQeb ju9d9VgpFhe57MTjOXiJExAcWbSFsM7smDYibWQak4pGT/kXCQ8iJT686aovHso+ rbhTDnde55bxv7ieZcnr42AjwlCIQ2lFexmWUan1CHyE2sczjvg= =bZwM -----END PGP SIGNATURE----- php-8.5.12.tar.xz SHA256 hash: 08bc2eba2a588654ade1357174aa646b761556c862dda0678345ee29ed481209 PGP signature: -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEE2VwDvHAr6VFTRK4zdORLyQZ3AaUFAmrWUKgACgkQdORLyQZ3 AaWt8BAAkiRCqB8qc8OoXos8YBES/67MKcpKh5es0geSOG8TuuxkkNG7rZfpAAU7 G32U30SCFYCpUZT5C6OQWV0EHdqDxvgRdpv5v3C/nxQSw320DyYIbJPWByxtq1WE V/KO4/PtGLPNIC1Tqgh3stxh1sOYtAPY+A07xd59l8rYpw0/hRWcpufrmrmx46te TrH3ZNEXkBZPWmaS2gcUkB3hDgol5gB+0vtAedOef3uQcWnmxTOawrIaAoTNtGIU 3tQQHtrzcPSimV9LBlScL1T8KZFJKb4ZMvYOF7WJbmbPgWbbnqqb/wznJb7/KNRh HmAuhDe2cPuJuN2J11NAZ1bw+/6AvTok8Vt0jyEPRaTVcUW7NG0PZgLsYf2hPXbG YETMwl39IDM7CN+YPUpYOgdXDlrjwu3ZB7A563y7L23kGidlO6oPU4u+Lp2zCZ1S vPWxDuR3KkWKTjwAJiwfAJEAmPvXl2lSrMkqldP9soiGSH7BFHPcBnB12lJTtTXy VcJwe9plmG8K3LFYYnLAZjVGfl+xqH2RRRxkmt8sUaKNQSxquXnTOfF4CpZSs4E4 dV/juvxwUla4ahqR29UvlhmuR/fI4wgoifmCIJQxMmakBCnBGxcRaZReBwugDZRh 7v5UfTk06YqT4kFcAsqz40EeJqvRyLT8LqkaaEOBlP8T1VSxuZU= =EFmu -----END PGP SIGNATURE-----