PHP 8.3.36 Released

The PHP development team announces the immediate availability of PHP 8.3.36. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.3 users are encouraged to upgrade to this version. There are no complete mitigations, updating is the only safe choice. See the security advisory for details: https://www.php.net/archive/2026.php#2026-10-21-5 For source downloads of PHP 8.3.36 please visit our downloads page. Windows binaries can be found on the PHP for Windows site. The list of changes is recorded in the ChangeLog. Release Announcement: <https://php.net/releases/8_3_36.php>

Downloads:            <https://php.net/downloads>
Windows downloads: <https://www.php.net/downloads.php?os=windows&version=8.3>

Changelog: <https://php.net/ChangeLog-8.php#8.3.36> Release Manifest:  <https://gist.github.com/ericmann/bd87f4e5a8b6d0a0a9f7bda353cc4283> Many thanks to all the contributors and supporters! Eric Mann, Jakub Zelenka, and Pierrick Charron php-8.3.36.tar.bz2 SHA256 hash: 46f4b45e3688ed2b1819015a7b532c15b51cc055bdd3b13fd00ddfeebeedcd5f PGP signature: -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEESx/A2d+SMhztn2FdvsVV4ioUNVMFAmrWI18ACgkQvsVV4ioU NVP08hAAkPHoBkbZZrd++fuyrS/8mz3qBrGBqxvfvWQIAK8M1T/5iRzSvzQuUWy1 6QYEnTedJLyFnM4f0mMrtDMswj7BkWz8SgJ8Akyh4GX+OVeg3Q8FNvhb09nqTrLg /Soy6z7AcKcnrofFpJhuLcoTBxp7UamJQQgA7zOICjjH2CDOxxEFcek/DklvCW1R 9gIlMYCk3VXNmAqHU7STvPLnrBzX/xKkqFXnqaLjWMBzgL9n0r0lHyPq+2JDHMho UyFCcmz9/c3gwx8/OZvnA97+w/ZQf5FjnB4z2DWuVb+TJiAzKBpjniqullnrH5LA B8UPu5vrxUECkHNMni+Tou6Y9i2t0SF2jBYaTF/c9fXBRyp+ymiLciEQMgHAhRIZ gAcI3KbJe/z6tUGiOs2Wxoeot8FS5U0o5OwNE6iurDg+iC3PpwmOyorz3psNdlpd nRBVGL+b32KNg/co7nT/GU6LOMetDR5uWf2+f0C4tlmHnQXT9uyQZWljY9xkKUjK Uqph8grS/H3m2YiGH7hRTro8Qj8CfX/MZAky/l2fU3O8wPa/1WIkEBSBLYpjlrDB 17gzXQxFBdjEhQx4E7kpyj03Va7hc9at9nAG4Kjc7W8e92uiOn2RgjluuNuWnp2m oqjdQSKzItn0b5pp+1BfwUTbkCpiz/JwpQZKuJPbse88p2/C/G0= =JPY/ -----END PGP SIGNATURE----- php-8.3.36.tar.gz SHA256 hash: c93f3441f87f6ab156bef4432db215d7e61ca2c0183bb3a2aa28d9886ab59f53 PGP signature: -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEESx/A2d+SMhztn2FdvsVV4ioUNVMFAmrWI18ACgkQvsVV4ioU NVM5Uw/8CWc6ccvc2gwPb9Yq6fUlIZyeLZq1KZC3VE9dRphu0FEk+/hch7wMeBp5 GAHnYHcLyVEIfINywiArU4mkIhWtHPMowZKpzjx44hxzvsEmT+dcn99xcahIKER2 ehBbn0nw65Ki7fsi7yPqTLqqICXrdtDh6JiF2qIRFRXTq3bmQZ6gadM16ANK1gko IYFcvHsoj/+SeoXwver++PlseJp5H9gOA4qUV+OVgrVHMCEdnhyhtM+II+s9z6fB nv+va67QGz1S1Cxhv439vEnv/YFjAjWouZOzYO3SnoBzeWvvdod32zEQdiXz5N9v vKpkl45rJ+4hjpxaoHdmwfMzCVK8N7FV9l0YF24OqKdakcZgzI5LtYWphGmBRYjU e9yG7k1WyJVogb7nPay0UMXFjjyCMqMnXlK1BVuDwTh8xpPUf/s1FF0pqcUMbxog VX9ZU3HJNAlKi2JuHHF50lhngY5e4UK3Dp0+hX2clSWETo/hZHueYUj3zTz9ZnO9 XIYue3O4qfpLM6+P7LFXTB9Ht9wro4DxCLnAmIjUvRP8Uyq9r4PK6KtnSG3i4MrR S3WjkuIY8fo0pRHmm95ZReakgseAnZDjDRonjUp1kmv/xrT4X+l9m5C/wd2TfvTH wTI4x1l7fPNtaaQ6Qe3Z+GZQd95VafmbtnXA7/qNjrvlRwvc6OU= =LlH8 -----END PGP SIGNATURE----- php-8.3.36.tar.xz SHA256 hash: dd54693aa334c5c4d72e9aee96b082c2473750a18a6c1d105789c93a3b1692fd PGP signature: -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEESx/A2d+SMhztn2FdvsVV4ioUNVMFAmrWI18ACgkQvsVV4ioU NVNs+RAAj/QMSy3YSQwr+rkUD0qaMvO0fZET3dBNxEtdMCM1iQSWzBJi9Llty7De OfaCXOK/NZpO3CICJifir0XY9eU6uHWl7wpo8YQHXcQ5EirDX3jeNEHMoPnx3jsX NX7j4fpcj3hfLuZLW1vyKhVmXCenrhJDPS+buta5g79OXpGUrJ0hy2IFKmt049BO sxDOjQZANd46RApf8GapEvpDClkTTSnnEh8v0S9ripShe4oECTzW+bDKEtsZVImv xpZJqC0sJ7Y9i4M7dVqfNjohEfj+Mh0NvfR8l4PHHko5RVz7A3EueThM8WZ4i2qr iwKIOSBhdzcgfEGwKKGzO4yjcf3pCvcANh8Oa6En3fSXwoJgMZJhTczCh7cFJIQS e58b8dMmSAsQLcgB1LQr7hulHOQLt4lDzO/iR4rT3C3bBaZsZfjfyZxNMFxUFgSm ZUrXgGGbDqtAtoif80OzXLMT+S8G3dks/nRnn+hVy0QDxjawIGAIutZVAVSA9Ixp UsxS1N6v7/WWUHuuKBQEYib7N+QXPIgJrr5vF3D7s7bF3RN2jIDlIvKVvp/Bz2xr x7rKFtIN3XsLOkS9qlL4XcZN8gMZkLh04VJ7gmEO5L/mOkk+PJidMjbCimASERjJ /FjxHzlKkku17fn7E1T6LPmrIN1MvA0B66iJhXWgIoMp7h+bTqM= =FtbT -----END PGP SIGNATURE-----