Re: PHP 8.2.35 Released!
| From: | Lynn | Date: | Wed, 21 Oct 2026 14:16:54 +0000 |
| Subject: | Re: PHP 8.2.35 Released! | ||
| References: | 1 | Groups: | php.internals |
| Request: | Send a blank email to internals+get-132892@lists.php.net to get a copy of this message | ||
On Wed, Oct 21, 2026 at 4:07 PM Sergey Panteleev <sergey@php.net> wrote:
>
> The PHP development team announces the immediate availability of PHP
> 8.2.35.
>
> This is a security release fixing two critical vulnerabilities
> (CVE-2026-109618, CVE-2026-109619)
> that can allow unauthenticated remote code execution.
>
> All PHP 8.2 users are advised to upgrade to this version.
>
> There are no complete mitigations, updating is the only safe choice.
>
> See the security advisory for details:
> https://www.php.net/archive/2026.php#2026-10-21-5
>
> For source downloads of PHP 8.2.35 please visit our downloads page.
> Windows binaries can be found on the PHP for Windows site.
> The list of changes is recorded in the ChangeLog.
>
> Release Announcement:
> <https://php.net/releases/8_2_35.php>
> Downloads: <https://php.net/downloads>
> Windows downloads: <
>
> https://www.php.net/downloads.php?os=windows&version=8.2>
> Changelog:
> <https://php.net/ChangeLog-8.php#8.2.35>
> Release Manifest: <
>
> https://gist.github.com/saundefined/35fb84fc90161b9e920a0992bda7a47c>
>
> Many thanks to all the contributors and supporters!
>
> Pierrick Charron, Sergey Panteleev & Ben Ramsey
>
>
> php-8.2.35.tar.bz2
> SHA256 hash:
> 0f43efd1ac24d4f90002c8d4d570bf4c4d59fa14313bf270aae8cf04d9dfdef3
> PGP signature:
> -----BEGIN PGP SIGNATURE-----
>
> iQJPBAABCAA5FiEE5gkT5N8gmQfY4w2WZZqXyc8qeVoFAmrVx/4bFIAAAAAABAAO
> bWFudTIsMi41KzEuMTIsMCwzAAoJEGWal8nPKnlaFq0P/2W91rkguw9eQggyFMTs
> l5pGJGNZrashKQ6LfOyesKPFAXLDxOKBf4LJBaSDt4sNFXoaCK+cMgZfaH4xOakS
> 79aQPJx1oxdAEjVtwZ+0QY/dLo3dE/0AteohYuj517k1xQVA1NhLrWltuCW0JIZP
> b+P8mn7d//MtwRX936tRVdO4IxljUe5Ns/QjVeIbH+4UpCuWJ+kmgFFQZMTj5NaR
> oIjFRqyKT/CD5KtlTIfeXaXnKjqEvt8RFxZQRRqikhY3Ef1ZcMmKc4R6Rp2Kp9g9
> p7uaiIid0sPXggMiARqZ0QUbfhhZJbquZlPgc9i/RMsIUPSz6u+3QAzIoKbg1z9z
> 3syVMg00mn1H/7QJQRMzVlBTXKa7Ne0VOToQXPxCiGIwf8ccG8vFb8GpKLVcaS/n
> SPV9pjrCzLjaguM5UtH1iwQi/H5HxRhEfQI+P/Yq/dJKnhDVJJc6nmPi5qa4ePLZ
> /azbGp1jvUDxAyBLq9vXiN5Derv20YTf/4qdXVGUmtVumg3CIpUT3s0jI+JA7lnF
> r3hoVyhVOMi3+jEVy47u8TrCU5pR4GTLz1+Cyhq8spagdY3yMzDLBmJ/0F1eqP+Y
> nqeB5538cI69U1aqwALtzE2FMy44OocyovgvTwBnHg5bIU2farKJJ2O2glZpPTiA
> NUJcE5ydh9cTJx7JoEuUHKJ6
> =T7Lq
> -----END PGP SIGNATURE-----
>
>
> php-8.2.35.tar.gz
> SHA256 hash:
> 9db4204f0a2d1911277ae832185e07bb4c3b3559772753a70d2968ca346d6910
> PGP signature:
> -----BEGIN PGP SIGNATURE-----
>
> iQJPBAABCAA5FiEE5gkT5N8gmQfY4w2WZZqXyc8qeVoFAmrVyAcbFIAAAAAABAAO
> bWFudTIsMi41KzEuMTIsMCwzAAoJEGWal8nPKnlaCTkP/i+SgGgM6SwcL1gg9fXn
> fn31m/MEPGmbibQ0qirWURTAyLrU4Fdxn/JbZnU6dnC75MiZoB7l+Geux1vopJcq
> fPNiRptjsoGJ5UhgNqokiSL52CrVXdaf8IRiW/2uAeOaVjK+oM0cC9CBz21AkKzG
> EVNoWslWMHW4FI5HunSu7l1OoptGN2g5DIUeEoWxE8PI0VNlBmRtdwED4OOVvWr1
> F1AyiLcsOZEXegWvW3A16O5gA9TlU+yWU+HGkikyPEGRlb0BT2f9ntUwyS1FkzAJ
> dEk2txvvcPdhVT/ZDGRpnk2MGDbSXf3nKxs/509x2MrDemT7R0A85Vxd2b3iRSR2
> t/etfQxOwGk4l3265ydOMBDbXgUfKUiPkvGYhUDMgMnkfI1Cj/SfJDoGyaDtbOn5
> xiIuKwFlRPPKgmJkU85j9A/+zQsZEfGvEGDCNt6mSnXHw5m+4nxbs563aE+4XqXh
> BtBeykSkoNsRj8ijKpJJC/Ygd0+faNscww/imbsAYNgIXBNgz+ApjxEa96mcVVU8
> s++wlleO0+KTFsFWGgw/pXJwF8FO0SnWMDvLMHTXeN6wLxEef3f6EL+X052ixB9m
> r+kI7tk+dWWKDj07Uja/CHnmreHTJBZ51tHLO7lXbHRSkykFPpze7GmxmEzXUYZo
> KBzDVOaFSv3PrHeoLZDXqEvf
> =dsL2
> -----END PGP SIGNATURE-----
>
>
> php-8.2.35.tar.xz
> SHA256 hash:
> 5737b98601fe5ab1b8c5db0c82ed3158acb9283ed3081ffe2faffb9ac81455e6
> PGP signature:
> -----BEGIN PGP SIGNATURE-----
>
> iQJPBAABCAA5FiEE5gkT5N8gmQfY4w2WZZqXyc8qeVoFAmrVyAgbFIAAAAAABAAO
> bWFudTIsMi41KzEuMTIsMCwzAAoJEGWal8nPKnlakfEP/iFvT4mcDQcXBeMM6CRm
> SzjpTs7moCgkxQzVISdVOmbFlmdUGjXFgvjlnKbOpw9PNhaUDOR3FfhLYB1XKKCs
> k5XsvF8C9Qh0qM3whwfKXUA2fz7GFsFX8Oe7cOYxKrtdld0rxvm7EbVCpHv+DF34
> TAjKRKL/p4aH5ntfHuuV0+Ow2J1D+Ko8vs3EBnxupPxmbn85W8BEVAj6hRiUFmd+
> zU3pGdBv/naQG/N+NCiSWkWn7VghY6mUf1nwXkdzFrVfQBSvbG5fxiO41RTHzHKB
> iSzOtaMK8Wy6M2+mGdn+UlY+5nSqiZk/cWmTO3mXlRrr1YPTNKnEnrkcDKwCNguC
> 7nTwNblOCaugiOlNNXrXbye9mlzsqFkq9ZrSqb52h5ctDPeXMDpZ8iJKNtDqfX77
> uoUbbRoDzA4xz6osMj237Mtbu6kqPI+QOdAOfBfRiCYWt8SVbsXD+qGUU8AffqWR
> R+fmMlm92ngkhITQx6jN3csTflgWCsBSrR5xirpy5fehMDGZpZ1BSFgILlK3PUPw
> Bpi+rCTiTBKni42uWrqNMXxVYGVS/MIWDK5alXQ6kE5ThwuNMSMaMJvJxZuTViUi
> r9o8X6IonYC0Et3ZpJuWKVjRcwSYzOZ/tKGRB00LKAKXyFyylWhVffAYzEgZSwvH
> qEQfrM2/LyS0lMeOkhjSStPB
> =P6Hg
> -----END PGP SIGNATURE-----
>
>
My thanks to everyone who worked hard to fix these CVEs the past few days!