Download PHP 8.3.36 or PHP 8.2.35 from the official php.net downloads page, released on 21 October 2026 to fix two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619.
This page, part of our PHP update guide, covers the Windows builds and Linux packages for both branches, what each release changes, the PHP 8.2 end-of-life date, and how to confirm the update took.
PHP 8.3.36 download
PHP 8.3.36 is the only fixed release for the 8.3 branch. Source tarballs and Windows binaries both sit on php.net, so there is no reason to use a mirror or a third-party download site.
The php.net downloads page may still show PHP 8.3.35 for a short while after the announcement. Wait until the version label reads 8.3.36 before you download.
- Open https://www.php.net/downloads.php in your browser.
- Pick your operating system next to I work with: Linux, macOS or Windows.
- Select version 8.3 in the version picker.
- On Windows, choose ZIP Downloads and pick x64 Non Thread Safe for IIS, FastCGI or the command line, or x64 Thread Safe for Apache.
- Confirm the heading reads PHP 8.3 (8.3.36) before you download the source or the Zip.
- Replace your existing PHP folder or package, keep your
php.ini, and restart the web server or PHP-FPM service.
PHP 8.2.35 download
PHP 8.2.35 is the fixed release for the 8.2 branch, and it comes from the same php.net downloads page as 8.3.36. Linux distributions and LTS vendors received the patches in advance, so most servers get it as a normal package update.
| Where you run PHP 8.2 | Where to get 8.2.35 | What to do |
|---|---|---|
| Windows (IIS or FastCGI) | php.net/downloads.php, Windows, version 8.2 | Download the x64 Non Thread Safe Zip and replace the PHP folder |
| Windows (Apache module) | php.net/downloads.php, Windows, version 8.2 | Download the x64 Thread Safe Zip and replace the PHP folder |
| Debian, Ubuntu, RHEL and other distro packages | Your distribution's security repository | Run the normal package update and check the vendor's security notice for the fixed package version |
| Built from source | php.net/downloads.php, version 8.2 source tarball | Rebuild with your existing configure options |
| rpms.remirepo.net packages | Not available on 21 October | Switch to distribution packages or build from source |
Windows builds need the Visual C++ Redistributable for Visual Studio 2015-2022 (x64 or x86) installed.
PHP 8.3.36 and 8.2.35 security fixes
Both releases fix the same two critical vulnerabilities that can allow unauthenticated remote code execution: the CVE-2026-109618 OOM corruption flaw and the CVE-2026-109619 stale global state bug. The PHP project says all installations serving web requests are at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed.
The risk is highest for mod_php. php.net reports a demonstrated exploit where an unauthenticated request triggers the attack before any application code runs.
| CVE | Advisory ID | Type | What goes wrong |
|---|---|---|---|
| CVE-2026-109618 | GHSA-w8hw-w9fx-j79w | RCE via OOM corruption | Out-of-memory handling can interrupt PHP while internal request data is only partly initialized, and request cleanup may treat that invalid data as valid |
| CVE-2026-109619 | GHSA-6wmf-4rv5-p3rp | RCE via stale global state | Request-owned internal state can survive after its memory is freed, and a later request on the same worker may use it before initialization resets it |
The PHP security team rated both flaws CVSS v4.0 9.2 in its advance notice on 20 October. Partial workarounds exist, but php.net states that updating is the only safe choice; the PHP mitigations for CVE-2026-109618 and CVE-2026-109619 only reduce exposure while you schedule the update.
PHP 8.3.36 changelog
PHP 8.3.36 is a single-purpose security release. The official ChangeLog lists one Core entry and nothing else, so it carries no behaviour changes for your code.
| Version | Component | Change |
|---|---|---|
| 8.3.36 | Core | Fixed GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp (avoid state corruption via bailout) |
| 8.3.35 (24 Sep 2026) | Filter, FPM, MySQLnd, OpenSSL, Phar, SOAP, Standard, Windows | Earlier security release with fixes such as an FPM IPv6 ACL bypass (CVE-2026-91768) and Windows reserved device names (CVE-2026-17545) |
If you are still on a release older than 8.3.35, moving to 8.3.36 also brings in every September fix in one step.
PHP 8.2.35 changelog
PHP 8.2.35 has the same single Core fix as 8.3.36. The previous 8.2 release, 8.2.34 from 24 September 2026, carried the same September security set as 8.3.35.
| Version | Component | Change |
|---|---|---|
| 8.2.35 | Core | Fixed GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp (avoid state corruption via bailout) |
| 8.2.34 (24 Sep 2026) | OpenSSL | TLS hostname verification fallback to CN after SAN mismatch (CVE-2026-91769) and a wildcard CN heap overflow (CVE-2026-91767) |
| 8.2.34 (24 Sep 2026) | SOAP, Phar, Standard | SOAP recursion and HTTP parsing overflow, Phar TAR entry injection, HTTP stream wrapper redirect leaks |
Install PHP 8.3.36 or 8.2.35 with apt or dnf on Linux
Distribution packages keep their own version numbers and backport the fix, so the package version may not read 8.3.36 or 8.2.35 exactly. Check your vendor's security notice for the fixed package version, such as the patched Ubuntu and Debian PHP packages listed in USN-8948-1.
sudo apt update && sudo apt upgradeRefreshes the package lists and installs every pending update, including the patched PHP packages, on Debian and Ubuntu. On Fedora, RHEL and similar systems run sudo dnf upgrade instead.
You should see: The PHP packages appear in the upgrade list. Restart PHP-FPM or Apache afterwards so no worker keeps running the old code.
The step-by-step PHP update for Windows, Linux and XAMPP covers service restarts and local stacks in more detail.
Check your PHP version after the 8.3.36 or 8.2.35 update
php -vPrints the version of the PHP command-line binary on your PATH.
You should see: The first line starts with PHP 8.3.36 or PHP 8.2.35. For the web server, load a page that calls phpinfo() and confirm the same version, then delete that page.
The CLI and the web server can use different PHP builds. A correct php -v result does not prove that PHP-FPM or mod_php was updated, so check both.
PHP 8.2 end of life: December 31, 2026
PHP 8.2 receives security fixes only until 31 December 2026. After that date the PHP project publishes no further fixes for the branch, and the 8.2.35 announcement asks users to plan an upgrade now.
| Branch | Initial release | Active support until | Security support until |
|---|---|---|---|
| 8.2 | 8 Dec 2022 | 31 Dec 2024 | 31 Dec 2026 |
| 8.3 | 23 Nov 2023 | 31 Dec 2025 | 31 Dec 2027 |
| 8.4 | 21 Nov 2024 | 31 Dec 2026 | 31 Dec 2028 |
| 8.5 | 20 Nov 2025 | 31 Dec 2027 | 31 Dec 2029 |
PHP 8.1 and older get no updates from the PHP project. Given the severity, the security team published minimal source backports for 7.4, 8.0 and 8.1 for people building from source; otherwise ask your LTS vendor.
Should you upgrade to PHP 8.4 or 8.5?
Patch first, then plan the branch move. PHP 8.4.27 and 8.5.12 carry the same two fixes, so jumping branches today gives no extra protection, but it does buy more support time.
Install 8.3.36 or 8.2.35 today, then move 8.2 sites to PHP 8.4 or 8.5 before 31 December 2026. A minor-version jump needs testing against the migration guide, while the security fix cannot wait. PHP 8.4 is supported until 31 December 2028 and PHP 8.5 until 31 December 2029; the PHP 8.4.27 download and PHP 8.5.12 download are the patched builds for those branches.
PHP 8.3.36 or 8.2.35 update not showing
The php.net downloads page still shows 8.3.35 or 8.2.34
The page was cached or loaded before the new builds were added.
- Reload https://www.php.net/downloads.php and pick the version again.
- Check that the heading shows 8.3.36 or 8.2.35 before you download.
`php -v` still shows the old version after the update
Another PHP binary sits earlier on PATH, or the service was not restarted.
- On Windows, confirm the PATH entry points to the folder you replaced.
- Restart PHP-FPM, Apache or IIS so every worker loads the new build.
- Run
php -vagain and checkphpinfo()on the web server.
No 8.2.35 or 8.3.36 package in a remirepo repository
php.net states the volunteer-maintained rpms.remirepo.net will not have updates on 21 October.
- Switch to your distribution's own PHP packages, or build 8.3.36 or 8.2.35 from the php.net source tarball.
PHP 8.3.36 and 8.2.35 FAQ
When was PHP 8.3.36 released?
PHP 8.3.36 and PHP 8.2.35 were announced on php.net on 21 October 2026, alongside PHP 8.5.12 and 8.4.27. All four are security releases that fix CVE-2026-109618 and CVE-2026-109619.
Is PHP 8.3.36 a security release?
Yes. PHP 8.3.36 is a security release that fixes two critical vulnerabilities allowing unauthenticated remote code execution. Its ChangeLog contains a single Core fix and no feature or behaviour changes.
Where can I download PHP 8.2.35 for Windows?
Download PHP 8.2.35 for Windows from php.net/downloads.php by choosing Windows and version 8.2. Use the Non Thread Safe Zip for IIS or the command line and the Thread Safe Zip for Apache.
Which PHP versions fix CVE-2026-109618 and CVE-2026-109619?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix both vulnerabilities. Older branches get no project releases, though minimal source backports exist for PHP 7.4, 8.0 and 8.1.
Is there a workaround if I cannot install PHP 8.3.36 yet?
php.net lists partial measures, such as disabling session.upload_progress.enabled, but says they do not make an installation safe. Updating to 8.3.36 or 8.2.35 is the only complete fix.
When does PHP 8.3 reach end of life?
PHP 8.3 gets security fixes until 31 December 2027. Its active support ended on 31 December 2025, so 8.3 releases now carry security fixes only.
Is PHP 8.2 still supported?
Yes, until 31 December 2026. PHP 8.2 receives security fixes only, and after that date the PHP project will publish no further releases for it.
Does PHP 8.3.36 break existing code?
The 8.3.36 ChangeLog contains only the security fix for state corruption via bailout. No functions, settings or language features change, so code that runs on 8.3.35 should run unchanged.
