PHP patches 8.2-8.5 branches to block unauthenticated remote code execution in latest security update

PHP has released security updates for its current supported branches to address two critical vulnerabilities that allow for unauthenticated remote code execution. According to reports from Phoronix and the r/netsec community, the updates target versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. These patches are designed to close security gaps that could otherwise allow attackers to run arbitrary code on vulnerable servers without needing valid credentials.

The severity of these flaws is highlighted by the fact that they can be exploited remotely and without authentication. Phoronix describes the vulnerabilities as critical, noting that they enable unauthenticated remote code execution. This means that an attacker does not need to log in or bypass any authentication mechanisms to potentially compromise a server running an affected version of PHP. The immediate release of patches across four major version lines underscores the urgency of the situation for web hosting providers and system administrators.

Context and Background

These updates follow a trend of significant security patches across various software ecosystems this month. As Threat Times reported on October 21, 2026, the Python Pillow imaging library was found to have a severe vulnerability allowing remote code execution via crafted image files. That report covered versions from 11.0.0 up to 13.0.0, highlighting the ongoing risks in widely used open-source libraries.

Also on October 21, 2026, Threat Times reported on a critical heap-based buffer overflow in the GStreamer rtpL16depay plugin. That vulnerability allowed remote attackers to execute arbitrary code via crafted RTP payloads. The current PHP vulnerabilities, while distinct in their technical details, share the characteristic of enabling remote code execution, which remains one of the most dangerous classes of software defects.

Who Is Affected

System administrators managing servers running PHP versions prior to the newly released patches are directly at risk. Specifically, anyone running PHP 8.5.x before version 8.5.12, 8.4.x before 8.4.27, 8.3.x before 8.3.36, or 8.2.x before 8.2.35 should consider their environment vulnerable. Phoronix advises server administrators to update immediately to mitigate the risk of exploitation. Web hosting companies that manage multiple client sites on shared PHP installations also need to act quickly to ensure all underlying server software is patched.

What should you do?

Server administrators should verify the current PHP version installed on their systems and compare it against the patched versions listed in the release notes. If the installed version is older than the patched release, administrators should schedule an immediate update. It is crucial to test the updates in a staging environment before deploying them to production servers to ensure compatibility with existing applications. Monitoring server logs for unusual activity is also recommended as a precautionary measure while updates are being rolled out.

What to do and how to stay safe: PHP

• Check the currently installed PHP version on all servers and compare it to the patched versions (8.5.12, 8.4.27, 8.3.36, 8.2.35).
• Apply the security updates immediately to all production and staging environments running affected PHP versions.
• Review server access logs for any signs of unauthorized access or suspicious code execution attempts prior to patching.
• Ensure that all web applications are compatible with the updated PHP versions to prevent service disruptions after the update.

Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which PHP versions are affected by these critical vulnerabilities?

PHP versions 8.5.x prior to 8.5.12, 8.4.x prior to 8.4.27, 8.3.x prior to 8.3.36, and 8.2.x prior to 8.2.35 are affected by the critical unauthenticated remote code execution flaws.

Do the attackers need to authenticate to exploit these vulnerabilities?

No, the source material states that these vulnerabilities allow for unauthenticated remote code execution, meaning attackers do not need valid credentials to exploit them.

When were these patches released?

The patches were just released, according to reports from Phoronix and the r/netsec community, urging immediate updates for server administrators.