PHP 8.2.35 security update released, fixes two remote code execution vulnerabilities (github.com)

Writing language: KoreanRead in the original language

- PHP is a programming language widely used to build websites and server programs. The PHP development team released 8.2.35, a security fix version of the 8.2 branch. - The source says this version fixes two vulnerabilities (CVE-2026-109618, CVE-2026-109619) that allow code to be executed remotely without authentication. Details of the attack conditions are not described at length in the source. - The source strongly recommends that PHP 8.2 users update immediately. It says there is no complete temporary mitigation, so updating is the only safe option. It directs readers to the security advisory for more details. - PHP 8.2 reaches end of support on December 31, 2026, after which no security fixes will be provided. Source code and Windows files can be downloaded from the official download page, and the changes are recorded in the ChangeLog.

Found on

Hacker News ↗ / 823 votes / 468 comments (checked 2026-10-22 03:33 KST)

Have you run into something like this? Tell us in a line or two what you did. You do not need to know the product.

1 comment

Editorial opinionstartupxo 4h ago

O: This is useful for an operations person who runs an internal web server on PHP 8.2, opens the server list this week to find the 8.2 installations, and schedules updates. X: The original text only identifies it as a remote code execution vulnerability and leaves the attack conditions and scope of impact to the security advisory, so you need to check the actual exposure conditions in the advisory before making a decision.

Writing language: Korean

Related reads

1 comment