Fixed PHP versions for CVE-2026-109618 and CVE-2026-109619
The fixed upstream releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12, published 21 October 2026. Anything older on those branches is affected. PHP 8.1 and older get no official release, but Linux distributions ship backported packages that keep the old version number.
- PHP 8.58.5.12Older than 8.5.12 is affected
- PHP 8.48.4.27Older than 8.4.27 is affected
- PHP 8.38.3.36Older than 8.3.36 is affected
- PHP 8.28.2.35Older than 8.2.35 is affected
- PHP 8.68.6.0RC4Pre-release only, not for production
- PHP 8.1, 8.0, 7.4 and olderno releaseAffected unless your vendor backported the fix
Upstream PHP releases
| Branch | Affected | Fixed in | Status |
|---|---|---|---|
| PHP 8.5 | < 8.5.12 | 8.5.12 | Fixed release available |
| PHP 8.4 | < 8.4.27 | 8.4.27 | Fixed release available |
| PHP 8.3 | < 8.3.36 | 8.3.36 | Fixed release available |
| PHP 8.2 | < 8.2.35 | 8.2.35 | Fixed release available PHP 8.2 reaches end of life on 31 December 2026. |
| PHP 8.6 | < 8.6.0RC4 | 8.6.0RC4 | Pre-release Pre-release. RC4 contains the fixes; earlier 8.6.0 builds are affected. Not for production. |
| PHP 8.1 | all | — | End of life No official release. The PHP security team published minimal source backports for 7.4, 8.0 and 8.1; distributions and LTS vendors may ship backported packages with the same version number. |
| PHP 8.0 | all | — | End of life No official release. Source backport and vendor packages only. |
| PHP 7.4 | all | — | End of life No official release. Source backport and vendor packages only. |
Distribution packages with the fix backported
Distributions patch the existing version instead of moving to the new upstream number, so php -v can show an "old" version that is in fact fixed. Compare the full package version (with the distribution suffix) against this table.
| Distribution | Package | Fixed package version | Advisory |
|---|---|---|---|
| Ubuntu 26.10 (stonking) | php8.5 | 8.5.9-0ubuntu2.1 | Ubuntu CVE tracker |
| Ubuntu 26.04 LTS (resolute) | php8.5 | 8.5.4-0ubuntu1.5 | Ubuntu CVE tracker |
| Ubuntu 24.04 LTS (noble) | php8.3 | 8.3.6-0ubuntu0.24.04.13 | Ubuntu CVE tracker |
| Ubuntu 22.04 LTS (jammy) | php8.1 | 8.1.2-1ubuntu2.28 | Ubuntu CVE tracker |
| Ubuntu 20.04 LTS (focal) | php7.4 | 7.4.3-4ubuntu2.29+esm5 | Ubuntu CVE tracker Requires Ubuntu Pro |
| Ubuntu 18.04 LTS (bionic) | php7.2 | 7.2.24-0ubuntu0.18.04.17+esm14 | Ubuntu CVE tracker Requires Ubuntu Pro |
| Ubuntu 16.04 LTS (xenial) | php7.0 | 7.0.33-0ubuntu0.16.04.16+esm22 | Ubuntu CVE tracker Requires Ubuntu Pro (Legacy Support) |
| Debian 13 (trixie) | php8.4 | 8.4.27-1~deb13u1 | DSA-6574-1 |
| Debian 12 (bookworm) | php8.2 | 8.2.35-1~deb12u1 | DLA-4848-1 |
Debian unstable (sid) and forky were still listed as unfixed at the time of writing. Red Hat had not published per-release package versions on its CVE page yet.
Check your package version
Debian / Ubuntu:
dpkg -l 'php*' | grep ^iiRHEL family (look for the CVE in the changelog):
rpm -q --changelog php-common | grep -E "CVE-2026-10961[89]"More environments: self-check commands.
FAQ
My Ubuntu server shows PHP 8.1.2. Is it vulnerable?
Not if the package is 8.1.2-1ubuntu2.28 or newer on Ubuntu 22.04. Ubuntu keeps the upstream number and backports the fix. Check with dpkg -l php8.1-common.
Which Docker image tags are fixed?
Official php images built from the fixed releases: 8.2.35, 8.3.36, 8.4.27, 8.5.12 and their variants (-fpm, -apache, -cli, Alpine). Floating tags like php:8.3-fpm only help after you pull and rebuild.
What about RHEL, AlmaLinux and Rocky Linux?
Red Hat rates CVE-2026-109618 as Important and says installing the fixed release is the only complete fix. Package versions per RHEL release were not yet listed on its CVE page at the time of writing; check the RPM changelog for the CVE ID.