What Is the Latest Version of PHP? October 2026 Release and Security Update

What is the latest version of PHP? As of October 21, 2026, PHP 8.5.12 is the latest stable release, according to the PHP development team’s current release announcements. The update addresses two critical security vulnerabilities that could allow remote code execution without authentication. Developers and website administrators should prioritize this security update while checking application compatibility and support status.

PHP is a widely used server-side programming language for websites, web applications, content management systems, and online services. Keeping it updated helps developers maintain secure, reliable applications and benefit from improvements to the language.

The latest release also highlights an important distinction. PHP 8.6.0 is moving through its release-candidate testing cycle, but it is not the stable production release. For live websites, developers should use a supported stable branch rather than an experimental build.

What Is the Latest Version of PHP in October 2026?

PHP 8.5.12 is the latest stable PHP release as of October 21, 2026. The PHP development team announced it as a security release addressing two critical vulnerabilities.

The same security update cycle includes releases for other supported PHP branches. Administrators should identify their installed version and apply the appropriate update rather than assuming every website runs PHP 8.5.

The current release information is:

The four stable releases address the same two critical vulnerabilities. The appropriate version depends on the PHP branch installed on the server and the application’s compatibility requirements.

Developers should not assume that upgrading to PHP 8.5 is the only way to address the vulnerabilities. Applying the latest security release within an existing supported branch may be the most practical immediate step for applications that cannot yet migrate to a newer minor version.

PHP 8.5.12: The Latest Stable Release

PHP 8.5.12 became available on October 21, 2026. The release addresses two critical vulnerabilities that could enable unauthenticated remote code execution.

Remote code execution is a serious security risk because it can allow an attacker to execute code on a vulnerable server. The potential consequences depend on the server’s configuration, permissions, exposed services, and the nature of the exploited vulnerability.

The PHP security team has urged users to update immediately. Its announcement identifies the vulnerabilities as critical and states that updating is the necessary response.

This makes PHP 8.5.12 particularly important for website owners who already use the PHP 8.5 branch.

The release is a maintenance and security update, not a new major version of the language. Applications already running PHP 8.5 should still undergo appropriate deployment checks, but the security implications make delaying the update especially concerning.

Before upgrading, administrators should confirm that the hosting environment supports the release and that their deployment process installs the intended version.

What Security Problems Does the Latest PHP Update Address?

The October 21, 2026, PHP security announcements identify two critical vulnerabilities: CVE-2026-109618 and CVE-2026-109619.

The PHP development team reports that these vulnerabilities can allow unauthenticated remote code execution. Both are rated 9.2 under CVSS version 4.0, according to the published security information.

The announcement identifies PHP installations serving web requests as potentially affected. This includes environments using PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, and LiteSpeed.

The security team also identifies mod_php as a particularly high-risk configuration because it has a demonstrated exploit that can trigger an attack before application code runs.

These details make the update relevant to more than developers working on new applications. Website administrators, hosting providers, and organizations maintaining older PHP applications should determine whether their environments use affected versions.

The immediate priority is to identify the installed PHP branch, obtain the corresponding security release, and verify that the web server actually uses the updated runtime.

Simply updating a command-line installation may not protect a website if its web-facing PHP runtime remains vulnerable.

Which PHP Versions Received the Latest Security Updates?

The PHP project released updates across four branches on October 21, 2026. Each release addresses the two critical vulnerabilities announced by the security team.

PHP 8.5.12

PHP 8.5.12 is the latest stable release in the current PHP 8.5 series. Users of this branch should update to this version to address the announced vulnerabilities.

PHP 8.4.27

PHP 8.4.27 provides the corresponding security update for the PHP 8.4 branch. Applications that depend on PHP 8.4 compatibility can apply this release without immediately migrating to PHP 8.5.

PHP 8.3.36

PHP 8.3.36 contains the security fixes for the PHP 8.3 branch. Administrators who continue to use this series should confirm their support status and plan their longer-term upgrade strategy.

PHP 8.2.35

PHP 8.2.35 addresses the same vulnerabilities for the PHP 8.2 series. However, PHP 8.2 is approaching the end of its official support period, with end of life scheduled for December 31, 2026.

Organizations using PHP 8.2 should apply the current security update and prepare to migrate to a branch with a longer support horizon.

These releases demonstrate why administrators should monitor the exact PHP branch running their applications. A security fix may be available for several branches, but their remaining support periods differ.

Is PHP 8.6 Available Yet?

PHP 8.6.0 is in its release-candidate testing cycle as of October 21, 2026. The PHP project announced PHP 8.6.0 RC3 on October 8 and scheduled RC4 for October 22.

A release candidate is a pre-release build intended for testing before a stable production release. Developers can use it to check compatibility, report defects, and prepare applications for a future upgrade.

However, the PHP project explicitly advises users not to use these early testing releases in production.

Therefore, PHP 8.6.0 RC3 should not be confused with the latest stable PHP version. The current stable release remains PHP 8.5.12.

Teams interested in PHP 8.6 can test the release candidate in a separate development environment. They should keep production applications on an appropriate supported stable release until the PHP project announces a stable version.

The distinction is especially important for businesses that operate public websites, online stores, customer portals, or applications that process sensitive information.

How to Check Your Current PHP Version

Before installing an update, identify the PHP version that your application currently uses. This helps determine which security release applies to your environment.

Check PHP Through a Terminal

On a server or computer with PHP installed, run this command: php -v

The command displays the version associated with the PHP executable available in the current command-line environment.

For example, an installation might report a PHP 8.4 release. In that case, the administrator should investigate the appropriate PHP 8.4 security update rather than assuming the server needs PHP 8.5 immediately.

Remember that the command-line version may differ from the runtime serving website requests. Some hosting environments maintain separate configurations for command-line scripts and web applications.

Check Your Hosting Control Panel

Many hosting providers display the selected PHP version in their website management dashboards.

Look for a PHP configuration, runtime, or software section. Depending on the hosting platform, you may be able to select a supported version or request an update from the provider.

After making a change, confirm that the website uses the intended release. A successful control-panel change does not eliminate the need to verify the active runtime.

Check the Web Runtime Carefully

A temporary diagnostic script can display the PHP version used by a web request:

<?php
echo PHP_VERSION;

Use this method only when appropriate and remove the file immediately afterward. Public diagnostic files can disclose server information.

For production systems, hosting dashboards, command-line checks, server configuration, and deployment logs can help establish which version is actually running.

How to Update PHP to the Latest Version

The update procedure depends on the hosting provider, operating system, web server, and PHP installation method.

For a website already running PHP 8.5, the immediate goal is to install PHP 8.5.12 or ensure the hosting provider has applied that security release. Applications running other supported branches should receive their corresponding patched versions.

A safe upgrade process includes several steps.

1. Identify the installed branch. Check the version used by both the website and any important command-line jobs.

2. Confirm the available security release. Match the installed branch with the applicable October 21 update.

3. Back up important data. Preserve the website files, database, configuration, and other essential information before changing the runtime.

4. Review dependencies. Check framework requirements, PHP extensions, application packages, and hosting restrictions.

5. Test the update. Where practical, use a staging environment to confirm that critical application functions continue to work.

6. Deploy the security release. Follow the hosting provider’s or server administrator’s installation procedure. Restart or reload the relevant services when required.

7. Verify the running version. Confirm that the web-facing runtime uses the updated release rather than an older installation.

8. Monitor application behavior. Review error logs, website availability, scheduled jobs, and essential user workflows after deployment.

The exact process differs between managed hosting and self-managed servers. Administrators should follow the instructions for their actual environment instead of copying commands intended for a different operating system.

Does Updating PHP Automatically Make a Website Secure?

Updating PHP addresses vulnerabilities fixed by the new release, but it does not guarantee complete website security.

Applications can still contain vulnerable dependencies, insecure authentication systems, unsafe input handling, or incorrectly configured server permissions.

Website administrators should combine PHP maintenance with regular application updates, secure configuration, access controls, reliable backups, and monitoring.

They should also review third-party packages and extensions. A current PHP runtime cannot compensate for an outdated component that introduces its own security weakness.

The October 21 update deserves immediate attention because of the severity of the announced vulnerabilities. Nevertheless, administrators should treat it as one essential part of an ongoing security process.

For organizations handling customer accounts, business records, or online transactions, documenting the installed runtime and its update status can make maintenance more consistent.

How Long Will PHP 8.2 Receive Support?

PHP 8.2 reaches the end of its official support period on December 31, 2026. According to the PHP project’s announcement, it will receive no further official security fixes after that date.

The October 21 release, PHP 8.2.35, provides the current security update for that branch. However, installing it does not extend the branch’s official support period.

Organizations that still depend on PHP 8.2 should begin planning a migration to a supported version. They should review framework requirements, update dependencies, test their applications, and schedule the transition before the deadline.

A migration plan is especially important for large websites or systems that cannot tolerate unexpected downtime.

The target should be a supported PHP branch that meets the application’s technical requirements and offers an appropriate remaining support period. The latest stable branch may be a suitable option, but compatibility must be checked first.

What Should Developers Know About PHP Version Compatibility?

Not every PHP application can move to a newer minor branch without preparation.

Frameworks and libraries specify which PHP versions they support. Older applications may rely on deprecated features, outdated extensions, or dependencies that have not been updated for a newer runtime.

Before moving from PHP 8.3 or PHP 8.4 to PHP 8.5, developers should review the migration documentation and test the complete application.

Pay particular attention to database operations, authentication, form submissions, scheduled tasks, API integrations, file uploads, and other essential workflows.

Composer-based projects should also review dependency constraints to determine whether their installed packages support the intended PHP version.

For the immediate October 21 security issue, applying the corresponding patch within the existing branch may reduce the need for an urgent major migration. However, the application must still move toward a supported long-term version when necessary.

Frequently Asked Questions

What is the latest version of PHP today?

PHP 8.5.12 is the latest stable PHP version as of October 21, 2026. It includes fixes for two critical security vulnerabilities.

Is PHP 8.5.12 safe for production websites?

PHP 8.5.12 is a stable release. Administrators should apply it promptly to address the announced vulnerabilities, while following appropriate compatibility checks and deployment procedures.

What are the latest PHP security updates?

The October 21, 2026, releases are PHP 8.5.12, PHP 8.4.27, PHP 8.3.36, and PHP 8.2.35. They address CVE-2026-109618 and CVE-2026-109619.

Should I install PHP 8.6 RC3?

No, not for a production website. PHP 8.6.0 RC3 is a testing release, and the PHP project advises against using early release candidates in production.

Can I remain on PHP 8.4 instead of upgrading to PHP 8.5?

PHP 8.4.27 is the current security release for the PHP 8.4 branch. Whether you should remain on that branch depends on your application’s requirements and its support horizon.

When does PHP 8.2 reach end of life?

PHP 8.2 reaches end of life on December 31, 2026. Users should apply PHP 8.2.35 and plan a migration to a supported branch.

How do I check which PHP version my website uses?

Run php -v in a terminal to check the command-line installation. Then verify the website’s runtime through your hosting dashboard or server configuration because the two versions can differ.

Will the latest PHP version improve performance?

Newer PHP releases can include performance improvements, but results depend on the application and its configuration. The immediate benefit of PHP 8.5.12 is its critical security fixes.

Can an older PHP branch receive security updates?

A branch may receive security fixes while it remains within its official support period. Once it reaches end of life, the PHP project no longer provides regular official security updates for that branch.

Should I update PHP manually or contact my hosting provider?

If you manage your own server, follow the installation procedure for your operating system and PHP setup. Managed-hosting customers should check the provider’s version controls or request assistance if the patched release is unavailable.

Conclusion

PHP 8.5.12 is the latest stable PHP release as of October 21, 2026, and its critical security fixes make the update especially important. The PHP project has also issued corresponding patches for PHP 8.4, PHP 8.3, and PHP 8.2.

Website owners should identify their active runtime, install the appropriate security update, and verify that their web applications use the patched version. Developers should also distinguish stable releases from PHP 8.6 release candidates and plan migrations around official support deadlines.

Which PHP version are you using, and have you applied the latest security update? Share your experience in the comments and return for confirmed PHP release updates.