PHP 8.2 branch, end of life 31 December 2026
PHP 8.2.35: the PHP2Shell fix, and the last months of PHP 8.2
PHP 8.2.35 is the PHP project's fix for PHP2Shell (CVE-2026-109618 and CVE-2026-109619) on PHP 8.2, released on 21 October 2026. Install it now, then plan to leave the branch: php.net's security support for PHP 8.2 ends on 31 December 2026, and after that the PHP project issues no more 8.2 fixes.
Last reviewed against php.net, Debian LTS, Red Hat and the official Docker image.
The 8.2.35 release
What PHP 8.2.35 is
This is a security-only point release on a branch in its final year. php.net's announcement for it carries a reminder that PHP 8.2 receives no further security fixes after 31 December 2026.
| Out since | 21 October 2026 |
|---|---|
| Security content | The PHP2Shell fix for CVE-2026-109618 and CVE-2026-109619 |
| Non-security changes | None listed; the ChangeLog has one Core entry |
| Last 8.2 release before it | 8.2.34 (24 September 2026) |
| Windows | 8.2.35-1, built with Visual Studio 2019 (VS16), dated 26 October 2026 |
| PHP 8.2 lifecycle | Security fixes only since 31 December 2024; end of life on 31 December 2026 |
The single ChangeLog entry
php.net's ChangeLog for 8.2.35 contains one fix under Core: GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp, "Avoid state corruption via bailout". There is nothing else in the release, so regression testing can focus on the sites themselves rather than on new PHP behaviour.
The ChangeLog dates that entry 22 October 2026. php.net's release post, its source download listing and the advisories give 21 October, and this page follows them.
Below 8.2.35 means exposed
Every 8.2 release up to 8.2.34 is affected by both CVEs, and the PHP project's advisory names PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed among the exposed setups. The exception is a vendor build with the fix backported, such as the Red Hat channels in the table below. On 26 October 2026 CISA added both flaws to its Known Exploited Vulnerabilities catalogue.
PHP2Shell in fullAvailability checked 27 October 2026
Sources for PHP 8.2.35
PHP 8.2 is still the default on Debian 12 and a supported stream on RHEL 8 and 9. Every row below is patched, including the two Red Hat rows marked backport, which carry the fix under lower 8.2 numbers.
| Source | Package or channel | Fixed in | Reference |
|---|---|---|---|
| php.net source | php-8.2.35 in .tar.gz, .tar.bz2 and .tar.xz, signed | 8.2.35 | php.net downloads, 21 Oct 2026 |
| php.net Windows | VS16 x64 and x86 builds; Non Thread Safe for IIS | 8.2.35-1 | PHP 8.2 for Windows, 26 Oct 2026 |
| Official Docker image | 8.2.35, 8.2.35-fpm, -apache, -cli and -zts on trixie and bookworm; cli, fpm and zts on alpine3.24 and alpine3.23; 8.2 aliases | 8.2.35 | Docker Hub php |
| Debian 12 (bookworm) | php8.2 from bookworm-security, issued by the Debian LTS team | 8.2.35-1~deb12u1 | DLA-4848-1, 21 Oct 2026 |
| RHEL 9 | php:8.2 module stream | 8.2.35-1.module+el9.8.0+25111+a1450321 | RHSA-2026:87072, 21 Oct 2026 |
| RHEL 8 | php:8.2 module stream | 8.2.35-1.module+el8.10.0+25110+f67151d2 | RHSA-2026:87073, 21 Oct 2026 |
| RHEL 9.6 EUS | php:8.2 on the 9.6 Extended Update Support channel | 8.2.28-1.module+el9.6.0+25176+d8415d54.4 (backport) | RHSA-2026:88834, 23 Oct 2026 |
| RHEL 9.4 for SAP | php:8.2 on 9.4 Update Services for SAP Solutions | 8.2.13-1.module+el9.4.0+25177+88c847cf.4 (backport) | RHSA-2026:88835, 23 Oct 2026 |
| AlmaLinux 8 and 9 | php:8.2 stream | 8.2.35-1.module_el8.10.0+4323+fc907035 on 8; AlmaLinux's earlier 8.2.33 .alma.1 builds also carry the fix | ALSA-2026:87073 and 87072, 22 Oct 2026 |
| Rocky Linux 8 and 9 | php:8.2 stream | 8.2.35-1.module+el8.10.0+40394+d21b33fb (8), 8.2.35-1.module+el9.8.0+40395+2f706e64 (9) | RLSA-2026:87073 and 87072, 22 Oct 2026 |
| Amazon Linux 2023 | php8.2 packages (release 2023.12.20261021) | 8.2.35-1.amzn2023.0.1 | ALAS2023-2026-3301, 22 Oct 2026 |
| packages.sury.org | php8.2-* for Debian 12 and 13 and Ubuntu 22.04, 24.04 and 26.04 | 8.2.35-1+0~20261021.94 and a release suffix | packages.sury.org/php |
| Ondřej Surý PPA | php8.2-* for Ubuntu 24.04 and 22.04 | 8.2.35-1+ubuntu24.04.1+deb.sury.org+1 on 24.04 | ppa:ondrej/php |
| Remi's repository | php:remi-8.2 module or php82 collection | 8.2.35-1 | Remi, 22 Oct 2026 |
| cPanel EasyApache 4 | ea-php82, up from 8.2.34 in release 25.91 | 8.2.35 | EasyApache 4 release 25.91 |
| Plesk | PHP 8.2 for hosted sites | 8.2.35 (21 Oct); 8.2.35-1 on Windows (27 Oct) | Plesk Obsidian change log |
| LiteSpeed repository | lsphp82 | 8.2.35-1 | rpms.litespeedtech.com |
- The two backports. Red Hat's 9.6 Extended Update Support and 9.4 SAP channels each follow one earlier RHEL minor release, and Red Hat added the fix to the 8.2.28 and 8.2.13 builds they already carried. A server on one of them is fixed at that number.
- AlmaLinux on 21 October. Before
rebuilding Red Hat's errata, AlmaLinux shipped its own fix for
php:8.2 on AlmaLinux 8 and 9 as 8.2.33 builds ending
.alma.1. The 8.2.35 packages from 22 October are newer and replace them. - Ubuntu. No Ubuntu release ships php8.2, and none appears with it in USN-8948-1 or USN-8948-2. On Ubuntu, PHP 8.2 means the Ondřej Surý PPA or packages.sury.org.
Applying 8.2.35
Patch today, plan the branch change next
Each card covers the patch on one platform and the first step towards leaving PHP 8.2 there.
Debian 12 (bookworm)
Bookworm's default PHP is 8.2, and DLA-4848-1 brought it to 8.2.35-1~deb12u1 on release day. Debian 12 now sits with the Debian LTS team, whose fixes come through the same bookworm-security suite, so a normal apt upgrade picks them up.
Debian 12 update steps
RHEL 8 and 9 on php:8.2
The php:8.2 module stream was fixed on both releases on 21 October, with AlmaLinux and Rocky Linux following under the same numbers. Two older extended channels, RHEL 9.6 EUS and 9.4 for SAP, were patched at 8.2.28 and 8.2.13 instead.
Patch php:8.2 on RHEL 8 and 9
cPanel, Plesk and shared hosting
Both panels shipped 8.2.35 on 21 October. Hosted sites on PHP 8.2 are patched when the provider runs the update; the site owner's job is to confirm the version, then, where the host allows it, use the panel's PHP selector to move off 8.2 before the year ends.
Update PHP on shared hosting
php:8.2 images
The 8.2 tags now carry 8.2.35. When PHP 8.1 reached end of life its tags stopped updating, with php:8.1-fpm last pushed on 31 December 2025. Expect 8.2 to follow, and schedule the base image change alongside this rebuild.
Rebuilding php:8.2 imagesPanel-specific steps: cPanel and WHM and Plesk. Amazon Linux 2023 has its own php8.2 packages, covered in updating PHP on Amazon Linux. Windows servers need the 8.2.35-1 zip from php.net, which also carries the Brotli fix for CVE-2026-111497: PHP on Windows and IIS.
Check, then move on
Confirm 8.2.35, then leave PHP 8.2 by 31 December
These commands show which 8.2 build is installed. Restart PHP-FPM (php8.2-fpm on Debian, php-fpm on the RHEL family) or Apache first, so the running workers match the files on disk.
# Debian 12: the LTS fix is 8.2.35-1~deb12u1
dpkg-query -W php8.2-fpm php8.2-cli libapache2-mod-php8.2
# Debian: list installed packages whose security support is limited or ended
check-support-status
# RHEL 8 or 9 family: confirm the php:8.2 stream and the installed build
dnf module list php
rpm -q php-fpm php-common check-support-status comes
from Debian's debian-security-support package. Afterwards, read the
version as the website sees it, following
how to check your PHP version,
and use
how to update PHP
for the full steps on each platform.
Planning the move off PHP 8.2
Start now so the change is tested well before 31 December 2026. The two natural targets each have a guide: PHP 8.2 to 8.3 (security support to the end of 2027) and PHP 8.2 to 8.4 (to the end of 2028). The upgrade hub covers the other routes, and what PHP 8.2's end of life means explains the deadline. The same day's releases for the newer branches: 8.3.36, 8.4.27 and 8.5.12.
Distribution life cycles run on their own clocks
php.net's date applies to the PHP project's releases. Red Hat's Application Streams life cycle keeps php:8.2 until May 2029 on RHEL 8 and 9, and it lists no newer PHP stream for RHEL 8. Debian 12 is in Debian LTS until 30 June 2028; check-support-status reports which of its packages have limited or ended support. If you rely on those, the deadline that matters is your vendor's. Until 8.2.35 is installed, the stopgaps are the interim settings, and the offline decision guide covers servers that cannot be patched soon.
Quick answers
About PHP 8.2.35
Is PHP 8.2.35 safe?
It closes PHP2Shell: the PHP project's advisories list 8.2.35 as the patched 8.2 release for both CVEs. The longer-term issue is the branch. php.net's security support for 8.2 ends on 31 December 2026, so a flaw found in 2027 will get no 8.2 release from the PHP project.
Does Debian 12 have PHP 8.2.35?
Yes. The Debian LTS team issued DLA-4848-1 on 21 October 2026, moving bookworm's php8.2 to 8.2.35-1~deb12u1. Debian's tracker shows it in bookworm's security suite; the main bookworm suite still holds the vulnerable 8.2.32 build, so make sure security updates are configured.
What changed in PHP 8.2.35?
Just the PHP2Shell fix. The 8.2.35 ChangeLog holds one Core line, the bailout fix tagged with both GitHub advisory identifiers. PHP 8.2 left active support at the end of 2024, which is why no ordinary bug fixes ride along.
Will there be a PHP 8.2.36?
Only if a critical security issue needs one before 31 December 2026. php.net makes releases for security-only branches as needed rather than on a schedule, and none at all once a branch reaches end of life.
Should I move from PHP 8.2 to 8.3 or to 8.4?
Either removes the end of year deadline. PHP 8.3 keeps security support until 31 December 2027 and is the default on Ubuntu 24.04 and RHEL 10; PHP 8.4 runs until 31 December 2028 and is Debian 13's default. Check what your application supports before choosing.
Does Red Hat drop PHP 8.2 on 31 December 2026?
Not on Red Hat's own schedule. Its Application Streams life cycle gives the php:8.2 stream a retirement date of May 2029 on both RHEL 8 and RHEL 9, so Red Hat's builds can keep receiving fixes after php.net stops. That support covers Red Hat's packages only, not 8.2 from other sources.
Know your exposure
Find every PHP server you run
Patching the server you know about is the easy part. A vulnerability scan finds the forgotten staging site, the old microsite and the appliance with PHP inside, then tells you which ones are still exposed.