PHP 8.4 branch, 21 October 2026
PHP 8.4.27: closing PHP2Shell on the PHP 8.4 branch
PHP 8.4.27, released on 21 October 2026, is the first PHP 8.4 build that is not exposed to PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Debian 13 and RHEL 10 shipped that same upstream release as their security updates, so on those systems a patched server should report 8.4.27 rather than an older number.
Last reviewed against php.net, Debian, Red Hat and the official Docker image.
Release facts
PHP 8.4.27 at a glance
PHP 8.4 is in its last months of active support, so 8.4.27 is a full point release: the security fix plus the branch's usual bug fixes.
| Published | 21 October 2026, the same day as 8.5.12, 8.3.36 and 8.2.35 |
|---|---|
| Closes | CVE-2026-109618 (RCE via OOM corruption) and CVE-2026-109619 (RCE via stale global state) |
| Also includes | Ordinary bug fixes across the engine, OPcache, DOM, XSL, Zip, PDO and more, outlined below |
| Supersedes | PHP 8.4.26 of 24 September 2026 |
| Windows | Rebuilt as 8.4.27-1 on 26 October 2026 (Visual Studio 2022, VS17) |
| PHP 8.4 support | Bug fixes and security fixes until 31 December 2026; critical security fixes only from then until 31 December 2028 |
A note on the date: the 8.4.27 ChangeLog entry says 22 Oct 2026, one day later than the announcement. The source files on php.net's downloads page are dated 21 October, as are the release post and the two advisories, so this page goes by 21 October.
The security change
At the top of the Core section sits "Avoid state corruption via bailout", tagged GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp. It is the one change that closes both CVEs; the PHP project rates each Critical, 9.2 on CVSS v4.0, and both can be triggered by an unauthenticated request.
What PHP2Shell is and who is exposedThe rest of the 8.4.27 ChangeLog
- PHP-FPM stability. An OPcache bug that could crash FPM workers with SIGSEGV when a class was reached through the class entry cache (GH-23637).
- Memory safety in extensions. Use-after-free fixes in DOMXPath during an evaluation, XSLTProcessor::importStylesheet() mid-transform, and ZipArchive::close() from a progress callback.
- Data access. PDOStatement column metadata, bindColumn() and execute() fixes, error reporting for PDO_DBLIB transactions, and a mysqlnd leak.
- Behaviour fixes. ZipArchive::extractTo() honouring a non-list file array, SplFixedArray::setSize() on subclasses, and socket_select() no longer truncating large sets on Windows.
- Also touched. The garbage collector, JIT, BCMath, the CLI server, GD, Intl, mbstring, OpenSSL, PCNTL, Session, SOAP and Standard.
Sources checked 27 October 2026
Who ships the 8.4.27 fix
On the 8.4 branch most vendors moved straight to 8.4.27. The one exception below is an AlmaLinux build that patched 8.4.24 on 21 October, before AlmaLinux rebuilt Red Hat's 8.4.27 packages.
| Source | What to install | Fixed build | Reference |
|---|---|---|---|
| php.net source | Signed tarballs in gz, bz2 and xz | 8.4.27 | php.net downloads, 21 Oct 2026 |
| php.net Windows | VS17 zips, x64 or x86, NTS for IIS and TS for Apache | 8.4.27-1 | PHP 8.4 for Windows, 26 Oct 2026 |
| Official Docker image | 8.4.27-fpm, 8.4.27-apache, 8.4.27-cli or 8.4.27-zts, each on trixie, bookworm or Alpine 3.24 and 3.23 (Alpine has no apache variant); also tagged 8.4 | 8.4.27 | Docker Hub php |
| Debian 13 (trixie) | php8.4, from the trixie-security suite | 8.4.27-1~deb13u1 | DSA-6574-1, 21 Oct 2026 |
| RHEL 10 | php8.4 packages (RHEL 10.2 and later) | 8.4.27-1.el10_2 | RHSA-2026:87071, 21 Oct 2026 |
| AlmaLinux 10 | php8.4 packages | 8.4.27-1.el10_2; AlmaLinux's own earlier build 8.4.24-1.el10_2.alma.1 also carries the fix | ALSA-2026:87071, 22 Oct 2026 |
| Rocky Linux 10 | php8.4 packages | 8.4.27-1.el10_2 | RLSA-2026:87071, 22 Oct 2026 |
| Amazon Linux 2023 | php8.4 packages; update with --releasever 2023.12.20261021 | 8.4.27-1.amzn2023.0.1 | ALAS2023-2026-3303, 22 Oct 2026 |
| packages.sury.org | php8.4-* for Debian 12 and 13 and Ubuntu 22.04, 24.04 and 26.04 | 8.4.27-1+0~20261021.57, then a per-release suffix | packages.sury.org/php |
| Ondřej Surý PPA | php8.4-* for Ubuntu 24.04 and 22.04 | 8.4.27-1+ubuntu24.04.1+deb.sury.org+1 on 24.04 | ppa:ondrej/php |
| Remi's repository | php:remi-8.4 module stream, or the php84 Software Collection | 8.4.27-1 | Remi, 22 Oct 2026 |
| cPanel EasyApache 4 | ea-php84, updated from 8.4.26 in release 25.91 | 8.4.27 | cPanel change log, 21 Oct 2026 |
| Plesk | PHP 8.4 for hosted sites, plus the panel's own engine | 8.4.27; Windows 8.4.27-1 from 27 October | Plesk Obsidian change log, 21 and 27 Oct |
| LiteSpeed repository | lsphp84 | 8.4.27-1 | rpms.litespeedtech.com |
- The AlmaLinux backport. On 21 October, before Red Hat's packages were there to rebuild, AlmaLinux backported the fix itself to every PHP stream it ships. For PHP 8.4 on AlmaLinux 10 that build is numbered 8.4.24, yet it carries the fix; the 8.4.27 build from ALSA-2026:87071 followed on 22 October and is the higher version.
- RHEL 9's php:8.4 stream. Red Hat's CVE data for both CVEs still lists it as affected, with no erratum, on 27 October 2026. Remi's php:remi-8.4 stream is a separate repository and does carry 8.4.27.
- Ubuntu. Ubuntu's own notices contain no php8.4 package. See the Ubuntu card below.
Getting 8.4.27 onto your server
Common sources of PHP 8.4
PHP 8.4 is the default on Debian 13, an optional extra on RHEL 10 and a supported official container image. Each needs a slightly different update.
Debian 13
PHP 8.4 is trixie's default, and Debian shipped the PHP project's own 8.4.27 as its security update, so the number on a patched server matches php.net. Make sure apt reads the trixie-security suite, upgrade, then restart php8.4-fpm.
Debian 13 update steps
RHEL 10, AlmaLinux 10, Rocky Linux 10
RHEL 10 has offered PHP 8.4 as separate php8.4 packages since 10.2, beside its default PHP 8.3. All three distributions fixed them under advisory number 2026:87071. AlmaLinux suggests rpm -q php8.4-common to read the installed build.
PHP 8.4 on RHEL and its rebuilds
PHP 8.4 on Ubuntu
No Ubuntu release appears in USN-8948-1 or USN-8948-2 with a php8.4 package, so PHP 8.4 on Ubuntu comes from the Ondřej Surý PPA or packages.sury.org. Ubuntu's unattended-upgrades leaves those alone unless their origin is in its allowed list.
Ubuntu with a third-party PHP
php:8.4 containers
The 8.4 and 8.4-fpm style tags point to 8.4.27, while the bare 8 and latest tags belong to PHP 8.5. Rebuild from a fresh pull and roll out new containers; restarting the old ones keeps the old PHP.
Rebuilding php:8.4 imagesHosting panels and Windows have their own routes: cPanel and WHM, Plesk and Windows with IIS; for Amazon Linux 2023's php8.4, see the Amazon Linux guide. On Windows, take the 8.4.27-1 zip: it is the 26 October rebuild with Brotli 1.2.1 against CVE-2026-111497.
Proving the update
Check that 8.4.27 is live
Upgrading the files on disk is half the job. PHP-FPM keeps its old workers until the service restarts, and Apache with mod_php keeps the old module loaded until Apache restarts.
# Debian 13: every installed PHP 8.4 package and its version
dpkg-query -W 'php8.4-*'
dpkg --compare-versions YOUR-VERSION ge 8.4.27-1~deb13u1 && echo patched
# RHEL 10, AlmaLinux 10 or Rocky Linux 10
rpm -q php8.4-common
# Containers: the PHP inside the running service
docker compose exec php php -r 'echo PHP_VERSION, PHP_EOL;'
Replace YOUR-VERSION with
the version dpkg-query printed. The service name in the Docker
example is whatever your compose file calls the PHP container. Then
read the version through the website as well, as described in
checking your PHP version;
for each platform's update steps, start at
how to update PHP.
What changes for PHP 8.4 at the end of 2026
On 31 December 2026 PHP 8.4 leaves active support. After that, php.net's policy is to release 8.4 only when a critical security issue needs it, which is how 8.3.36 looks today: a security fix with no bug fix list. There is no need to leave 8.4 for that: security support runs to 31 December 2028. Sites coming from PHP 8.2 can follow moving from PHP 8.2 to 8.4, and the other paths are in the upgrade guides.
Not able to patch yet?
The PHP project's stopgaps for 8.4 start with
session.upload_progress.enabled=0
set in php.ini or the pool file, followed by a restart of every
worker. They narrow the attack surface without closing it; see the
interim settings
and
the guide to taking a site offline.
Fixes for other branches released the same day:
8.5.12 and
8.2.35. End dates for
every branch are on
PHP end of life.
Quick answers
Questions about PHP 8.4.27
Is PHP 8.4.27 safe to run?
Against PHP2Shell, yes. Both GitHub advisories give 8.4.27 as the patched version for the 8.4 branch, and anything earlier on 8.4 is affected. Patching does not undo an intrusion that came first, so a site that served requests on 8.4.26 or older from the internet deserves a compromise check.
Does Debian 13 have PHP 8.4.27?
Yes. DSA-6574-1, issued on 21 October 2026, moved trixie's php8.4 to 8.4.27-1~deb13u1, the upstream release with Debian's packaging revision. It is delivered through Debian's security archive, so a server without trixie-security in its APT sources still sees the vulnerable 8.4.24 build.
What else changed in 8.4.27?
Alongside the PHP2Shell fix, the ChangeLog carries the branch's routine bug fixes. Notable ones for servers: an OPcache fix for PHP-FPM workers crashing with SIGSEGV (GH-23637), use-after-free fixes in DOMXPath, XSLTProcessor and ZipArchive, and a set of PDOStatement corrections.
Is there a PHP 8.4.27 package for Ubuntu?
Not from Ubuntu itself. Its current releases ship PHP 8.1 (22.04), 8.3 (24.04) or 8.5 (26.04 and 26.10), and no Ubuntu release appears in the PHP2Shell notices with php8.4. Ondřej Surý builds 8.4.27 for Ubuntu 22.04 and 24.04 in his PPA, and packages.sury.org also covers 26.04.
Does Plesk need PHP 8.4.27 even if my sites use another version?
Plesk runs part of the panel on PHP. Its change log for 21 October 2026 records plesk-engine and sw-engine moving to PHP 8.4.27 in Plesk Obsidian 18.0.81 Update 4 and 18.0.80 Update 11, separately from the PHP versions offered to hosted sites.
How long will PHP 8.4 keep getting fixes?
php.net gives 8.4 active support until 31 December 2026, then critical security fixes only until 31 December 2028. Red Hat's own schedule for PHP 8.4 on RHEL 10 runs to a retirement date of May 2029.
Know your exposure
Find every PHP server you run
Patching the server you know about is the easy part. A vulnerability scan finds the forgotten staging site, the old microsite and the appliance with PHP inside, then tells you which ones are still exposed.