PHP 8.5 branch, released 21 October 2026
PHP 8.5.12: the PHP2Shell security release for PHP 8.5
PHP 8.5.12 is the release that closes PHP2Shell on the PHP 8.5 branch. The PHP project published it on 21 October 2026 to fix CVE-2026-109618 and CVE-2026-109619, two critical flaws that can let an unauthenticated attacker run code on a web server. Any 8.5 build older than 8.5.12 is vulnerable unless your vendor has backported the fix.
Last reviewed against php.net, Ubuntu, the official Docker image and the cPanel and Plesk change logs.
The 8.5.12 release
What PHP 8.5.12 contains
php.net announced 8.5.12 as a security release, published alongside 8.4.27, 8.3.36 and 8.2.35. php.net's downloads page lists it as the Current Stable release.
| Released | 21 October 2026 |
|---|---|
| Security fixes | CVE-2026-109618 (GHSA-w8hw-w9fx-j79w) and CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp), both rated Critical by the PHP project at CVSS v4.0 9.2 |
| Other changes | A full set of routine bug fixes from the branch's regular release cycle, summarised below |
| Previous 8.5 release | 8.5.11, published 24 September 2026 |
| Windows package | 8.5.12-1, rebuilt on 26 October 2026 with Brotli 1.2.1 |
| Branch status | Active support until 31 December 2027, then security fixes only until 31 December 2029 |
php.net's ChangeLog dates the 8.5.12 entry 22 October 2026. Everything else the PHP project published about it, from the news post to the dated source tarballs and both GitHub advisories, says 21 October, the day the release was scheduled for 14:00 UTC. This site uses 21 October.
The PHP2Shell fix
A single Core entry carries both advisory identifiers, under the
title "Avoid state corruption via bailout". Both flaws begin when
PHP abandons a request part way through, after running out of
memory or hitting a fatal error, and leaves internal state that
later code trusts. PHP 8.5 adds a path of its own: the
fatal_error_backtraces
feature, new in this branch, is one of the two routes the PHP
project confirmed for CVE-2026-109619.
Everything else in the 8.5.12 ChangeLog
- Engine, OPcache and JIT. Tracing JIT cases that produced wrong results or invalid IR, optimizer folds that changed meaning, and a use-after-free with frameless functions from dl()-loaded extensions.
- Databases. A run of PDOStatement repairs (out-of-bounds column metadata, stale results after a failed execute, leaked driver options), plus mysqlnd, PDO_DBLIB and PDO_Firebird fixes.
- One removal. pg_service() has been taken out of the pgsql extension, since no released libpq provides it. Search your code for it before you deploy.
- Documents, text and URLs. Dom\HTMLDocument and DOMXPath fixes, grapheme and IntlDateFormatter corrections, and patches to the bundled Lexbor library, several of them in URL handling.
- Smaller areas. The CLI built-in server, BCMath, BZ2, FFI, FTP, GD, mbstring, OpenSSL, PCNTL, Session, SOAP, SQLite3, Standard, Tidy and Zlib.
Checked 27 October 2026
Where to get PHP 8.5.12
Install from the source your server already uses. A row marked backport is a vendor build that carries the 8.5.12 fix under a lower 8.5 number.
| Source | Package or tag | Version with the fix | Reference |
|---|---|---|---|
| php.net source | php-8.5.12.tar.gz, .tar.bz2 or .tar.xz, each with a signature | 8.5.12 | php.net downloads, 21 Oct 2026 |
| php.net Windows | VS17 builds, x64 and x86, Thread Safe and Non Thread Safe | 8.5.12-1 | Windows downloads, 26 Oct 2026 |
| Official Docker image | 8.5.12 with -cli, -apache, -fpm or -zts, on trixie, bookworm, alpine3.24 or alpine3.23 (no apache on Alpine); 8.5, 8 and latest are aliases | 8.5.12 | Docker Hub php |
| Ubuntu 26.10 | php8.5 source package | 8.5.9-0ubuntu2.1 (backport) | USN-8948-1, 21 Oct 2026 |
| Ubuntu 26.04 LTS | php8.5 source package | 8.5.4-0ubuntu1.5 (backport) | USN-8948-1, 21 Oct 2026 |
| Amazon Linux 2023 | php8.5, from repository release 2023.12.20261021 (dnf needs --releasever) | 8.5.12-1.amzn2023.0.1 | ALAS2023-2026-3304, 22 Oct 2026 |
| packages.sury.org | php8.5-* for Debian 12 and 13, Ubuntu 22.04, 24.04 and 26.04 | 8.5.12-1+0~20261021.27, plus a suffix per release | packages.sury.org/php |
| Ondřej Surý PPA | php8.5-* for Ubuntu 22.04 and 24.04 | 8.5.12-1+ubuntu24.04.1+deb.sury.org+1 (24.04) | ppa:ondrej/php |
| Remi's repository | php:remi-8.5 module or the php85 collection, Enterprise Linux 8 to 10 and Fedora | 8.5.12-1 | Remi, 22 Oct 2026 |
| cPanel EasyApache 4 | ea-php85, moved from 8.5.11 in release 25.91 | 8.5.12 | EasyApache 4 change log, 21 Oct 2026 |
| Plesk | PHP 8.5 component; Windows servers moved to the rebuilt package on 27 October | 8.5.12 (Linux), 8.5.12-1 (Windows) | Plesk change log, 21 and 27 Oct 2026 |
| LiteSpeed repository | lsphp85 (apt and Enterprise Linux 9 builds) | 8.5.12-1 | rpms.litespeedtech.com |
- Why Ubuntu's numbers are lower. Canonical kept 26.04 on the 8.5.4 it released with and 26.10 on 8.5.9, and added the fix to each. Judge those servers by the package revision in USN-8948-1, not by the 8.5 number.
- Debian. Debian's security tracker lists no php8.5 package for either CVE, since Debian 12 and 13 default to PHP 8.2 and 8.4. For Debian 12 and 13, packages.sury.org carries 8.5.12.
- Red Hat and its rebuilds. Red Hat's CVE data lists no PHP 8.5 package for RHEL 8, 9 or 10. The only Red Hat 8.5.12 build it names is for its Hardened Images product (RHSA-2026:87414). Remi's repository carries 8.5.12 for Enterprise Linux 8, 9 and 10.
Your route to 8.5.12
Four ways PHP 8.5 reaches a server
A recent Ubuntu release, a container image, a hosting panel or a Windows zip: pick the one that matches your server, or see the Debian and RHEL notes below the cards.
Ubuntu 26.04 or 26.10
PHP 8.5 is what Ubuntu 26.04's php metapackage installs, and 26.10 carries it too. Canonical patched both in place, so a fixed 26.04 package still starts 8.5.4. Take the security update with apt, then restart php8.5-fpm or Apache.
Ubuntu steps for PHP 8.5
Containers built on php:8.5
The latest, 8 and 8.5 tags all resolved to 8.5.12 on 27 October, but a running container keeps the PHP it was built with. Pull, rebuild and replace it. The apache variants load mod_php, the setup the PHP project rates most at risk.
Rebuilding php:8.5 images
cPanel and Plesk servers
cPanel shipped ea-php85 8.5.12 in EasyApache 4 release 25.91 and Plesk listed 8.5.12 the same day. Both arrive through the panel's package updates, which the server administrator controls; a site owner on shared hosting cannot install them.
Update PHP in cPanel
Windows and IIS
Use the 8.5.12-1 Non Thread Safe build for IIS with FastCGI. It replaced the original 8.5.12 zips on 26 October with a Brotli library that closes CVE-2026-111497, so fetch it again if you downloaded earlier.
Update PHP on Windows and IISRunning 8.5 on Debian through packages.sury.org? See updating PHP on Debian. On RHEL, AlmaLinux or Rocky Linux with Remi's builds, see updating PHP on the RHEL family. Plesk users have their own steps in the Plesk guide, and Amazon Linux 2023's locked repository versions are explained in PHP on Amazon Linux 2023.
After installing
Confirm 8.5.12 is serving your sites
Restart PHP-FPM, or Apache if it loads PHP as a module, before you check: workers started before the update still run the old code.
# The version the PHP command line reports
php -v
# Debian or Ubuntu packages: the exact installed builds
dpkg-query -W php8.5-fpm php8.5-cli
# The interim setting that only exists on 8.5, as the CLI sees it
php -r 'var_dump(ini_get("fatal_error_backtraces"));'From php.net, Docker, Remi or Ondřej Surý's builds, look for 8.5.12 or later. On Ubuntu's own packages, compare the full version with the table above instead. The command line can run a different build from the web server, so finish with a check through the site itself: how to check your PHP version. The step-by-step guides start at how to update PHP.
If 8.5.12 cannot go on today
PHP 8.5 has an interim step no other branch has. Set
fatal_error_backtraces=0 in
php.ini or the FPM pool, not with ini_set(),
and restart every worker. It shuts the fatal backtrace path and no
other, so pair it with session.upload_progress.enabled=0
and the rest of the
interim settings.
None of them is a fix. If the update is days away, work through
the offline question
before deciding to wait.
Planning beyond 8.5.12
Of the supported branches, 8.5 has the longest runway, with security support to the end of 2029, so staying put is reasonable. Sites arriving from an older branch can start at the upgrade guides, and PHP end of life dates covers every branch. The same day's fixes for other branches: PHP 8.4.27, PHP 8.3.36 and PHP 8.2.35.
Quick answers
PHP 8.5.12 questions
Is PHP 8.5.12 safe?
It is not vulnerable to PHP2Shell: the PHP project's advisories list 8.5.12 as the patched release for both CVEs on this branch. Two caveats remain. php.net's informational note of 23 October suggests keeping session.upload_progress.enabled=0 until its next regular bugfix release, and a server that ran an older build on the internet still needs checking for compromise, because CISA added both flaws to its Known Exploited Vulnerabilities catalogue on 26 October 2026.
Does Ubuntu 26.04 have PHP 8.5.12?
Not under that number. Ubuntu 26.04 LTS ships PHP 8.5.4 and patched it in place: package 8.5.4-0ubuntu1.5, published in USN-8948-1, is listed as fixed for both CVEs. If you need the upstream 8.5.12 build itself, packages.sury.org publishes it for 26.04, and Ondřej Surý's Launchpad page names it as the canonical source of PHP packages for 26.04.
What changed in PHP 8.5.12 apart from the security fix?
Quite a lot, because 8.5 is still in active support and gets regular bug fix releases. The ChangeLog covers JIT and optimizer corrections, PDO statement fixes, DOM and Intl fixes, Lexbor patches and built-in server fixes. One entry removes a function: pg_service() is gone from the pgsql extension, as no released libpq supports it.
Does php:latest on Docker Hub include 8.5.12?
Yes. On 27 October 2026 the official image's latest tag was an alias of 8.5.12-cli-trixie, and 8 and 8.5 pointed at 8.5.12 as well. A tag only changes what the next pull fetches, so images built before the release still need rebuilding.
Should I keep fatal_error_backtraces=0 after updating?
The PHP project lists fatal_error_backtraces=0 as a workaround for 8.5 servers still waiting for the update: it closes the fatal backtrace path while the patch is pending. Its advisory gives no advice on switching backtraces back on afterwards. The setting it does suggest leaving off after patching, where your sites do not use it, is session upload progress.
Should I move to PHP 8.6 instead?
Not on a production server yet. PHP 8.6.0 RC4, published on 21 October 2026, carries the same fixes, but php.net says not to use it in production. The PHP wiki's timetable targets general availability on 19 November 2026.
Know your exposure
Find every PHP server you run
Patching the server you know about is the easy part. A vulnerability scan finds the forgotten staging site, the old microsite and the appliance with PHP inside, then tells you which ones are still exposed.