The GitHub advisories list affected upstream ranges as everything before 8.2.35, 8.3.36, 8.4.27, and 8.5.12 on those branches. A build of PHP 8.3.35 is below the fix. A build of PHP 8.3.36 is in the fixed range. The same pattern holds for the other three supported branches.
Branches the PHP project no longer updates
PHP 8.1 and older are outside current upstream security support. The supported-versions table reviewed on 22 October 2026 lists 8.2, 8.3, 8.4, and 8.5 only. PHP’s advisory says 8.1 and older will not get updates from the PHP project. Some vendors backport the fix. The upstream version string on those packages often stays at the old point release, so “8.1.34” or “7.4.33” does not tell you whether the backport is present.
PHP published minimal source backports for 7.4, 8.0, and 8.1 only. On 22 October 2026 the php-src branches PHP-7.4-CVE-2026-109618-109619, PHP-8.0-CVE-2026-109618-109619, and PHP-8.1-CVE-2026-109618-109619 were present. They are not tagged releases. PHP 5.6, 7.0, 7.1, 7.2, and 7.3 are not in that source-backport list.
Version strings that mislead
Ubuntu 24.04’s fixed php8.3 package is 8.3.6-0ubuntu0.24.04.13. The upstream number 8.3.6 is older than 8.3.36, and the Ubuntu package is still the fixed build named in Ubuntu’s notice. Debian bookworm’s fixed php8.2 security update is 8.2.35-1~deb12u1, which does move the upstream number. You have to read the tracker for the distribution you run.
PHP 8.6 was a release candidate in the October 2026 news archive. A release candidate is not one of the four production fixes.
Use the version guide for the branch you run, then the distribution guide if the package is not an upstream tarball.
Questions
Are CLI-only installs affected?
The advisory scopes the risk to PHP installations serving web requests. Confirm whether any SAPI on the host still accepts HTTP before you dismiss a CLI version.