These are the first upstream releases PHP identifies as containing both fixes:
| Branch | Fixed upstream release | Security support until |
|---|---|---|
| 8.2 | 8.2.35 | 31 December 2026 |
| 8.3 | 8.3.36 | 31 December 2027 |
| 8.4 | 8.4.27 | 31 December 2028 |
| 8.5 | 8.5.12 | 31 December 2029 |
Windows builds for those releases are published from the PHP downloads page, according to the release announcements.
Source backports, not releases
For 7.4, 8.0, and 8.1, PHP provided minimal source backports and did not tag new releases. Building those branches is a source-build task. The resulting binary may still report the previous version string. Rebuild extensions from the same tree and restart workers. Do not describe that build as PHP 7.4.34 or another number the project did not ship.
Vendor packages confirmed in this review
Ubuntu’s 21 October 2026 post lists fixed packages for 14.04 through 26.10, including ESM releases. Examples: Ubuntu 22.04 php8.1 8.1.2-1ubuntu2.28, Ubuntu 24.04 php8.3 8.3.6-0ubuntu0.24.04.13, Ubuntu 26.04 php8.5 8.5.4-0ubuntu1.5, and Ubuntu 20.04 php7.4 7.4.3-4ubuntu2.29+esm5.
Debian’s tracker, reviewed 22 October 2026, lists bookworm php8.2 fixed in 8.2.35-1deb12u1 and trixie php8.4 fixed in 8.4.27-1deb13u1. The bookworm base version 8.2.32-1~deb12u1 was still marked vulnerable, so the security repository matters.
AlmaLinux’s 21 October 2026 post lists production packages for the streams it ships on AlmaLinux 8, 9, and 10, and says rpm -q is the check because php -v may not change.
Other distributions were not given a package version in the sources opened for this page. Use their trackers on the day you patch. The vendor backport guide shows the comparison to make.
Questions
Is 8.2.35 the last 8.2 fix?
It is the PHP2Shell fix for the 8.2 branch. PHP 8.2 security support ends on 31 December 2026, so plan a later move to a newer branch.