PHP 8.2.35
- ID
- 37951
- Status
- summarized
- Published
- 21 Oct 2026, 9:45 PM
- Fetched
- 22 Oct 2026, 5:17 AM
- Provider
- Hacker News
- Category
- dev-community
- Original URL
- https://github.com/php/php-src/releases/tag/php-8.2.35
- Source URL
- https://hnrss.org/best
Summary
- Score
- 8.0
- Created
- 22 Oct 2026, 5:18 AM
- Tags
- Audience
- developersvibe_coderssaas_founders
What happened
PHP 8.2.35 was released on 21 Oct 2026 as a security release fixing two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which can allow unauthenticated remote code execution. The release says there are no complete mitigations and that updating is the only safe choice. PHP 8.2 reaches end of life on 31 December 2026 and will receive no further security fixes after that date.
Why it matters
If any service, WordPress site, container, or legacy Laravel app still runs PHP 8.2, treat it as exposed to unauthenticated RCE and patch to 8.2.35 now; there is no complete mitigation. Also set a concrete deadline to move off PHP 8.2 before 31 Dec 2026, because after that date it gets no further security fixes.
Discussion angle
Which of your projects or client sites still pin PHP 8.2, and how do you verify the patch actually landed on shared hosting and containers rather than assuming the host updated it?