Is my site affected?
Answer first: if your PHP version is below a fixed release, or on an unsupported branch, you are affected. Verify on php.net before acting.
Some hosts and Linux distributions patch under a different version number, so the version string alone proves nothing either way.
Fixed releases (21 October 2026)
| Branch | Fixed release | Status |
|---|---|---|
| PHP 8.5 | 8.5.12 | Fixed |
| PHP 8.4 | 8.4.27 | Fixed |
| PHP 8.3 | 8.3.36 | Fixed |
| PHP 8.2 | 8.2.35 | Security-only until 31 Dec 2026 |
| PHP 8.1 | — | No updates — must migrate |
| PHP 8.0 | — | No updates — must migrate |
| PHP 7.x | — | No updates — must migrate |
| PHP 5.x | — | No updates — must migrate |
What to do next
- If you are on a fixed release, confirm with your host that the patch is applied.
- If you are below a fixed release, update PHP now.
- PHP 8.1 and older cannot be patched — migrate to 8.2 or newer.
- A WAF or config change only reduces risk; only updating PHP fixes it.
Verify on php.net before acting. See the PHP changelog and supported versions.