Release by release
| Release | Status | Fixed package | Advisory |
|---|---|---|---|
| 8.5.12 (cli, fpm, apache, zts, alpine3.23/3.24; bookworm, trixie) | Fixed packageamd64 pushed ~16:28-16:48Z; all arches (386, arm, arm64, s390x) by ~17:31Z. | 8.5.12 | –2026-10-21 |
| 8.4.27 | Fixed packageSame variants. | 8.4.27 | –2026-10-21 |
| 8.3.36 | Fixed packageSame variants. | 8.3.36 | –2026-10-21 |
| 8.2.35 | Fixed packageSame variants; e.g. 8.2.35-fpm, 8.2.35-apache, 8.2.35-fpm-alpine. | 8.2.35 | –2026-10-21 |
| 8.4.27RC1 / 8.5.12RC1 tags | No fix yetRC tags are not the fixed release. | – | – |
| 8.1 and older | No fix yet8.1 tags last updated 2025-12-31; not patched. | – | – |
Confirm the fix is installed
docker run --rm php:8.4-fpm php -v # expect 8.4.27 or newer; no changelog to grep, docker image uses upstream sourceRestart PHP
Installing the package replaces the files on disk. PHP processes that are already running keep the old code.
docker pull php:8.4-fpm && docker build --pull -t myapp . && docker compose up -d --force-recreateIf your release has no fix yet
Watch the advisory feed for your release and install the update the day it lands. Until then, the triage page lists the official temporary measures. If your release is past its end of life, read options for old versions.