Release by release
| Release | Status | Fixed package | Advisory |
|---|---|---|---|
| 8.5.12 (vs17), 8.4.27 (vs17) | Fixed packageTS and NTS, x64 and x86; e.g. php-8.5.12-nts-Win32-vs17-x64.zip. Listing time 13:47-13:49. SBOM/VEX files and sha256sum.txt present. | 8.5.12 / 8.4.27 | –2026-10-21 |
| 8.3.36 (vs16), 8.2.35 (vs16) | Fixed packageSame layout. | 8.3.36 / 8.2.35 | –2026-10-21 |
| 8.1.34, 8.0.30, 7.4.33 | No fix yetLatest 8.1 is 8.1.34 (2025-12-16), not patched; only source backport branches exist. | – | – |
Confirm the fix is installed
php -v # expect 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 or newer; verify zip hash against sha256sum.txtRestart PHP
Installing the package replaces the files on disk. PHP processes that are already running keep the old code.
iisreset # IIS/FastCGI; or: net stop Apache2.4 && net start Apache2.4 (service name may differ)If your release has no fix yet
Watch the advisory feed for your release and install the update the day it lands. Until then, the triage page lists the official temporary measures. If your release is past its end of life, read options for old versions.