1. Identify the actual Web runtime
Record the PHP branch, complete package revision, installation source, loaded extensions, service name and site handler. The CLI and Web server may run different binaries. In multi-PHP panels, inspect each site’s assigned handler. Inventory every FPM pool, Apache instance, image, queue worker and deployment replica. Keep a backup and a tested rollback plan before changing production.
2. Install a patched build
The first fixed releases are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Choose your existing supported branch or a compatible newer supported branch. Update all matching extensions with the runtime. Test application compatibility and health checks. Fetch releases or packages from PHP or the responsible vendor; an unchanged CMS or a WAF rule is not a runtime patch.
| PHP branch | Upstream releases below | First patched release | Security support ends |
|---|---|---|---|
| PHP 8.5 | < 8.5.12 | ✓ 8.5.12 | Dec 31, 2029 |
| PHP 8.4 | < 8.4.27 | ✓ 8.4.27 | Dec 31, 2028 |
| PHP 8.3 | < 8.3.36 | ✓ 8.3.36 | Dec 31, 2027 |
| PHP 8.2 | < 8.2.35 | ✓ 8.2.35 | Dec 31, 2026 |
No normal PHP project release is available for these branches. Minimal source backports exist for 7.4, 8.0 and 8.1; vendor support must be verified separately. Read guide ↗
Distribution versions and backports
Ubuntu, Debian and enterprise Linux vendors often retain an older upstream number while adding security patches to a package revision. A banner such as 8.3.6 does not prove that a machine is vulnerable or fixed. Match the OS release, repository, architecture and installed revision to the vendor’s status for BOTH CVEs. This site deliberately does not invent package cutoffs.
3. Restart and verify every instance
Installing a new binary leaves old worker processes in memory until they exit. Restart Apache for mod_php or the corresponding PHP-FPM services and pools. Restart queue workers and scheduled long-running processes too. Verify service start times, Web runtime version, package revision, health checks and every load-balanced replica. Delete any temporary diagnostic page immediately; do not leave phpinfo() publicly accessible.
Command example / INVENTORY
php -v
php --ini
# Check the executable used by the Web service separately.
php-fpm -v
# On versioned installations, for example:
php-fpm8.3 -vRepair guide
Ubuntu & Debian
Identify the installed php*-common package and the Web handler’s package, then consult the Ubuntu or Debian security tracker for both CVEs.
Read guideRHEL, Rocky, AlmaLinux & related systems
Identify whether the runtime is provided by the OS, an application stream or a third-party repository.
Read guideDocker & container images
A restart of the same container does not install a PHP patch.
Read guideBaoTa & 1Panel
Panel PHP installations can be independent of system PHP.
Read guideWordPress, shared hosting & managed services
Updating WordPress, Drupal or Joomla does not update the PHP interpreter.
Read guide