Back to list
PHPSecurityOSS

Responding Promptly to the Critical PHP Security Release (October 21)

php.net has announced an upcoming critical PHP security release (announcement on php.net).

  • Scheduled: Wednesday, October 21, 2026, 14:00 UTC (23:00 JST)
  • What: two critical vulnerabilities, both rated CVSS v4.0 9.2
  • Affected and fixed versions will be published with the release. It may come earlier if details of either vulnerability become public or if active exploitation is found.

What K.N.Lab. will do

For our PHP open-source tools, pb-php and pb-migrate, we will respond promptly after the release.

  1. Once the fixed PHP versions are out, we will promptly run the pb-php and pb-migrate test suites on them.
  2. We will post the results as an update to this article. If either tool needs a change, we will publish a fixed version promptly.

pb-talk runs on bash, curl and jq and does not use PHP, so it is not affected.

If you use pb-php or pb-migrate

These vulnerabilities are in PHP itself. What you need to update is PHP, not the tools. We recommend getting ready to upgrade as soon as the release is available.

pb-php and pb-migrate run on PHP 8.1 or later, but PHP’s officially supported versions are currently 8.2 to 8.5, and PHP 8.1 has already reached end of life, so it is not expected to receive these fixes. PHP 8.2’s official support also ends on December 31, 2026. If you are on 8.1 or 8.2, we recommend upgrading to 8.3 or later (pb-migrate recommends 8.3+ as of v0.7.5, and the next release, 0.8, will require PHP 8.3 or newer). Note that pb-php requires PHP 8.3 or later as of v2.2.0, released on October 21 (see the update below).

For questions or problems, please use each repository’s GitHub Issues.

Update (October 22, 2026): pb-php is done

The fixed PHP versions were released on schedule at 14:00 UTC on October 21 (php.net security advisory).

  • Fixed versions: PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12
  • Vulnerabilities: CVE-2026-109618 and CVE-2026-109619. Both are in PHP’s own web request handling and can be triggered before application code runs.

For pb-php, we confirmed that the full test suite (46 tests) passes on the fixed PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. These vulnerabilities are in PHP itself, so pb-php’s code needs no changes. We also published two releases:

  • v2.1.5: a documentation-only release (no code changes). It documents PHP 8.1’s end of life and these vulnerabilities, and deprecates PHP 8.1 and 8.2.
  • v2.2.0: now requires PHP 8.3 or later. Usage is unchanged. On PHP 8.1 or 8.2, Composer automatically keeps you on v2.1.5.

If you use pb-php while serving web requests, update PHP itself to a fixed version. Updating pb-php does not fix PHP.

For pb-migrate, see the next update.

Update (October 22, 2026): pb-migrate is done

For pb-migrate, we confirmed that the full test suite (210 tests) passes on the fixed PHP 8.3.36, 8.4.27 and 8.5.12. These vulnerabilities are in PHP itself, so pb-migrate’s code needs no changes. We also published v0.8.0, as announced:

  • It now requires PHP 8.3 or later. Commands, options and behavior are unchanged.
  • It uses pb-php v2.2.0 or later.
  • On PHP 8.1 or 8.2, Composer automatically keeps you on v0.7.5. To use v0.8.0, upgrade PHP to 8.3 or later.

With this, both pb-php and pb-migrate are done for this security release. Whichever you use, update PHP itself to a fixed version (8.3.36, 8.4.27, 8.5.12 or later).