Back to Changelog
PHP 8.1
v8.1.35.3
Security backport for PHP 8.1 (end of life) fixing CVE-2026-109618 and CVE-2026-109619.
Bug Fix
1- PHP 8.1 is end of life; the PHP project did not release a new 8.1 version. The binary continues to report version 8.1.34. Moving sites to PHP 8.2 or newer is recommended.
Security Fix
1- Applies the PHP security team's source backport for CVE-2026-109618 (remote code execution via out-of-memory handling) and CVE-2026-109619 (remote code execution via stale request state), taken from php-src commit 1d7dec178a09 ('Avoid state corruption via bailout'), to PHP 8.1.34.