Is my PHP version patched?

Type the PHP version number you see on your server. This page compares that number with the PHP security releases of 21 October 2026 and the end-of-life dates. It does not look at any website. It runs in your browser and sends nothing.

Example: 8.3.31. Find it with php -v or in your hosting panel.

Data used

Data as of . Fixed releases for .

Supported PHP branches
BranchFixed inEnd of life

PHP 8.1 and older: no official fixed release. Sources: php.net releases, endoflife.date/php, OSV record.

What this page does not do

It only compares the number you type. Linux distribution packages (Ubuntu, Debian, Red Hat and others) can include a security fix without changing the version number, so a lower number does not always mean the fix is missing: check your distribution's security notice. After an update, the running PHP process (PHP-FPM, Apache) has to be restarted before it uses the new version. This is not security advice.

Which PHP versions fix CVE-2026-109618 and CVE-2026-109619?

PHP published security releases on 21 October 2026: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older received no official fixed release. Source: the php.net release feed and the OSV database, read on 22 October 2026.

Fixed versions and end of life (endoflife.date, 22 Oct 2026)
BranchFixed inSupport ends
8.58.5.122029-12-31
8.48.4.272028-12-31
8.38.3.362027-12-31
8.28.2.352026-12-31
8.1 and olderno official fix8.1 ended 2025-12-31

When does PHP 8.2 reach end of life?

31 December 2026, according to endoflife.date and php.net.

Does the version number tell the whole story?

Not always. Linux distribution packages (Debian, Ubuntu, RHEL and others) can include a fix without changing the version number, and the command-line php -v can differ from the PHP that serves your site (PHP-FPM must be restarted after an update). Check your distribution's security notice and your host's advice. This page is not security or legal advice.

Also see: Is my runtime still supported? (Python, Node.js, .NET, PostgreSQL, MySQL, WordPress)

Managing several client sites? The PHP Patch and End-of-Life Kit ($19) (or both together for $29) is a site list that flags unpatched versions, with three client emails and a host checklist. This page is free and makes no network calls; it only compares the number you type.