PHP updates - October 2026 (CVE-2026-109618 and CVE-2026-109619)

Change effective on 21 October 2026

PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 fix two critical remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619 (see the PHP security advisory). Redeploy your app to pick up the fixed versions.

PHP 8.1 is end-of-life and won’t receive a new release from the PHP project, so PHP 8.1.34 on the Heroku-22 stack has been rebuilt with the PHP project’s backported fix for both vulnerabilities. This is a minimal mitigation rather than a supported release, so we strongly recommend upgrading to a supported PHP version.

The following new PHP runtime versions are now available:

The following PHP extensions have been added or updated:

The Apache HTTP web server has been updated to version 2.4.69.

The Nginx web server has been updated to version 1.30.6.

The blackfire CLI agent program used by ext-blackfire has been updated to version 2026.10.0.

The librdkafka library has been updated to version 2.16.0.