# PHP 8.3.36 Released

- Thread: https://externals.io/message/132890
- Original archive: https://news-web.php.net/php.internals/132890
- Started by ericmann@php.net on 2026-10-21T14:01:22+00:00
- Messages: 1
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · RFCs at https://externals.io/rfc.md · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #132890 — ericmann@php.net — 2026-10-21T14:01:22+00:00

URL: https://externals.io/message/132890#132890

The PHP development team announces the immediate availability of PHP 8.3.36.

This is a security release fixing two critical vulnerabilities 
(CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote 
code execution.

All PHP 8.3 users are encouraged to upgrade to this version.

There are no complete mitigations, updating is the only safe choice.

See the security advisory for details:
https://www.php.net/archive/2026.php#2026-10-21-5

For source downloads of PHP 8.3.36 please visit our downloads page.
Windows binaries can be found on the PHP for Windows site.
The list of changes is recorded in the ChangeLog.

Release Announcement: <https://php.net/releases/8_3_36.php>
Downloads:            <https://php.net/downloads>
Windows downloads: 
<https://www.php.net/downloads.php?os=windows&version=8.3>
Changelog: <https://php.net/ChangeLog-8.php#8.3.36>
Release Manifest: 
  <https://gist.github.com/ericmann/bd87f4e5a8b6d0a0a9f7bda353cc4283>

Many thanks to all the contributors and supporters!


Eric Mann, Jakub Zelenka, and Pierrick Charron


php-8.3.36.tar.bz2
SHA256 hash: 
46f4b45e3688ed2b1819015a7b532c15b51cc055bdd3b13fd00ddfeebeedcd5f
PGP signature:
-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEESx/A2d+SMhztn2FdvsVV4ioUNVMFAmrWI18ACgkQvsVV4ioU
NVP08hAAkPHoBkbZZrd++fuyrS/8mz3qBrGBqxvfvWQIAK8M1T/5iRzSvzQuUWy1
6QYEnTedJLyFnM4f0mMrtDMswj7BkWz8SgJ8Akyh4GX+OVeg3Q8FNvhb09nqTrLg
/Soy6z7AcKcnrofFpJhuLcoTBxp7UamJQQgA7zOICjjH2CDOxxEFcek/DklvCW1R
9gIlMYCk3VXNmAqHU7STvPLnrBzX/xKkqFXnqaLjWMBzgL9n0r0lHyPq+2JDHMho
UyFCcmz9/c3gwx8/OZvnA97+w/ZQf5FjnB4z2DWuVb+TJiAzKBpjniqullnrH5LA
B8UPu5vrxUECkHNMni+Tou6Y9i2t0SF2jBYaTF/c9fXBRyp+ymiLciEQMgHAhRIZ
gAcI3KbJe/z6tUGiOs2Wxoeot8FS5U0o5OwNE6iurDg+iC3PpwmOyorz3psNdlpd
nRBVGL+b32KNg/co7nT/GU6LOMetDR5uWf2+f0C4tlmHnQXT9uyQZWljY9xkKUjK
Uqph8grS/H3m2YiGH7hRTro8Qj8CfX/MZAky/l2fU3O8wPa/1WIkEBSBLYpjlrDB
17gzXQxFBdjEhQx4E7kpyj03Va7hc9at9nAG4Kjc7W8e92uiOn2RgjluuNuWnp2m
oqjdQSKzItn0b5pp+1BfwUTbkCpiz/JwpQZKuJPbse88p2/C/G0=
=JPY/
-----END PGP SIGNATURE-----


php-8.3.36.tar.gz
SHA256 hash: 
c93f3441f87f6ab156bef4432db215d7e61ca2c0183bb3a2aa28d9886ab59f53
PGP signature:
-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEESx/A2d+SMhztn2FdvsVV4ioUNVMFAmrWI18ACgkQvsVV4ioU
NVM5Uw/8CWc6ccvc2gwPb9Yq6fUlIZyeLZq1KZC3VE9dRphu0FEk+/hch7wMeBp5
GAHnYHcLyVEIfINywiArU4mkIhWtHPMowZKpzjx44hxzvsEmT+dcn99xcahIKER2
ehBbn0nw65Ki7fsi7yPqTLqqICXrdtDh6JiF2qIRFRXTq3bmQZ6gadM16ANK1gko
IYFcvHsoj/+SeoXwver++PlseJp5H9gOA4qUV+OVgrVHMCEdnhyhtM+II+s9z6fB
nv+va67QGz1S1Cxhv439vEnv/YFjAjWouZOzYO3SnoBzeWvvdod32zEQdiXz5N9v
vKpkl45rJ+4hjpxaoHdmwfMzCVK8N7FV9l0YF24OqKdakcZgzI5LtYWphGmBRYjU
e9yG7k1WyJVogb7nPay0UMXFjjyCMqMnXlK1BVuDwTh8xpPUf/s1FF0pqcUMbxog
VX9ZU3HJNAlKi2JuHHF50lhngY5e4UK3Dp0+hX2clSWETo/hZHueYUj3zTz9ZnO9
XIYue3O4qfpLM6+P7LFXTB9Ht9wro4DxCLnAmIjUvRP8Uyq9r4PK6KtnSG3i4MrR
S3WjkuIY8fo0pRHmm95ZReakgseAnZDjDRonjUp1kmv/xrT4X+l9m5C/wd2TfvTH
wTI4x1l7fPNtaaQ6Qe3Z+GZQd95VafmbtnXA7/qNjrvlRwvc6OU=
=LlH8
-----END PGP SIGNATURE-----


php-8.3.36.tar.xz
SHA256 hash: 
dd54693aa334c5c4d72e9aee96b082c2473750a18a6c1d105789c93a3b1692fd
PGP signature:
-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEESx/A2d+SMhztn2FdvsVV4ioUNVMFAmrWI18ACgkQvsVV4ioU
NVNs+RAAj/QMSy3YSQwr+rkUD0qaMvO0fZET3dBNxEtdMCM1iQSWzBJi9Llty7De
OfaCXOK/NZpO3CICJifir0XY9eU6uHWl7wpo8YQHXcQ5EirDX3jeNEHMoPnx3jsX
NX7j4fpcj3hfLuZLW1vyKhVmXCenrhJDPS+buta5g79OXpGUrJ0hy2IFKmt049BO
sxDOjQZANd46RApf8GapEvpDClkTTSnnEh8v0S9ripShe4oECTzW+bDKEtsZVImv
xpZJqC0sJ7Y9i4M7dVqfNjohEfj+Mh0NvfR8l4PHHko5RVz7A3EueThM8WZ4i2qr
iwKIOSBhdzcgfEGwKKGzO4yjcf3pCvcANh8Oa6En3fSXwoJgMZJhTczCh7cFJIQS
e58b8dMmSAsQLcgB1LQr7hulHOQLt4lDzO/iR4rT3C3bBaZsZfjfyZxNMFxUFgSm
ZUrXgGGbDqtAtoif80OzXLMT+S8G3dks/nRnn+hVy0QDxjawIGAIutZVAVSA9Ixp
UsxS1N6v7/WWUHuuKBQEYib7N+QXPIgJrr5vF3D7s7bF3RN2jIDlIvKVvp/Bz2xr
x7rKFtIN3XsLOkS9qlL4XcZN8gMZkLh04VJ7gmEO5L/mOkk+PJidMjbCimASERjJ
/FjxHzlKkku17fn7E1T6LPmrIN1MvA0B66iJhXWgIoMp7h+bTqM=
=FtbT
-----END PGP SIGNATURE