# PHP 8.5.12 Released

- Thread: https://externals.io/message/132891
- Original archive: https://news-web.php.net/php.internals/132891
- Started by Daniel Scherzer on 2026-10-21T14:03:59+00:00
- Messages: 1
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · RFCs at https://externals.io/rfc.md · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #132891 — Daniel Scherzer — 2026-10-21T14:03:59+00:00

URL: https://externals.io/message/132891#132891

The PHP development team announces the immediate availability of PHP 8.5.12.
This is a security release.

This is a security release fixing two critical vulnerabilities
(CVE-2026-109618,
CVE-2026-109619) that can allow unauthenticated remote code execution.

All PHP 8.5 users are encouraged to upgrade to this version.

There are no complete mitigations, updating is the only safe choice.

See the security advisory for details:
https://www.php.net/archive/2026.php#2026-10-21-5

For source downloads of PHP 8.5.12 please visit our downloads page.
Windows binaries can be found on the same page.
The list of changes is recorded in the ChangeLog.

Release Announcement: <https://php.net/releases/8_5_12.php>
Downloads:            <https://php.net/downloads>
Windows downloads:    <
https://www.php.net/downloads.php?os=windows&version=8.5>
Changelog:            <https://php.net/ChangeLog-8.php#8.5.12>
Release Manifest:     <
https://gist.github.com/DanielEScherzer/9fce78e81e004f0398e249e1fe0df5b8>

Many thanks to all the contributors and supporters!

Regards,
Daniel Scherzer, Volker Dusch, and Pierrick Charron


php-8.5.12.tar.bz2
SHA256 hash:
ffb60edc437ced63b5137e4984db379a8111c50049c711510d8b958277efc1a8
PGP signature:
-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEE2VwDvHAr6VFTRK4zdORLyQZ3AaUFAmrWUKQACgkQdORLyQZ3
AaU1QRAAj951A3VHXxL+rfVce64T0cCI6bde+BqSWmxMifKN29UkVDOrzxkzNYZK
993NLsmMPMN00FlJsXXlZ8RuOBgTzv8HHnKTjJdxtbXDlaHWiYNZT5hIY9/JpLe8
1pHztBB4GwGxtYqFleg2w0ya52To191dTxqkbE9xMyNGxY6b14K1f+CyWkYlbxjD
c/mnsCJ26zzVWfU1ZhEIGjC5ykXQcIZRwMbwdywnvQo63DzxqT5gFwKq2Lkdy0oM
/RCXWYBQdXsLbkanC2jzAceubm1Rk1MQHMtbvEkY/IwkGR73ky4q/Yig99K3grID
sVYXUVhqxMnPFWMManQPC+aKE9rrtgJkY84rDLFYWTmi7qW81lYBOLWizH5oFhBY
fSomfaNNqGuddn9Swrqn07R+gA1JAdiSWq1ViIrE5TN2J6ytey0n4mepThdNq4oZ
FN+jmH/MkftDWMgDrt0iSq/Kk4nAcjsBc28YIku29J45J9zE9HkejoEBaTzDXUdC
Y5IIjlF8NEzPZJhppM4WmvP1HzcocmtMjzjyBY82Z+sw+oUzh+6thCU4MYIV89YF
gQvVhM77r/3MxsA3JNPgF9B6e/vK9JEptlAl9gzLDwJCW+VCWg4wWgTFvW4Eah32
kMwu8qYX/8hrPv4JKvqeADfGWUJvLKGQV9REeA6jBSy9yD+ZvC4=
=gNxr
-----END PGP SIGNATURE-----


php-8.5.12.tar.gz
SHA256 hash:
81a0f450349e84b08eb43faa85f8a4c835684f3cc1c50471775d1317a046c525
PGP signature:
-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEE2VwDvHAr6VFTRK4zdORLyQZ3AaUFAmrWUKgACgkQdORLyQZ3
AaVyQg//SiL5miUAcCERQkmIpKyk9ZNvTX1NYhs5YEF+eNpUoUAEHUBdmbAqJ17G
P6Z8cMurmQqGVX2dc4YSuHqjmFiBzEQpAOqzVg9AJaKFm4L9mQyI3uB/+p+T5Eu7
2biVKD1U4EcJ0AWwsCLB1wOH3zY4FS+flovZLiM8o+VEnJnoM+X8THbF6NuWyjQk
5v8/5xrPFHMycae63gbq+e9P7OKuaMdOXmkdTGzl20sn14M2rmQoqnExBkMb81fV
lC7AT9X4X7ATOCkzBNAuY4MGSqJmnPQrh8SSSuEmNqltqCIw56u1lvf7x1QXPQiJ
GPHkzfiFf9+03QO95jos1RDPnNNaKJsGc/GR/5KHKzSEbA9nDTPfTBIffQOAiNu5
Ii3Otv4Q0cU7d7lHf0oJ9U/gdU/Ixv6Y8gYs2gEABu4T1v1kumObMSaT4wxSNeJh
UQqOX//JCz+x9cAaZSie1qTUObmKDbP4HnOwauY6fVfdYXcVTLB5KekhCrbEULT8
/A2NhOZiQHAigwE6EfI1L9Qwta5/YFLkI9xbY9fLi31HnCUNc70X36FzokVTYQeb
ju9d9VgpFhe57MTjOXiJExAcWbSFsM7smDYibWQak4pGT/kXCQ8iJT686aovHso+
rbhTDnde55bxv7ieZcnr42AjwlCIQ2lFexmWUan1CHyE2sczjvg=
=bZwM
-----END PGP SIGNATURE-----


php-8.5.12.tar.xz
SHA256 hash:
08bc2eba2a588654ade1357174aa646b761556c862dda0678345ee29ed481209
PGP signature:
-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEE2VwDvHAr6VFTRK4zdORLyQZ3AaUFAmrWUKgACgkQdORLyQZ3
AaWt8BAAkiRCqB8qc8OoXos8YBES/67MKcpKh5es0geSOG8TuuxkkNG7rZfpAAU7
G32U30SCFYCpUZT5C6OQWV0EHdqDxvgRdpv5v3C/nxQSw320DyYIbJPWByxtq1WE
V/KO4/PtGLPNIC1Tqgh3stxh1sOYtAPY+A07xd59l8rYpw0/hRWcpufrmrmx46te
TrH3ZNEXkBZPWmaS2gcUkB3hDgol5gB+0vtAedOef3uQcWnmxTOawrIaAoTNtGIU
3tQQHtrzcPSimV9LBlScL1T8KZFJKb4ZMvYOF7WJbmbPgWbbnqqb/wznJb7/KNRh
HmAuhDe2cPuJuN2J11NAZ1bw+/6AvTok8Vt0jyEPRaTVcUW7NG0PZgLsYf2hPXbG
YETMwl39IDM7CN+YPUpYOgdXDlrjwu3ZB7A563y7L23kGidlO6oPU4u+Lp2zCZ1S
vPWxDuR3KkWKTjwAJiwfAJEAmPvXl2lSrMkqldP9soiGSH7BFHPcBnB12lJTtTXy
VcJwe9plmG8K3LFYYnLAZjVGfl+xqH2RRRxkmt8sUaKNQSxquXnTOfF4CpZSs4E4
dV/juvxwUla4ahqR29UvlhmuR/fI4wgoifmCIJQxMmakBCnBGxcRaZReBwugDZRh
7v5UfTk06YqT4kFcAsqz40EeJqvRyLT8LqkaaEOBlP8T1VSxuZU=
=EFmu
-----END PGP SIGNATURE