# PHP 8.4.27 Released

- Thread: https://externals.io/message/132893
- Original archive: https://news-web.php.net/php.internals/132893
- Started by Calvin Buckley on 2026-10-21T14:32:43+00:00
- Messages: 1
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · RFCs at https://externals.io/rfc.md · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #132893 — Calvin Buckley — 2026-10-21T14:32:43+00:00

URL: https://externals.io/message/132893#132893

The PHP development team announces the immediate availability of PHP 8.4.27.

This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619)
that can allow unauthenticated remote code execution.

All PHP 8.4 users are advised to upgrade to this version.

There are no complete mitigations, updating is the only safe choice.

See the security advisory for details:
https://www.php.net/archive/2026.php#2026-10-21-5

For source downloads of PHP 8.4.27 please visit our downloads page.
Windows binaries can be found on the PHP for Windows site.
The list of changes is recorded in the ChangeLog.

Release Announcement: <https://php.net/releases/8_4_27.php>
Downloads:            <https://php.net/downloads>
Windows downloads:    <https://www.php.net/downloads.php?os=windows&version=8.4>
Changelog:            <https://php.net/ChangeLog-8.php#8.4.27>
Release Manifest:     <https://gist.github.com/NattyNarwhal/fba184b51d4397c46a082e71f10ee295>

Many thanks to all the contributors and supporters!

Regards,
Calvin Buckley, Saki Takamachi, and Eric Mann


php-8.4.27.tar.bz2
SHA256 hash: b2530a877c722f4b08c9e174a30cb08bac2b7e1903ee6e9e315f0aa9f5f82c24
PGP signature:
-----BEGIN PGP SIGNATURE-----

iJEEABYKADkWIQSdf5mgy48FyKaVjWJWqXr3YAo5pgUCatYuXRsUgAAAAAAEAA5t
YW51MiwyLjUrMS4xMiwwLDMACgkQVql692AKOaZJ+QD+N5jC7Og89QDafkw23xHB
7YML1Ad26UiFzG1wcMENZRIA/066M0vjg+Q1x2HQi4f+07YtqhCIN4IZqiDQEzUz
xAcE
=MAOU
-----END PGP SIGNATURE-----


php-8.4.27.tar.gz
SHA256 hash: 5bafed9994c1a49796b25b5f61c22c9183bfe046b6acc7b363842d03c77f972f
PGP signature:
-----BEGIN PGP SIGNATURE-----

iJEEABYKADkWIQSdf5mgy48FyKaVjWJWqXr3YAo5pgUCatYuXRsUgAAAAAAEAA5t
YW51MiwyLjUrMS4xMiwwLDMACgkQVql692AKOaY3qAEAgkdyhOWhQhtETdt3JYNZ
ikZrPY9u29jZaMmjoPj8ubEA/24terMZUo3PRBzmb7phybo6A0IK7Fu3GzqZNKsR
ub0H
=lyID
-----END PGP SIGNATURE-----


php-8.4.27.tar.xz
SHA256 hash: dcf93923b0e38e0d5252b25b796520b5a47761a08b3488b6d0b5d1115764d3f0
PGP signature:
-----BEGIN PGP SIGNATURE-----

iJEEABYKADkWIQSdf5mgy48FyKaVjWJWqXr3YAo5pgUCatYuXRsUgAAAAAAEAA5t
YW51MiwyLjUrMS4xMiwwLDMACgkQVql692AKOaZf7gEA7j/NMWQy9TbvQ4IhAajS
gOO1tgMmpSTh3sPTOQQWfIkA/R363Ndrs3VJxYGx1pSZcstwfCwYXWbhUNGUsu6Z
PjEJ
=uvS8
-----END PGP SIGNATURE