PHP 8.2.35
⚡ INAPP
If you're still running PHP 8.2, you're sitting on a ticking time bomb. Version 8.2.35 just landed, and it patches two vulnerabilities that let attackers execute code on your server without even logging in. There's no workaround, no config flag to flip, no WAF rule that fully saves you. You update, or you accept that anyone with a browser and bad intentions can run arbitrary code on your box. And here's the kicker: 8.2 hits end of life on December 31st, 2026. After that, no more security patches. Ever. This is about more than two specific CVEs. Your current version is already on borrowed time, and the clock is louder than you think. I've been covering PHP releases for years, and I rarely see a situation this cut-and-dry. Usually there's some mitigation, some "only affects X configuration" caveat. Not this time. CVE-2026-109618 and CVE-2026-109619 are unauthenticated remote code execution bugs. That means the barrier between "random person on t...