Critical Security Update: PHP 8.2.35 Now Available for Debian 12

Announcement
1

Debian 12 has released the patched PHP version addressing the recently disclosed critical vulnerabilities:

  • CVE-2026-109618
  • CVE-2026-109619

These vulnerabilities affect PHP 8.2 and may allow unauthenticated remote code execution under certain conditions.

The patched version is:

PHP 8.2.35

For additional information about these vulnerabilities, please refer to the CERT-EU security advisory:

Update Instructions

Run the following commands to update the PHP 8.2 packages currently installed on your system:

sudo apt update
dpkg -l | awk '$1 == "ii" && $2 ~ /^php8[.]2/ {print $2}' | xargs -r sudo apt install -y --only-upgrade --no-remove

This command updates only the PHP 8.2 packages that are already installed and does not remove existing packages.

Verify the Update

After the update completes, verify the installed PHP version with:

php -v

The output should report:

PHP 8.2.35

or a newer version.

Because these vulnerabilities have significant security implications, we strongly recommend applying this update as soon as possible on all affected VitalPBX systems running Debian 12.

PHP CVE-2026-109618 & CVE-2026-109619