# Critical Security Update: PHP 8.2.35 Now Available for Debian 12

**URL:** https://forums.vitalpbx.org/t/critical-security-update-php-8-2-35-now-available-for-debian-12/6482
**Category:** Announcement
**Created:** [October 21, 2026, 7:11pm UTC](https://forums.vitalpbx.org/t/critical-security-update-php-8-2-35-now-available-for-debian-12/6482 "2026-10-21T19:11:40Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![miguel](https://forums.vitalpbx.org/user_avatar/forums.vitalpbx.org/miguel/32/415_2.png) [@miguel](https://forums.vitalpbx.org/u/miguel)
#### Post date: [October 21, 2026, 7:11pm UTC](https://forums.vitalpbx.org/t/critical-security-update-php-8-2-35-now-available-for-debian-12/6482/1 "2026-10-21T19:11:40Z")

</div>

Debian 12 has released the patched PHP version addressing the recently disclosed critical vulnerabilities:

- `CVE-2026-109618`
- `CVE-2026-109619`

These vulnerabilities affect PHP 8.2 and may allow unauthenticated remote code execution under certain conditions.

The patched version is:

`PHP 8.2.35`

For additional information about these vulnerabilities, please refer to the CERT-EU security advisory:

> **[Critical Vulnerabilities in PHP](https://cert.europa.eu/publications/security-advisories/2026-018)**
>
> Critical Vulnerabilities in PHP

### Update Instructions

Run the following commands to update the PHP 8.2 packages currently installed on your system:

```bash
sudo apt update
dpkg -l | awk '$1 == "ii" && $2 ~ /^php8[.]2/ {print $2}' | xargs -r sudo apt install -y --only-upgrade --no-remove

```

This command updates only the PHP 8.2 packages that are already installed and does not remove existing packages.

### Verify the Update

After the update completes, verify the installed PHP version with:

```bash
php -v

```

The output should report:

```plaintext
PHP 8.2.35

```

or a newer version.

Because these vulnerabilities have significant security implications, we strongly recommend applying this update as soon as possible on all affected VitalPBX systems running Debian 12.