Is PHP 8.2.1 vulnerable?
PHP 8.2.1 was released on 5 January 2023, before the fix for CVE-2026-109618 and CVE-2026-109619 shipped in PHP 8.2.35. The upstream release itself therefore predates the patch — though a server running 8.2.1 may still have the fix applied, because CloudLinux and the Linux distributions backport security patches without changing the version number.
- Released
- 5 January 2023
- Branch
- PHP 8.2 — Still receiving security updates.
- Fix shipped in
- PHP 8.2.35 — The first 8.2 release carrying the October 2026 patch.
- Newest on this branch
- PHP 8.2.35 — 34 releases have shipped since 8.2.1.
Why this does not automatically mean your site is exposed
CloudLinux, CloudLinux, Debian, Ubuntu and Red Hat apply security fixes to older releases without changing the version number. A server can report PHP 8.2.1 and already have the patch for CVE-2026-109618 applied, because the distribution backported it. Tenable stopped relying on version numbers alone for exactly this reason.
So the version string tells you what was printed, not what was patched. The reliable answer comes from your host. On managed hosting it is usually on their status page; on cPanel it is under MultiPHP Manager.
What version is your site actually running?
Check any site below. We load the homepage once and read what it reports — no signup. Most servers hide their PHP version, which is the right thing for them to do, so if nothing comes back the page explains where to look instead.
No signup. We load your homepage once — the same single request any visitor makes — and report what it tells us. Nothing else on your site is touched.
Other PHP 8.2 releases
Common questions
Is PHP 8.2.1 affected by CVE-2026-109618?
PHP 8.2.1 was released on 5 January 2023, before the fix for CVE-2026-109618 and CVE-2026-109619 shipped in PHP 8.2.35. The upstream release itself therefore predates the patch — though a server running 8.2.1 may still have the fix applied, because CloudLinux and the Linux distributions backport security patches without changing the version number.
What PHP version should I upgrade 8.2.1 to?
The newest release on the 8.2 branch is PHP 8.2.35, which is the smallest change from 8.2.1 and keeps you on a supported branch. Moving to a newer branch entirely gives you longer support, but is more likely to need plugin or code changes, so test it first.
How do I check which PHP version my site runs?
In WordPress, go to Tools → Site Health → Info → Server; the PHP version is the first line, and you need no cPanel, FTP or SSH access. You can also paste your address into the checker on this page, though most servers hide their version — in a sample of twenty WordPress sites, only one published it.
My server reports PHP 8.2.1. Does that mean I am definitely vulnerable?
No. CloudLinux, Debian, Ubuntu and Red Hat all backport security fixes into older releases without changing the version number, so a server reporting 8.2.1 may already have the patch applied. The version string records what was printed, not what was patched. Ask your host, or check your control panel, for the definitive answer.
Release dates from php.net’s release index. Advisory details from the PHP project’s own security advisories GHSA-w8hw-w9fx-j79w and GHSA-6wmf-4rv5-p3rp, both CVSS 9.2, published 2026-10-21.