Patched setup-php builds cover PHP 5.3 through 8.7
Updated setup-php builds now include fixes for CVE-2026-109618 and CVE-2026-109619 across PHP 5.3 through 8.7.
The builds target Linux, macOS and Windows, and include security backports for end-of-life PHP branches used in continuous integration. The project's October 2026 notice points to separate macOS and Windows packages for local installations.
The setup-php GitHub Action provides updated builds addressing CVE-2026-109618 and CVE-2026-109619. They cover PHP 5.3 through PHP 8.7 on Linux, macOS and Windows, including security backports for end-of-life PHP versions used in CI. Details are available at https://setup-php.com/php-october-2026-security-releases.
For local installations, macOS users can use https://github.com/shivammathur/homebrew-php. Official Windows packages cover PHP 8.2 through PHP 8.5 at https://www.php.net/downloads.php?os=windows. Additional Windows builds for PHP 5.3 through PHP 8.7 are published at https://github.com/shivammathur/php-builder-windows/releases. Security-backported patches for do-it-yourself builds of end-of-life versions are available at https://github.com/shivammathur/php-src-backports.
Readers’ Forum
No contributions yet — open the debate.
Open the discussion
No account or password needed — just enter your e-mail and we’ll send you a one-time sign-in link. First time here? You’re set up automatically.
Your rating will be applied automatically after you sign in.
Check your inbox
We’ve sent a sign-in link to …. Open it on this device — this tab will sign you in automatically.
Nothing arrived? Check your spam folder — and mark the mail as "Not spam" so it lands in your inbox next time.