PHP 8.4.26: security release, update advised

The PHP development team announced on 24 September 2026 the immediate availability of PHP 8.4.26, a version classified by the official source as a "security release". For those running PHP 8.4 in production on their servers, here is the reason to schedule an update: a security release should be applied before the next scheduled maintenance window, not after.

What's changing

The announcement on php.net does not list individual CVEs resolved in the body text: for details of the changes, the source directs you to the official ChangeLog published on the website. Those administering shared hosting, VPS or containers with PHP 8.4 should consult that changelog before planning their rollout, to understand whether the fixes affect modules actually in use (extensions, session management, parsers, and so on).

Where to download

For PHP 8.4.26 source code, the reference page is the official downloads page on php.net. For those managing Windows machines, sources and binaries are available in the same section of the site, with dedicated builds.

What to do now

For those running hosting panels with PHP selector (cPanel EA4, Plesk, CloudLinux), the update typically arrives through the panel provider's repositories within days of the upstream release: it's worth checking your panel provider's changelog for the availability date of the 8.4.26 package.

For those compiling PHP from source or managing containerised environments with custom PHP images, the update must be done manually by downloading the tarball from the official page and recompiling, or by updating the base image tag.

Since no accelerated End of Life date is indicated in the source for 8.4, the standard advice for security releases remains: apply the update at your next maintenance window, verifying first in staging the compatibility with loaded extensions.

Source: PHP – releases, php.net, 24 September 2026.