Critical PHP security release

Super useful info, thank you for relaying it!

Edit: Seems legit. Went through 8.2/3/4 not seeing patched versions, going to 8.5 got the patched version right away.

I’m seeing 8.3.35 instead of 8.3.22, but the patch is 8.3.36…

Still waiting for 8.3.36. Most our agency sites are on 8.3.

Upgrading to 8.5 is not a good option considering most of plugins don’t even report compatibility with that PHP version.

I am also seeing 8.3.35 but the patch is in 8.3.36. Earlier it was showing 8.3.26 which was released on Sept 2025 and Kinsta haven’t updated patch version after that.

@VladimirM When can we expect PHP 8.2./3/4 to get patches applied?

8.3.36 arrived at one of my sites now, a few mins ago.

Yes, I am seeing 8.3.36 as well. Still not seeing updates for 8.2.34

Hi everyone,

We have created a status page specifically for this critical PHP security release, where you can subscribe to receive updates.

You can find the status page here: Kinsta Status - PHP Security Vulnerability Update

We apologize for the inconvenience and appreciate your understanding as we work to secure all available PHP versions and fully address this critical PHP security vulnerability incident.