The PHP development team has issued PHP 8.2.35 as a security-focused update addressing two critical vulnerabilities. CVE-2026-109618 and CVE-2026-109619 could permit unauthenticated remote code execution if exploited. The update requires immediate installation by all users of PHP 8.2, as no alternative mitigations exist. PHP 8.2 entered its end-of-life phase on 31 December 2026, meaning no further security patches will be issued after that date. Users are advised to transition to supported versions promptly. Source code and binaries for PHP 8.2.35 are available through the official downloads page, with detailed change logs documenting the fixes.