On October 21, 2026, the PHP team released PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12 to fix two critical remote code execution vulnerabilities: CVE-2026-109618 and CVE-2026-109619. Patched PHP runtimes are now available for ExeOutput for PHP 2025. We recommend that you install them and rebuild your applications as soon as possible.
ExeOutput itself is unchanged, so your license and maintenance period are not affected. PHP 8.5 support is also no longer a beta: it now uses the final 8.5.12 release.
🔒 What the vulnerabilities are
According to the PHP security advisory, both flaws allow remote code execution without authentication:
- CVE-2026-109618: memory corruption when PHP runs out of memory while parsing a request.
- CVE-2026-109619: global state left over by one request and reused by a later request handled by the same PHP process.
All PHP runtimes that ExeOutput for PHP 2025 shipped before this update predate the fix.
⬇️ How to update
- Web Update (recommended): in ExeOutput’s application menu, choose Check For Updates, tick the PHP 8.2 / 8.3 / 8.4 / 8.5 packages you use and click Install.
- Refreshed installer: download ExeOutput for PHP 2025.0 (build 25.0.1.0). If you install it over an existing ExeOutput 2025, run Web Update afterwards, because the installer removes the PHP 8.2–8.5 runtimes.
🛠️ Rebuild your applications
The PHP runtime is embedded in each EXE you build. Applications you have already distributed keep the PHP version they were built with until you rebuild and redistribute them.
Web Update clears ExeOutput’s runtime cache automatically. If you updated the runtimes another way, click Environment Options › Clear CEF and PHP runtimes cache before rebuilding, or your EXE may still embed the old PHP. You can check the embedded version with phpinfo() or PHP_VERSION.
⚠️ If you must stay on an older runtime for now
The PHP security advisory lists mitigations. They reduce exposure but do not make an unpatched runtime safe. Your project’s php.ini is embedded in the EXE, so you must rebuild to apply them. Changing settings with ini_set() at runtime does not help.
PHP 8.0, 8.1, 7.4 and 5.6 no longer receive security fixes from php.net. Move your projects to PHP 8.2 or later. ExeOutput 2027 will ship only supported PHP versions.
🌐 External HTTP Server option
By default, your application’s PHP engine does not listen on any network port: ExeOutput passes requests to PHP through a private named pipe. This limits exposure, but it is not a reason to skip the update.
If you enabled the External HTTP Server, it listens on all IPv4 interfaces (0.0.0.0:<port>), so other machines on the network can reach it. Block that port in the Windows firewall, or leave the option off if you don’t need it.
Requirement
Remember that the Visual C++ 2015–2022 Redistributable (x86) must be installed on the machines that build and run your applications.
Questions about this update? Ask on our forum. Stay informed about future updates by subscribing to our newsletter.
💡 For a detailed list of all changes, check out the full changelog.