Critical PHP Security Release Today: What Pimcore Users Need to Know

Hi there

We are reaching out today with a time-sensitive security notice, not our usual roundup.

Critical PHP Security Release Today: What Pimcore Users Need to Know

Today at 14:00 UTC (16:00 CEST), the PHP project is publishing a critical security release. It fixes two vulnerabilities, both rated 9.2 out of 10 on CVSS v4.

To be clear: this is a vulnerability in PHP itself, not in Pimcore. But because Pimcore runs on PHP, every Pimcore installation needs attention today.

What this means for you:

• 🔹PHP 8.2 to 8.5: PHP project will release a patch until 4pm CEST. Install patch after the release and test.
• 🔹PHP 8.1 or older: The PHP project will not ship a fix for you. PHP 8.1 lost security support on December 31, 2025, and older versions lost it years ago. Upgrading PHP is the only real fix.
• 🔹Pimcore Platform 2023.1 or newer (Pimcore Core v11 or newer): Already supports PHP 8.2 and newer. Update PHP in your infrastructure after the release of the patch.
• 🔹Pimcore Platform 2022.0 or older (Pimcore Core 10 or older): Lost LTS support in August 2025 and does not officially support PHP 8.2 or newer. We are already evaluating options to provide help.

How Pimcore has you covered:

• ✅ Updated Docker images will be released as soon as the PHP patch ships.
• ✅ Pimcore PaaS, powered by upsun, will also receive the updated Docker images immediately.

If you have questions, reach out to your Pimcore contact or partner, or raise a ticket at get.support.pimcore.com.