Good News: The PHP Security Fix Is Live

Hi there

We are following up on yesterday's critical PHP security notice: the fix is out, and most of you are already covered.

The PHP Security Fix Is Live: What Happens Next

Good news: the PHP fix is out. If you're on Pimcore Platform 2023.1 or newer, you're covered as soon as your servers run one of the patched PHP versions (8.2.35, 8.3.36, 8.4.27, or 8.5.12).

We took care of it immediately. Updated Pimcore Docker images have been live since yesterday.

Still on Pimcore 10.6? We've got you too.

Upgrades don't happen overnight, so we built a dedicated patch:

• Enterprise Edition & LTS: Available Friday, October 23, 2026, 10:00 CEST via Composer.
• Community Edition: Get it bundled with Enterprise Edition (LTS included), on special terms for a limited time.

Can't patch right away? Keep internet-facing instances behind a VPN or firewall until you're ready to update.