Alert AL26-026 notes under its table: "versions 8.1 and older no longer receive updates from the PHP project. Some distributions and LTS vendors provide backported fixes, so contact your vendor for details, or upgrade to a supported version." Its table lists no 8.1 or older row.

The exact words it rests on

Note: versions 8.1 and older no longer receive updates from the PHP project. Some distributions and LTS vendors provide backported fixes, so contact your vendor for details, or upgrade to a supported version.

What the source said when we opened it, on 23 Oct 2026.

The source

AL26-026 - Critical vulnerabilities impacting PHP - CVE-2026-109618 and CVE-2026-109619
Canadian Centre for Cyber Security · 2026-10-21

Open the sourcearchived copy

Checked

Checked by the notis newsroom on 23 Oct 2026, against the source above.

In the story

PHP patches two critical remote code execution flaws 23 Oct 2026