PHP 8.5.9

PHP 8.5.9 just dropped and it's a security release — meaning you probably want to update sooner rather than later. Here's the deal.

The PHP team pushed this one out hot on July 30, 2026, and the official line is simple: this is a security release, and all PHP 8.5 users should upgrade ASAP.

What's Fixed

While the exact CVEs aren't public yet (they'll be detailed on the PHP ChangeLog), the fact that this is a designated security release means several vulnerabilities have been patched. Security releases in the 8.5 branch typically address issues found through the bug bounty program or internal audits.

Upgrade Path

If you're on PHP 8.5.x, the upgrade to 8.5.9 is a straight swap — no breaking changes, no deprecations to worry about. Just update your package manager and restart your webserver or FPM pool:

• Debian/Ubuntu: apt update && apt upgrade php8.5
• Alpine: apk upgrade php85
• macOS (Homebrew): brew upgrade php
• Docker: Pull the latest php:8.5.9 image

TL;DR: It's a security release. Patch now, ask questions later. 🔒