PHP 7.4.33 / 8.0.30 / 8.1.34 for Windows, patched for CVE-2026-109618 and CVE-2026-109619 (2026-10-22)

Unofficial Windows x64 Thread Safe builds of PHP 7.4.33, 8.0.30 and 8.1.34, compiled on 22 October 2026 from the official PHP security patches for CVE-2026-109618 and CVE-2026-109619 ("php2shell").

⚠️ Not official PHP releases. For local development only (WampServer, XAMPP, Laragon). Provided as is, without warranty. These branches are end of life: the real fix is PHP 8.2 or newer.

Archive	php -v	Compiler	SHA-256
php-7.4.33-CVE-2026-10-22-ACRONET-Win32-vc15-x64.zip	7.4.33-CVE-2026-10-22-ACRONET	VC15 (14.16)	85ac2e055e8ef943f1ea110f87e027cb382949d52498dfd7306ab9ed7f5aa2c3
php-8.0.30-CVE-2026-10-22-ACRONET-Win32-vs16-x64.zip	8.0.30-CVE-2026-10-22-ACRONET	VS16	6709349244cc99fff01c53c6527f82f95be204d1ba3d7da3abe58f834441cc56
php-8.1.34-CVE-2026-10-22-ACRONET-Win32-vs16-x64.zip	8.1.34-CVE-2026-10-22-ACRONET	VS16	73c64459678d7b65f6a8bba51ae2d5918f6f012f125032cc509d6978d95acde1

Same compiler and extension API as the official builds: Xdebug and other third-party extensions keep loading. PHP_VERSION_ID is unchanged. No Oracle extensions, no PGO. Sources, patch commits and build steps: see the README.

---

En français : versions Windows non officielles de PHP 7.4.33, 8.0.30 et 8.1.34, compilées le 22 octobre 2026 à partir des correctifs officiels des failles CVE-2026-109618 et CVE-2026-109619. Pour le développement local uniquement, sans garantie. La vraie solution reste PHP 8.2 ou plus récent. Compilées par Acronet, agence web à Mulhouse.

Update (22 October 2026, evening): Non Thread Safe (NTS) editions added (-nts- archives), for IIS, Nginx, Apache with mod_fcgid and other FastCGI setups. Keep the edition you already run (php -i, line Thread Safety).

Mise à jour (22 octobre 2026, soir) : éditions Non Thread Safe (NTS) ajoutées (archives -nts-), pour IIS, Nginx, Apache avec mod_fcgid et tout serveur en FastCGI. Gardez l'édition déjà installée (php -i, ligne Thread Safety).