PHP 8.1.34 for Windows - CVE-2026-109618 & CVE-2026-109619 security fix (x64/x86, NTS/TS)

Unofficial PHP 8.1.34 Windows builds with the official PHP security team backport for two critical remote code execution vulnerabilities:

• CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): RCE via OOM corruption
• CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): RCE via stale global state

Built from php-src 1d7dec1 (branch PHP-8.1-CVE-2026-109618-109619) with the official php-windows-builder: Visual Studio 2019 (vs16), PGO. php -v reports 8.1.34-pl1-cve2026.

File	Use
php-8.1.34-pl1-cve2026-nts-Win32-vs16-x64.zip	IIS, FastCGI, CLI (64-bit)
php-8.1.34-pl1-cve2026-Win32-vs16-x64.zip	Apache mod_php (64-bit)
php-8.1.34-pl1-cve2026-nts-Win32-vs16-x86.zip	IIS, FastCGI, CLI (32-bit)
php-8.1.34-pl1-cve2026-Win32-vs16-x86.zip	Apache mod_php (32-bit)
php-debug-pack-* / php-devel-pack-*	PDB symbols / SDK for building extensions
SHA256SUMS	Checksums for every file

Verify a download:

gh attestation verify .\php-8.1.34-pl1-cve2026-nts-Win32-vs16-x64.zip --repo ruban-s/php-8.1-windows-security

Requires the Visual C++ 2015-2022 Redistributable. Upgrade steps, verification and FAQ: see the README. PHP 8.1 is end of life, so plan an upgrade to a supported version.