TYPO3-PSA-2026-001: Critical PHP security release: PHP update required for all TYPO3 installations

The PHP project has published a security release fixing two critical vulnerabilities in PHP.

Given the critical severity, TYPO3 users should update PHP on their installations without delay. Your hosting provider may already be updating PHP for you. Please check with them, and if you manage your own server, VPS or Docker containers, update PHP as soon as possible.

In TYPO3, you can find the PHP version of your installation under System Information Toolbar > PHP Version in the backend. Many hosting providers also display it in their administration panel.

These vulnerabilities are in PHP itself and are not specific to TYPO3. They affect every server running a PHP application. No TYPO3 update is required. Only PHP needs to be updated.

PHP versions prior to 8.2 no longer receive security updates from the PHP project. If your installation runs on an older version, update to PHP 8.2 or newer. This also applies to ELTS customers using TYPO3 v11 or v12 with PHP 8.1.

TYPO3 v10 ELTS supports PHP up to 7.4. Customers on this version should obtain commercial PHP security updates, for example through Ubuntu Pro.