| Version | Change log |
| PHP 8.4.14 Oct 22, 2025 |
Core: Fixed bug GH-18850 (Repeated inclusion of file with __halt_compiler() triggers "Constant already defined" warning). Partially fixed bug GH-19542 (Scanning of string literals >=2GB will fail due to signed int overflow). Fixed bug GH-19544 (GC treats ZEND_WEAKREF_TAG_MAP references as WeakMap references). Fixed bug GH-19613 (Stale array iterator pointer). Fixed bug GH-19679 (zend_ssa_range_widening may fail to converge). Fixed bug GH-19681 (PHP_EXPAND_PATH broken with bash 5.3.0). Fixed bug GH-19720 (Assertion failure when error handler throws when accessing a deprecated constant). CLI: Fixed bug GH-19461 (Improve error message on listening error with IPv6 address). Date: Fixed date_sunrise() and date_sunset() with partial-hour UTC offset. DBA: Fixed bug GH-19706 (dba stream resource mismanagement). DOM: Fixed bug GH-19612 (Mitigate libxml2 tree dictionary bug). FPM: Fixed failed debug assertion when php_admin_value setting fails. Intl: Fixed bug GH-11952 (Fix locale strings canonicalization for IntlDateFormatter and NumberFormatter). Opcache: Fixed bug GH-19493 (JIT variable not stored before YIELD). OpenSSL: Fixed bug GH-19245 (Success error message on TLS stream accept failure). PGSQL: Fixed bug GH-19485 (potential use after free when using persistent pgsql connections). Phar: Fixed memory leaks when verifying OpenSSL signature. Fix memory leak in phar tar temporary file error handling code. Fix metadata leak when phar convert logic fails. Fix memory leak on failure in phar_convert_to_other(). Fixed bug GH-19752 (Phar decompression with invalid extension can cause UAF). Standard: Fixed bug GH-16649 (UAF during array_splice). Fixed bug GH-19577 (Avoid integer overflow when using a small offset and PHP_INT_MAX with LimitIterator). Streams: Remove incorrect call to zval_ptr_dtor() in user_wrapper_metadata(). Fix OSS-Fuzz #385993744. Zip: Fix memory leak in zip when encountering empty glob result. |
| PHP 8.4.13 Oct 7, 2025 |
Core: Fixed GH-19169 build issue with C++17 and ZEND_STATIC_ASSERT macro. Fixed bug GH-19053 (Duplicate property slot with hooks and interface property). Fixed bug GH-19044 (Protected properties are not scoped according to their prototype). Fixed bug GH-18581 (Coerce numeric string keys from iterators when argument unpacking). Fixed OSS-Fuzz #434346548 (Failed assertion with throwing __toString in binary const expr). Fixed bug GH-19305 (Operands may be being released during comparison). Fixed bug GH-19303 (Unpacking empty packed array into uninitialized array causes assertion failure). Fixed bug GH-19306 (Generator can be resumed while fetching next value from delegated Generator). Fixed bug GH-19326 (Calling Generator::throw() on a running generator with a non-Generator delegate crashes). Fixed bug GH-19280 (Stale array iterator position on rehashing). Fixed bug GH-18736 (Circumvented type check with return by ref + finally). Fixed bug GH-19065 (Long match statement can segfault compiler during recursive SSA renaming). Calendar: Fixed bug GH-19371 (integer overflow in calendar.c). FTP: Fix theoretical issues with hrtime() not being available. GD: Fix incorrect comparison with result of php_stream_can_cast(). Hash: Fix crash on clone failure. Intl: Fix memleak on failure in collator_get_sort_key(). Fix return value on failure for resourcebundle count handler. LDAP: Fixed bug GH-18529 (additional inheriting of TLS int options). LibXML: Fixed bug GH-19098 (libxml<2.13 segmentation fault caused by php_libxml_node_free). MbString: Fixed bug GH-19397 (mb_list_encodings() can cause crashes on shutdown). Opcache: Reset global pointers to prevent use-after-free in zend_jit_status(). Fix issue with JIT restart and hooks. Fix crash with dynamic function defs in hooks during preload. OpenSSL: Fixed bug GH-18986 (OpenSSL backend: incorrect RAND_{load,write}_file() return value check). Fix error return check of EVP_CIPHER_CTX_ctrl(). Fixed bug GH-19428 (openssl_pkey_derive se |
| PHP 8.4.11 Jul 31, 2025 |
Core: Fixed GH-18480 (array_splice with large values for offset/length arguments). Partially fixed GH-18572 (nested object comparisons leading to stack overflow). Fixed OSS-Fuzz #417078295. Fixed OSS-Fuzz #418106144. Curl: Fixed GH-18460 (curl_easy_setopt with CURLOPT_USERPWD/CURLOPT_USERNAME/ CURLOPT_PASSWORD set the Authorization header when set to NULL). Date: Fixed bug GH-18076 (Since PHP 8, the date_sun_info() function returns inaccurate sunrise and sunset times, but other calculated times are correct) (JiriJozif). Fixed bug GH-18481 (date_sunrise with unexpected nan value for the offset). DOM: Backport lexbor/lexbor#274. Intl: Fix various reference issues. LDAP: Fixed bug GH-18529 (ldap no longer respects TLS_CACERT from ldaprc in ldap_start_tls()). Opcache: Fixed bug GH-18417 (Windows SHM reattachment fails when increasing memory_consumption or jit_buffer_size). Fixed bug GH-18297 (Exception not handled when jit guard is triggered). Fixed bug GH-18408 (Snapshotted poly_func / poly_this may be spilled). Fixed bug GH-18567 (Preloading with internal class alias triggers assertion failure). Fixed bug GH-18534 (FPM exit code 70 with enabled opcache and hooked properties in traits). Fix leak of accel_globals->key. OpenSSL: Fix missing checks against php_set_blocking() in xp_ssl.c. SPL: Fixed bug GH-18421 (Integer overflow with large numbers in LimitIterator). Standard: Fixed bug GH-17403 (Potential deadlock when putenv fails). Fixed bug GH-18400 (http_build_query type error is inaccurate). Fixed bug GH-18509 (Dynamic calls to assert() ignore zend.assertions). Windows: Fix leak+crash with sapi_windows_set_ctrl_handler(). Zip: Fixed bug GH-18431 (Registering ZIP progress callback twice doesn't work). Fixed bug GH-18438 (Handling of empty data and errors in ZipArchive::addPattern). |
| PHP 8.4.9 Jul 2, 2025 |
Core: Fixed GH-18480 (array_splice with large values for offset/length arguments). Partially fixed GH-18572 (nested object comparisons leading to stack overflow). Fixed OSS-Fuzz #417078295. Fixed OSS-Fuzz #418106144. Curl: Fixed GH-18460 (curl_easy_setopt with CURLOPT_USERPWD/CURLOPT_USERNAME/ CURLOPT_PASSWORD set the Authorization header when set to NULL). Date: Fixed bug GH-18076 (Since PHP 8, the date_sun_info() function returns inaccurate sunrise and sunset times, but other calculated times are correct) (JiriJozif). Fixed bug GH-18481 (date_sunrise with unexpected nan value for the offset). DOM: Backport lexbor/lexbor#274. Intl: Fix various reference issues. LDAP: Fixed bug GH-18529 (ldap no longer respects TLS_CACERT from ldaprc in ldap_start_tls()). Opcache: Fixed bug GH-18417 (Windows SHM reattachment fails when increasing memory_consumption or jit_buffer_size). Fixed bug GH-18297 (Exception not handled when jit guard is triggered). Fixed bug GH-18408 (Snapshotted poly_func / poly_this may be spilled). Fixed bug GH-18567 (Preloading with internal class alias triggers assertion failure). Fixed bug GH-18534 (FPM exit code 70 with enabled opcache and hooked properties in traits). Fix leak of accel_globals->key. OpenSSL: Fix missing checks against php_set_blocking() in xp_ssl.c. SPL: Fixed bug GH-18421 (Integer overflow with large numbers in LimitIterator). Standard: Fixed bug GH-17403 (Potential deadlock when putenv fails). Fixed bug GH-18400 (http_build_query type error is inaccurate). Fixed bug GH-18509 (Dynamic calls to assert() ignore zend.assertions). Windows: Fix leak+crash with sapi_windows_set_ctrl_handler(). Zip: Fixed bug GH-18431 (Registering ZIP progress callback twice doesn't work). Fixed bug GH-18438 (Handling of empty data and errors in ZipArchive::addPattern). |
| PHP 8.4.8 Jun 18, 2025 |
BCMath: Fixed pointer subtraction for scale. Core: Fixed property hook backing value access in multi-level inheritance. Fixed accidentally inherited default value in overridden virtual properties. Fixed bug GH-17376 (Broken JIT polymorphism for property hooks added to child class). Fixed bug GH-17913 (ReflectionFunction::isDeprecated() returns incorrect results for closures created from magic __call()). Fixed bug GH-17941 (Stack-use-after-return with lazy objects and hooks). Fixed bug GH-17988 (Incorrect handling of hooked props without get hook in get_object_vars()). Fixed bug GH-17998 (Skipped lazy object initialization on primed SIMPLE_WRITE cache). Fixed bug GH-17998 (Assignment to backing value in set hook of lazy proxy calls hook again). Fixed bug GH-17961 (use-after-free during dl()'ed module class destruction). Fixed bug GH-15367 (dl() of module with aliased class crashes in shutdown). Fixed OSS-Fuzz #403308724. Fixed bug GH-13193 again (Significant performance degradation in 'foreach'). DBA: Fixed assertion violation when opening the same file with dba_open multiple times. DOM: Fixed bug GH-17991 (Assertion failure dom_attr_value_write). Fix weird unpack behaviour in DOM. Fixed bug GH-18090 (DOM: Svg attributes and tag names are being lowercased). Fix xinclude destruction of live attributes. Fuzzer: Fixed bug GH-18081 (Memory leaks in error paths of fuzzer SAPI). GD: Fixed bug GH-17984 (calls with arguments as array with references). LDAP: Fixed bug GH-18015 (Error messages for ldap_mod_replace are confusing). Mbstring: Fixed bug GH-17989 (mb_output_handler crash with unset http_output_conv_mimetypes). Opcache: Fixed bug GH-15834 (Segfault with hook "simple get" cache slot and minimal JIT). Fixed bug GH-17966 (Symfony JIT 1205 assertion failure). Fixed bug GH-18037 (SEGV Zend/zend_execute.c). Fixed bug GH-18050 (IN_ARRAY optimization in DFA pass is broken). Fixed bug GH-18113 (stack-buffer-overflow ext/opcache/jit/ir/ir_sccp.c). Fixed bug GH-18112 |
| PHP 8.4.7 May 6, 2025 |
BCMath: Fixed pointer subtraction for scale. Core: Fixed property hook backing value access in multi-level inheritance. Fixed accidentally inherited default value in overridden virtual properties. Fixed bug GH-17376 (Broken JIT polymorphism for property hooks added to child class). Fixed bug GH-17913 (ReflectionFunction::isDeprecated() returns incorrect results for closures created from magic __call()). Fixed bug GH-17941 (Stack-use-after-return with lazy objects and hooks). Fixed bug GH-17988 (Incorrect handling of hooked props without get hook in get_object_vars()). Fixed bug GH-17998 (Skipped lazy object initialization on primed SIMPLE_WRITE cache). Fixed bug GH-17998 (Assignment to backing value in set hook of lazy proxy calls hook again). Fixed bug GH-17961 (use-after-free during dl()'ed module class destruction). Fixed bug GH-15367 (dl() of module with aliased class crashes in shutdown). Fixed OSS-Fuzz #403308724. Fixed bug GH-13193 again (Significant performance degradation in 'foreach'). DBA: Fixed assertion violation when opening the same file with dba_open multiple times. DOM: Fixed bug GH-17991 (Assertion failure dom_attr_value_write). Fix weird unpack behaviour in DOM. Fixed bug GH-18090 (DOM: Svg attributes and tag names are being lowercased). Fix xinclude destruction of live attributes. Fuzzer: Fixed bug GH-18081 (Memory leaks in error paths of fuzzer SAPI). GD: Fixed bug GH-17984 (calls with arguments as array with references). LDAP: Fixed bug GH-18015 (Error messages for ldap_mod_replace are confusing). Mbstring: Fixed bug GH-17989 (mb_output_handler crash with unset http_output_conv_mimetypes). Opcache: Fixed bug GH-15834 (Segfault with hook "simple get" cache slot and minimal JIT). Fixed bug GH-17966 (Symfony JIT 1205 assertion failure). Fixed bug GH-18037 (SEGV Zend/zend_execute.c). Fixed bug GH-18050 (IN_ARRAY optimization in DFA pass is broken). Fixed bug GH-18113 (stack-buffer-overflow ext/opcache/jit/ir/ir_sccp.c). Fixed bug GH-18112 |
| PHP 8.4.6 Apr 23, 2025 |
BCMath: Fixed pointer subtraction for scale. Core: Fixed property hook backing value access in multi-level inheritance. Fixed accidentally inherited default value in overridden virtual properties. Fixed bug GH-17376 (Broken JIT polymorphism for property hooks added to child class). Fixed bug GH-17913 (ReflectionFunction::isDeprecated() returns incorrect results for closures created from magic __call()). Fixed bug GH-17941 (Stack-use-after-return with lazy objects and hooks). Fixed bug GH-17988 (Incorrect handling of hooked props without get hook in get_object_vars()). Fixed bug GH-17998 (Skipped lazy object initialization on primed SIMPLE_WRITE cache). Fixed bug GH-17998 (Assignment to backing value in set hook of lazy proxy calls hook again). Fixed bug GH-17961 (use-after-free during dl()'ed module class destruction). Fixed bug GH-15367 (dl() of module with aliased class crashes in shutdown). Fixed OSS-Fuzz #403308724. Fixed bug GH-13193 again (Significant performance degradation in 'foreach'). DBA: Fixed assertion violation when opening the same file with dba_open multiple times. DOM: Fixed bug GH-17991 (Assertion failure dom_attr_value_write). Fix weird unpack behaviour in DOM. Fixed bug GH-18090 (DOM: Svg attributes and tag names are being lowercased). Fix xinclude destruction of live attributes. Fuzzer: Fixed bug GH-18081 (Memory leaks in error paths of fuzzer SAPI). GD: Fixed bug GH-17984 (calls with arguments as array with references). LDAP: Fixed bug GH-18015 (Error messages for ldap_mod_replace are confusing). Mbstring: Fixed bug GH-17989 (mb_output_handler crash with unset http_output_conv_mimetypes). Opcache: Fixed bug GH-15834 (Segfault with hook "simple get" cache slot and minimal JIT). Fixed bug GH-17966 (Symfony JIT 1205 assertion failure). Fixed bug GH-18037 (SEGV Zend/zend_execute.c). Fixed bug GH-18050 (IN_ARRAY optimization in DFA pass is broken). Fixed bug GH-18113 (stack-buffer-overflow ext/opcache/jit/ir/ir_sccp.c). Fixed bug GH-18112 |
| PHP 8.4.5 Mar 12, 2025 |
Core: Fixed GH-13569 (GC buffer unnecessarily grows up to GC_MAX_BUF_SIZE when scanning WeakMaps). Fixed bug GH-13612 (Corrupted memory in destructor with weak references). Fixed bug GH-13446 (Restore exception handler after it finishes). Fixed bug GH-13784 (AX_GCC_FUNC_ATTRIBUTE failure). Fixed bug GH-13670 (GC does not scale well with a lot of objects created in destructor). DOM: Add some missing ZPP checks. Fix potential memory leak in XPath evaluation results. FPM: Fixed GH-11086 (FPM: config test runs twice in daemonised mode). Fix incorrect check in fpm_shm_free(). GD: Fixed bug GH-12019 (add GDLIB_CFLAGS in feature tests). Gettext: Fixed sigabrt raised with dcgettext/dcngettext calls with gettext 0.22.5 with category set to LC_ALL. MySQLnd: Fix GH-13452 (Fixed handshake response [mysqlnd]). Fix incorrect charset length in check_mb_eucjpms(). Opcache: Fixed GH-13508 (JITed QM_ASSIGN may be optimized out when op1 is null). Fixed GH-13712 (Segmentation fault for enabled observers when calling trait method of internal trait when opcache is loaded). Random: Fixed bug GH-13544 (Pre-PHP 8.2 compatibility for mt_srand with unknown modes). Fixed bug GH-13690 (Global Mt19937 is not properly reset in-between requests when MT_RAND_PHP is used). Session: Fixed bug GH-13680 (Segfault with session_decode and compilation error). SPL: Fixed bug GH-13685 (Unexpected null pointer in zend_string.h). Standard: Fixed bug GH-11808 (Live filesystem modified by tests). Fixed GH-13402 (Added validation of `n` in $additional_headers of mail()). Fixed bug GH-13203 (file_put_contents fail on strings over 4GB on Windows). Fixed bug GHSA-pc52-254m-w9w7 (Command injection via array-ish $command parameter of proc_open). (CVE-2024-1874) Fixed bug GHSA-wpj3-hf5j-x4v4 (__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix). (CVE-2024-2756) Fixed bug GHSA-h746-cjrr-wfmr (password_verify can erroneously return true, opening ATO risk). (CVE-2024-3096) Fixed bug GHSA-fjp9-9hwx-59fq (mb_ |
| PHP 8.4.4 Feb 12, 2025 |
Core: Fixed GH-13569 (GC buffer unnecessarily grows up to GC_MAX_BUF_SIZE when scanning WeakMaps). Fixed bug GH-13612 (Corrupted memory in destructor with weak references). Fixed bug GH-13446 (Restore exception handler after it finishes). Fixed bug GH-13784 (AX_GCC_FUNC_ATTRIBUTE failure). Fixed bug GH-13670 (GC does not scale well with a lot of objects created in destructor). DOM: Add some missing ZPP checks. Fix potential memory leak in XPath evaluation results. FPM: Fixed GH-11086 (FPM: config test runs twice in daemonised mode). Fix incorrect check in fpm_shm_free(). GD: Fixed bug GH-12019 (add GDLIB_CFLAGS in feature tests). Gettext: Fixed sigabrt raised with dcgettext/dcngettext calls with gettext 0.22.5 with category set to LC_ALL. MySQLnd: Fix GH-13452 (Fixed handshake response [mysqlnd]). Fix incorrect charset length in check_mb_eucjpms(). Opcache: Fixed GH-13508 (JITed QM_ASSIGN may be optimized out when op1 is null). Fixed GH-13712 (Segmentation fault for enabled observers when calling trait method of internal trait when opcache is loaded). Random: Fixed bug GH-13544 (Pre-PHP 8.2 compatibility for mt_srand with unknown modes). Fixed bug GH-13690 (Global Mt19937 is not properly reset in-between requests when MT_RAND_PHP is used). Session: Fixed bug GH-13680 (Segfault with session_decode and compilation error). SPL: Fixed bug GH-13685 (Unexpected null pointer in zend_string.h). Standard: Fixed bug GH-11808 (Live filesystem modified by tests). Fixed GH-13402 (Added validation of `n` in $additional_headers of mail()). Fixed bug GH-13203 (file_put_contents fail on strings over 4GB on Windows). Fixed bug GHSA-pc52-254m-w9w7 (Command injection via array-ish $command parameter of proc_open). (CVE-2024-1874) Fixed bug GHSA-wpj3-hf5j-x4v4 (__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix). (CVE-2024-2756) Fixed bug GHSA-h746-cjrr-wfmr (password_verify can erroneously return true, opening ATO risk). (CVE-2024-3096) Fixed bug GHSA-fjp9-9hwx-59fq (mb_ |
| PHP 8.4.3 Jan 29, 2025 |
Core: Fixed GH-13569 (GC buffer unnecessarily grows up to GC_MAX_BUF_SIZE when scanning WeakMaps). Fixed bug GH-13612 (Corrupted memory in destructor with weak references). Fixed bug GH-13446 (Restore exception handler after it finishes). Fixed bug GH-13784 (AX_GCC_FUNC_ATTRIBUTE failure). Fixed bug GH-13670 (GC does not scale well with a lot of objects created in destructor). DOM: Add some missing ZPP checks. Fix potential memory leak in XPath evaluation results. FPM: Fixed GH-11086 (FPM: config test runs twice in daemonised mode). Fix incorrect check in fpm_shm_free(). GD: Fixed bug GH-12019 (add GDLIB_CFLAGS in feature tests). Gettext: Fixed sigabrt raised with dcgettext/dcngettext calls with gettext 0.22.5 with category set to LC_ALL. MySQLnd: Fix GH-13452 (Fixed handshake response [mysqlnd]). Fix incorrect charset length in check_mb_eucjpms(). Opcache: Fixed GH-13508 (JITed QM_ASSIGN may be optimized out when op1 is null). Fixed GH-13712 (Segmentation fault for enabled observers when calling trait method of internal trait when opcache is loaded). Random: Fixed bug GH-13544 (Pre-PHP 8.2 compatibility for mt_srand with unknown modes). Fixed bug GH-13690 (Global Mt19937 is not properly reset in-between requests when MT_RAND_PHP is used). Session: Fixed bug GH-13680 (Segfault with session_decode and compilation error). SPL: Fixed bug GH-13685 (Unexpected null pointer in zend_string.h). Standard: Fixed bug GH-11808 (Live filesystem modified by tests). Fixed GH-13402 (Added validation of `n` in $additional_headers of mail()). Fixed bug GH-13203 (file_put_contents fail on strings over 4GB on Windows). Fixed bug GHSA-pc52-254m-w9w7 (Command injection via array-ish $command parameter of proc_open). (CVE-2024-1874) Fixed bug GHSA-wpj3-hf5j-x4v4 (__Host-/__Secure- cookie bypass due to partial CVE-2022-31629 fix). (CVE-2024-2756) Fixed bug GHSA-h746-cjrr-wfmr (password_verify can erroneously return true, opening ATO risk). (CVE-2024-3096) Fixed bug GHSA-fjp9-9hwx-59fq (mb_ |
