Everything
php
Learn Community Releases The PHP Project
Home » Releases » 8.5 » 8.5.10 »

PHP 8.5.6

The latest release of PHP 8.5 is 8.5.10 which includes important security patches.

Source Code

  • PHP 8.5.6 (tar.gz)

    • sha256: 169aaa21c2834b38df8e39169f43bc5bea8d4059a816cfbc59be08fc2bae60cd

  • PHP 8.5.6 (tar.bz2)

    • sha256: 4457240f65f0c59a620920d66cdab1b12100a431e03ad9febe38b13a1b25957f

  • PHP 8.5.6 (tar.xz)

    • sha256: 826c600b7c6f956bd335558ca3bdbcab23b22126c1cc8d9348be2280a2204bb7

Change Log

  • core

    • Fixed bug GH-19983 (GC assertion failure with fibers, generators and destructors).
      iliaal
    • Fixed ZEND_API mismatch on zend_ce_closure forward decl for Windows+Clang.
      henderkes
    • Fixed bug GH-21504 (Incorrect RC-handling for ZEND_EXT_STMT op1).
      ilutov
    • Fixed bug GH-21478 (Forward property operations to real instance for initialized lazy proxies).
      iliaal
    • Fixed bug GH-21605 (Missing addref for Countable::count()).
      ilutov
    • Fixed bug GH-21699 (Assertion failure in shutdown_executor when resolving self::/parent::/static:: callables if the error handler throws).
      macoaure
    • Fixed bug GH-21603 (Missing addref for __unset).
      ilutov
    • Fixed bug GH-21760 (Trait with class constant name conflict against enum case causes SEGV).
      Pratik Bhujel

  • cli

    • Fixed bug GH-21754 (`--rf` command line option with a method triggers ext/reflection deprecation warnings).
      DanielEScherzer

  • curl

    • Add support for brotli and zstd on Windows.
      Shivam Mathur

  • dom

    • Fixed GHSA-4jhr-8w89-j733 and GH-21566 (Dom\XMLDocument::C14N() emits duplicate xmlns declarations after setAttributeNS()). (CVE-2026-7263)
      David Carlier

  • fpm

  • iconv

    • Fixed bug GH-17399 (iconv memory leak on bailout).
      iliaal

  • lexbor

    • Upgrade to lexbor v2.7.0.
      CVE-2026-29078
      CVE-2026-29079) (ndossche
      ilutov

  • mbstring

    • Fixed GHSA-wm6j-2649-pv75 (Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()). (CVE-2026-7259)
      vi3tL0u1s
    • Fixed GHSA-74r9-qxhc-fx53 (Out-of-bounds access in mbfl_name2encoding_ex()). (CVE-2026-6104)
      ilutov

  • opcache

    • Fixed bug GH-21158 (JIT: Assertion jit->ra[var].flags & (1<<0) failed in zend_jit_use_reg).
      Arnaud
    • Fixed bug GH-21593 (Borked function JIT JMPNZ smart branch).
      ilutov
    • Fixed bug GH-21460 (COND optimization regression).
      Dmitry
      Arnaud
    • Fixed faulty returns out of zend_try block in zend_jit_trace().
      ilutov

  • openssl

    • Fix memory leak regression in openssl_pbkdf2().
      ndossche
    • Fix a bunch of memory leaks and crashes on edge cases.
      ndossche

  • pdo_firebird

    • Fixed GHSA-w476-322c-wpvm (SQL injection via NUL bytes in quoted strings). (CVE-2025-14179)
      SakiTakamachi

  • pdo_pgsql

    • Fixed bug GH-21683 (pdo_pgsql throws with ATTR_PREFETCH=0 on empty result set).
      thomasschiet

  • phar

    • Restore is_link handler in phar_intercept_functions_shutdown.
      iliaal
    • Fixed bug GH-21797 (phar: NULL dereference in Phar::webPhar() when SCRIPT_NAME is absent from SAPI environment).
      iliaal
    • Fix memory leak in Phar::offsetGet().
      iliaal
    • Fix memory leak in phar_add_file().
      iliaal
    • Fixed bug GH-21799 (phar: propagate phar_stream_flush return value from phar_stream_close).
      iliaal
    • Fix memory leak in phar_verify_signature() when md_ctx is invalid.
      JarneClauw

  • random

    • Fixed bug GH-21731 (Random\Engine\Xoshiro256StarStar::__unserialize() accepts all-zero state).
      iliaal

  • session

    • Fixed memory leak when session GC callback return a refcounted value.
      jorgsowa

  • soap

    • Fixed GHSA-85c2-q967-79q5 (Stale SOAP_GLOBAL(ref_map) pointer with Apache Map). (CVE-2026-6722)
      ilutov
    • Fixed GHSA-m33r-qmcv-p97q (Use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION). (CVE-2026-7261)
      ilutov
    • Fixed GHSA-hmxp-6pc4-f3vv (Broken Apache map value NULL check). (CVE-2026-7262)
      ilutov

  • spl

    • Fixed bug GH-21499 (RecursiveArrayIterator getChildren UAF after parent free).
      Girgias
    • Fix concurrent iteration and deletion issues in SplObjectStorage.
      ndossche

  • sqlite3

    • Fixed wrong free list comparator pointer type.
      David Carlier

  • standard

    • Fixed GHSA-96wq-48vp-hh57 (Signed integer overflow of char array offset). (CVE-2026-7568)
      TimWolla
    • Fixed GHSA-m8rr-4c36-8gq4 (Consistently pass unsigned char to ctype.h functions). (CVE-2026-7258)
      ilutov

  • streams

    • Fixed bug GH-21468 (Segfault in file_get_contents w/ a https URL and a proxy set). (CVE-2026-12184)
      ndossche

  • uri

    • Fixed CVE-2026-42371 (uriparser before 1.0.1 has numeric truncation in text range comparison). (CVE-2026-42371)
      Joshua W. Windle

PHP 8.5


  Represents a security release