Everything
php
Learn Community Releases The PHP Project
Home » Releases » 8.5 » 8.5.10 »

PHP 8.5.8

The latest release of PHP 8.5 is 8.5.10 which includes important security patches.

Source Code

  • PHP 8.5.8 (tar.gz)

    • sha256: 6ebc55e52af4396385e689f7af0f28944fbbf966843433b573e9dc1dc03df539

  • PHP 8.5.8 (tar.bz2)

    • sha256: 22f938efc6c4eaa8bf2e40ae11466140309496aa5d5a19204272fb2596fd11dd

  • PHP 8.5.8 (tar.xz)

    • sha256: 58910198d19e873048fe87cdfe16bc790025417ede3d1651bfa1c4b533d573f2

Change Log

  • core

    • Fixed bug GH-22280 (Incorrect compile error for goto to label preceding try/finally block).
      Pratik Bhujel
    • Fixed bug GH-22112 (Assertion when error handler throws during NaN to bool/string coercion).
      iliaal

  • bcmath

    • Fixed issues with oversized allocations and signed overflow in bcround() and BcMath\Number::round().
      edorian

  • date

    • Fix incorrect recurrence check of DatePeriod::createFromISO8601String().
      ndossche

  • exif

    • Read correct value for single and double tags.
      ndossche

  • gd

    • Fixed bug GH-22121 (Double free in gdImageSetStyle() after overflow-triggered early return).
      iliaal

  • intl

    • Fix incorrect argument positions for invalid start/end arguments in transliterator_transliterate().
      Weilin Du
    • Fixed IntlTimeZone::getDisplayName() to synchronize object error state for invalid display types.
      Weilin Du

  • lexbor

    • Merge patch c3a6847.
      ilutov
      timwolla

  • opcache

    • Fixed bug GH-22265 (Another tailcall vm_interrupt bug).
      Levi Morrison
    • Fixed bug GH-20469 (Unsafe inheritance cache replay with reentrant autoloading).
      Levi Morrison
    • Fixed bug GH-21972 (Corrupted variable type when a typed by-value return contains a reference wrapper).
      Weilin Du

  • openssl

    • Fixed bug GH-22187 (Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD). (CVE-2026-14355)
      David Carlier

  • phar

    • Fixed a bypass of the magic ".phar" directory protection in Phar::addEmptyDir() for paths starting with "/.phar", while allowing non-magic directory names that merely share the ".phar" prefix.
      Weilin Du
    • Fixed an integer underflow when parsing ZIP extra fields.
      Weilin Du

  • reflection

    • Preserve class-name case in ReflectionClass::getProperty() error messages and autoloading.
      jorgsowa

  • soap

    • Fixed bug GH-22218 (SoapServer::handle() crash on $_SERVER not being an array).
      David Carlier / Rex-Reynolds
    • Fixed bug GH-22285 (Soap server requires the raw input to be passed to $server->handle).
      David Carlier / ndossche

  • sqlite

    • Fix error checks for column retrieval.
      ndossche

  • uri

    • Add LEXBOR_STATIC to CFLAGS_URI on Windows so ext/uri does not see LXB_API as __declspec(dllimport) when linked statically into PHP.
      Luther Monson
    • Clean error logs before each Uri\WhatWg\Url wither call so that errors from previous wither calls are not returned the next time a UrlValidationError is thrown.
      kocsismate

  • zip

    • Fixed error-related memory leaks.
      ndossche

  • zlib

    • Fixed memory leak if deflate initialization fails and there is a dict.
      ndossche
    • Fixed memory leak in inflate_add().
      ndossche

PHP 8.5


  Represents a security release