Everything
php
Learn Community Releases The PHP Project
Home » Releases » PHP 8.5 » Changelog »

PHP 8.5 Combined Changelog

Explore PHP 8.5

  • PHP 8.5.10

    27 Aug, 2026
    View Release Page

    • core

      • Fixed bug GH-22782 (Const expr FCC crashes under preloading).
        Arnaud
      • Fixed bug GH-23088 (Stack overflow when comparing deeply nested arrays).
        Lazizbek Ergashev

    • date

      • Fixed leak on double DatePeriod::__construct() call.
        ilutov

    • dom

      • Fixed bug GH-23116 (Stack overflow when normalizing a deeply nested DOMDocument).
        Lazizbek Ergashev
      • Fixed bug GH-23117 (Stack overflow when normalizing a deeply nested Dom\XMLDocument).
        Lazizbek Ergashev
      • Fixed bug GH-22825 (DOMElement::setAttribute() fails silently when the DTD declares a default value for the attribute).
        iliaal
      • Fixed bug GH-23120 (Stack overflow when comparing deeply nested DOM nodes with DOMNode::isEqualNode()).
        Weilin Du

    • exif

      • Fixed exif_read_data() allocating a HEIF meta box larger than the file it came from.
        iliaal

    • intl

      • Fixed IntlListFormatter::__construct() leaving stale global error state after successful calls.
        Weilin Du

    • opcache

      • Fixed GH-22693 (DT_TEXTREL in JIT-generated TLS access on x86_64).
        David Carlier
      • Fixed bug GH-22763 (JIT fails to clear ZREG_TYPE_ONLY after setting reg).
        Arnaud
      • Fixed bug GH-22857 (Function JIT emits wrong code for FETCH_OBJ_FUNC_ARG on a property hook getter, losing register-held variables).
        Zhao Hao
      • Fixed bug GH-22916 (Preserve parent regs in zend_jit_deoptimizer_start()).
        Arnaud

    • openssl

      • Fix missing error check on invalid alpn protocols.
        ndossche

    • mbstring

      • Fixed bug GH-22779 (mb_strrpos() returns the wrong position for a negative offset in a non-UTF-8 encoding).
        Eyüp Can Akman
      • Fixed bug GH-21036 (mb_ereg_search_getregs() crashes after mb_eregi() invalidates the regex cache).
        Matthias Goergens

    • pcre

      • Fixed bug GH-21134 (Crash with \C + UTF-8). Using \C in UTF-8 patterns is now forbidden.
        Arnaud

    • pdo_odbc

      • Fixed bug GH-23016 (NULL values in long columns come back as garbage binary strings).
        Calvin Buckley
        iliaal

    • pdo_pgsql

      • Fixed several lazy fetch (PDO::ATTR_PREFETCH => 0) defects: an infinite loop when cleaning up a fetch left in a COPY, a use-after-free when a statement with emulated or disabled prepares is destroyed, a connection left busy for the next fetch, and rows delivered from a result another statement took over.
        KentarouTakeda

    • reflection

      • Fixed bug GH-22905 (Reflection exception messages truncate on null bytes).
        DanielEScherzer
      • Fixed ReflectionProperty::isLazy() and skipLazyInitialization() using the parent slot when a child class hooks an inherited property.
        iliaal
      • Fixed segfault in ReflectionMethod::createFromMethodName() on an uninstantiable subclass.
        iliaal

    • session

      • Fix corruption in mod_mm.
        ndossche
      • Fixed bug GH-23043 (broken session id code can cause zend_mm_heap corrupted).
        ndossche

    • simplexml

      • Fixed integer element offsets that cannot resolve aliasing an existing element.
        iliaal
      • Fixed segfault when comparing uninitialized SimpleXMLElement instances.
        iliaal

    • sockets

      • Fixed socket_set_option() validation error messages for UDP_SEGMENT and SO_LINGER options.
        Weilin Du
      • Fixed various memory related issues in ext/sockets.
        David Carlier

    • sqlite

      • Fix leak when trying to close db if blob stream is still open.
        ndossche

    • standard

      • Fixed bug GH-23111 (Stack overflow in array_walk_recursive() with deeply nested arrays).
        Lazizbek Ergashev
      • Fixed bug GH-23113 (Stack overflow in array_replace_recursive() with deeply nested arrays).
        Lazizbek Ergashev
      • Fixed bug GH-23115 (Stack overflow in compact() with deeply nested arrays).
        Lazizbek Ergashev

    • streams

      • Fixed bug GH-15836 (Use-after-free when a user stream filter accesses $this->stream during the close flush).
        iliaal

    • xsl

      • Fixed use-after-free when a DOMDocument subclass __clone() retains the stylesheet copy made by XSLTProcessor::importStylesheet().
        iliaal

  • PHP 8.5.9

    30 Jul, 2026
    View Release Page

    • core

      • Fixed bug GH-22290 (AST pretty printing does not correctly handle strings containing NUL).
        iliaal
      • Fixed bug GH-22206 (missing return in global register detection).
        P3p111n0
      • Lock unmodified readonly properties for modification after clone-with.
        NickSdot

    • bcmath

    • calendar

      • Fixed bug GH-22602 (gregoriantojd() and juliantojd() integer overflow with INT_MAX year).
        arshidkv12

    • date

      • Update timelib to 2022.17.
        Derick
      • Fixed bug GH-19803 (Parsing a string with a single white space does create an error).
        Derick
      • Fixed Unix timestamps in February of the year 0 are misparsed with @-notation.
        LukasGelbmann
      • Fixed bug GH-11310 (__debugInfo does nothing on userland classes extending Date classes).
        Derick

    • dba

      • Fixed OOB read on malformed length field in dba flatfile handler.
        alhudz

    • dom

      • Fixed bug GH-22570 (Stack overflow when serializing a deeply nested Dom\XMLDocument).
        iliaal
      • Fixed getElementsByClassName() item() returning the wrong element on random access.
        David Carlier

    • exif

      • Fixed bug GH-11020 (exif_read_data() emits a spurious "Illegal IFD size" warning when an IFD is not followed by a next-IFD offset).
        Eyüp Can Akman

    • gd

      • Upgrade libgd. (CVE-2026-9672)
        Pierre Joye

    • hash

      • Fixed bug GH-18173 (ext/hash relies on implementation-defined malloc alignment).
        iliaal

    • odbc

      • Fixed bug GH-22668 (Heap buffer over-read when a column value exceeds the driver-reported display size).
        iliaal

    • opcache

      • Fixed bug GH-22158 (Tracing JIT dispatches the observer begin handler through the wrong run_time_cache slot on megamorphic calls).
        ptondereau
        iliaal
      • Fixed bug GH-22443 (Tracing JIT SIGSEGV on megamorphic dynamic calls from an undereferenced run_time_cache map_ptr offset).
        iliaal
      • Fixed bug GH-21770 (Infinite recursion in property hook getter in opcache preloaded trait).
        iliaal

    • openssl

      • Fixed timeout for supplemental read at end of a blocking stream in SSL stream wrapper.
        ilutov

    • intl

      • Fixed Locale::lookup() and locale_lookup() to return NULL instead of the fallback locale when a language tag cannot be canonicalized.
        Weilin Du
      • Fixed memory leaks when calling Collator::__construct() or Spoofchecker::__construct() twice.
        Weilin Du
      • Fixed memory leak when calling IntlListFormatter::__construct() twice.
        Weilin Du
      • Fixed IntlChar methods leaving stale global error state after successful calls.
        Xuyang Zhang

    • pdo_odbc

      • Fixed bug GH-20726 (Crash with ODBC connection pooling when the DSN carries no credentials).
        iliaal
      • Fixed bug GH-22667 (Heap buffer over-read when a column value exceeds the driver-reported display size).
        iliaal
      • Fixed bug GH-22666 (Heap buffer overflow when an output parameter value is longer than the declared maxlen).
        iliaal
      • Fixed bug GH-22665 (Out-of-bounds write when the ODBC driver reports a diagnostic message length beyond the error buffer).
        iliaal

    • pgsql

      • Fixed GHSA-7qpv-r5mr-78m4 (SQL injection via E'...' backslash breakout). (CVE-2026-17543)
        ilutov

    • phar

      • Fixed inconsistent handling of the magic ".phar" directory. Paths such as "/.phar" remain protected, while non-magic paths that merely start with ".phar" are handled consistently across file and directory creation, copying, ArrayAccess, stream lookup, directory iteration and extraction.
        Weilin Du
      • Fixed GHSA-vc5h-9ppw-p5f3 (Crash via recursive symlinks). (CVE-2026-7260)
        Jakub Zelenka

    • phpdbg

      • Fixed bug GH-17387 (Trivial crash in phpdbg lexer).
        iliaal
      • Fixed fleaked lowercased lookup keys in phpdbg_resolve_opline_break.
        jorgsowa
      • Fixed off-by-one in phpdbg_safe_class_lookup() causing class lookups to always fail during phpdbg's signal-safe interruption path.
        jorgsowa

    • reflection

      • Fixed bug GH-22324 (Ignore leading namespace separator in ReflectionParameter::__construct()).
        jorgsowa
      • Fixed bug GH-22441 (ReflectionClass::hasProperty() and getProperty() ignore dynamic properties shadowing a private parent property).
        iliaal
      • Fixed bug GH-22658 (ReflectionConstant::__toString() with a string value with null bytes truncates output).
        DanielEScherzer
      • Fixed bug GH-22683 (Reflection(Class)Constant::__toString() should not warn on NAN conversions).
        Khaled Alam
      • Fixed bug GH-22681 (Reflection*::__toString() truncates on null bytes).
        DanielEScherzer

    • session

      • Fixed bug GH-21314 (Different session garbage collector behavior between PHP 8.3 and PHP 8.5).
        jorgsowa

    • spl

      • Fix class_parents for classes with leading slash in non-autoload mode.
        jorgsowa
      • Ignore leading back-slash in class_parents(), class_implements(), and class_uses().
        jorgsowa
      • Fixed bug GH-16217 (SplFileObject::fputcsv() on an uninitialized object segfaults).
        iliaal

    • standard

      • Fixed bug GH-22395 (base_convert() outputs at most 64 characters).
        Weilin Du
      • Fixed bug GH-22678 (Use-after-free in array_multisort() when the comparator mutates the array being sorted).
        azchin
        iliaal

    • uri

      • Fixed behavior of Uri\WhatWg\Url wither methods with regards to empty opaque hosts.
        kocsismate
      • Fixed bug GH-22628 (Percent-encoding of caret in WHATWG URL paths is not performed).
        kocsismate
      • Fixed bug GH-22629 (WHATWG Validation error incorrect with empty host and non-empty userinfo).
        kocsismate

    • zip

      • Fixed bug GH-22649 (ZipArchive::setCommentName() and setCommentIndex() could crash after overwriting an entry and resetting its inherited unchanged comment).
        Weilin Du
      • Fixed bug GH-21705 (ZipArchive::getFromIndex() ignores ZipArchive::FL_UNCHANGED for deleted entries).
        Weilin Du

  • PHP 8.5.8

    02 Jul, 2026
    View Release Page

    • core

      • Fixed bug GH-22280 (Incorrect compile error for goto to label preceding try/finally block).
        Pratik Bhujel
      • Fixed bug GH-22112 (Assertion when error handler throws during NaN to bool/string coercion).
        iliaal

    • bcmath

      • Fixed issues with oversized allocations and signed overflow in bcround() and BcMath\Number::round().
        edorian

    • date

      • Fix incorrect recurrence check of DatePeriod::createFromISO8601String().
        ndossche

    • exif

      • Read correct value for single and double tags.
        ndossche

    • gd

      • Fixed bug GH-22121 (Double free in gdImageSetStyle() after overflow-triggered early return).
        iliaal

    • intl

      • Fix incorrect argument positions for invalid start/end arguments in transliterator_transliterate().
        Weilin Du
      • Fixed IntlTimeZone::getDisplayName() to synchronize object error state for invalid display types.
        Weilin Du

    • lexbor

      • Merge patch c3a6847.
        ilutov
        timwolla

    • opcache

      • Fixed bug GH-22265 (Another tailcall vm_interrupt bug).
        Levi Morrison
      • Fixed bug GH-20469 (Unsafe inheritance cache replay with reentrant autoloading).
        Levi Morrison
      • Fixed bug GH-21972 (Corrupted variable type when a typed by-value return contains a reference wrapper).
        Weilin Du

    • openssl

      • Fixed bug GH-22187 (Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD). (CVE-2026-14355)
        David Carlier

    • phar

      • Fixed a bypass of the magic ".phar" directory protection in Phar::addEmptyDir() for paths starting with "/.phar", while allowing non-magic directory names that merely share the ".phar" prefix.
        Weilin Du
      • Fixed an integer underflow when parsing ZIP extra fields.
        Weilin Du

    • reflection

      • Preserve class-name case in ReflectionClass::getProperty() error messages and autoloading.
        jorgsowa

    • soap

      • Fixed bug GH-22218 (SoapServer::handle() crash on $_SERVER not being an array).
        David Carlier / Rex-Reynolds
      • Fixed bug GH-22285 (Soap server requires the raw input to be passed to $server->handle).
        David Carlier / ndossche

    • sqlite

      • Fix error checks for column retrieval.
        ndossche

    • uri

      • Add LEXBOR_STATIC to CFLAGS_URI on Windows so ext/uri does not see LXB_API as __declspec(dllimport) when linked statically into PHP.
        Luther Monson
      • Clean error logs before each Uri\WhatWg\Url wither call so that errors from previous wither calls are not returned the next time a UrlValidationError is thrown.
        kocsismate

    • zip

      • Fixed error-related memory leaks.
        ndossche

    • zlib

      • Fixed memory leak if deflate initialization fails and there is a dict.
        ndossche
      • Fixed memory leak in inflate_add().
        ndossche

  • PHP 8.5.7

    04 Jun, 2026
    View Release Page

    • cli

      • Fixed bug GH-21901 (Stale getopt() optional value).
        onthebed

    • core

      • Fixed bug GH-22071 (JIT assertion on abstract static method call).
        David Carlier

    • date

      • Fixed bug GH-18422 (int overflow in php_date_llabs).
        iliaal

    • dom

      • Fixed bug GH-22077 (UAF in custom XPath function).
        afflerbach/David Carlier

    • opcache

      • Fixed tracing JIT crash when a VM interrupt is handled during an observed user function call.
        Levi Morrison
      • Fixed bug GH-21746 (Segfault with tracing JIT).
        Arnaud
      • Fixed bug GH-22004 (Assertion failure at ext/opcache/jit/zend_jit_trace.c).
        Arnaud
      • Fixed tailcall VM crash when a VM interrupt is handled from a VM helper.
        Levi Morrison
        Arnaud

    • openssl

      • Fix compatibility issues with OpenSSL 4.0.
        jordikroon
        Remi

    • standard

      • Fixed bug GH-21689 (version_compare() incorrectly handles versions ending with a dot).
        timwolla

    • uri

      • Fixed CVE-2026-44927 (In uriparser before 1.0.2, there is pointer difference truncation to int in various places). (CVE-2026-44927)
        Sebastian Pipping
      • Fixed CVE-2026-44928 (In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal). (CVE-2026-44928)
        Sebastian Pipping

  • PHP 8.5.6

    07 May, 2026
    View Release Page

    • core

      • Fixed bug GH-19983 (GC assertion failure with fibers, generators and destructors).
        iliaal
      • Fixed ZEND_API mismatch on zend_ce_closure forward decl for Windows+Clang.
        henderkes
      • Fixed bug GH-21504 (Incorrect RC-handling for ZEND_EXT_STMT op1).
        ilutov
      • Fixed bug GH-21478 (Forward property operations to real instance for initialized lazy proxies).
        iliaal
      • Fixed bug GH-21605 (Missing addref for Countable::count()).
        ilutov
      • Fixed bug GH-21699 (Assertion failure in shutdown_executor when resolving self::/parent::/static:: callables if the error handler throws).
        macoaure
      • Fixed bug GH-21603 (Missing addref for __unset).
        ilutov
      • Fixed bug GH-21760 (Trait with class constant name conflict against enum case causes SEGV).
        Pratik Bhujel

    • cli

      • Fixed bug GH-21754 (`--rf` command line option with a method triggers ext/reflection deprecation warnings).
        DanielEScherzer

    • curl

      • Add support for brotli and zstd on Windows.
        Shivam Mathur

    • dom

      • Fixed GHSA-4jhr-8w89-j733 and GH-21566 (Dom\XMLDocument::C14N() emits duplicate xmlns declarations after setAttributeNS()). (CVE-2026-7263)
        David Carlier

    • fpm

    • iconv

      • Fixed bug GH-17399 (iconv memory leak on bailout).
        iliaal

    • lexbor

      • Upgrade to lexbor v2.7.0.
        CVE-2026-29078
        CVE-2026-29079) (ndossche
        ilutov

    • mbstring

      • Fixed GHSA-wm6j-2649-pv75 (Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()). (CVE-2026-7259)
        vi3tL0u1s
      • Fixed GHSA-74r9-qxhc-fx53 (Out-of-bounds access in mbfl_name2encoding_ex()). (CVE-2026-6104)
        ilutov

    • opcache

      • Fixed bug GH-21158 (JIT: Assertion jit->ra[var].flags & (1<<0) failed in zend_jit_use_reg).
        Arnaud
      • Fixed bug GH-21593 (Borked function JIT JMPNZ smart branch).
        ilutov
      • Fixed bug GH-21460 (COND optimization regression).
        Dmitry
        Arnaud
      • Fixed faulty returns out of zend_try block in zend_jit_trace().
        ilutov

    • openssl

      • Fix memory leak regression in openssl_pbkdf2().
        ndossche
      • Fix a bunch of memory leaks and crashes on edge cases.
        ndossche

    • pdo_firebird

      • Fixed GHSA-w476-322c-wpvm (SQL injection via NUL bytes in quoted strings). (CVE-2025-14179)
        SakiTakamachi

    • pdo_pgsql

      • Fixed bug GH-21683 (pdo_pgsql throws with ATTR_PREFETCH=0 on empty result set).
        thomasschiet

    • phar

      • Restore is_link handler in phar_intercept_functions_shutdown.
        iliaal
      • Fixed bug GH-21797 (phar: NULL dereference in Phar::webPhar() when SCRIPT_NAME is absent from SAPI environment).
        iliaal
      • Fix memory leak in Phar::offsetGet().
        iliaal
      • Fix memory leak in phar_add_file().
        iliaal
      • Fixed bug GH-21799 (phar: propagate phar_stream_flush return value from phar_stream_close).
        iliaal
      • Fix memory leak in phar_verify_signature() when md_ctx is invalid.
        JarneClauw

    • random

      • Fixed bug GH-21731 (Random\Engine\Xoshiro256StarStar::__unserialize() accepts all-zero state).
        iliaal

    • session

      • Fixed memory leak when session GC callback return a refcounted value.
        jorgsowa

    • soap

      • Fixed GHSA-85c2-q967-79q5 (Stale SOAP_GLOBAL(ref_map) pointer with Apache Map). (CVE-2026-6722)
        ilutov
      • Fixed GHSA-m33r-qmcv-p97q (Use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION). (CVE-2026-7261)
        ilutov
      • Fixed GHSA-hmxp-6pc4-f3vv (Broken Apache map value NULL check). (CVE-2026-7262)
        ilutov

    • spl

      • Fixed bug GH-21499 (RecursiveArrayIterator getChildren UAF after parent free).
        Girgias
      • Fix concurrent iteration and deletion issues in SplObjectStorage.
        ndossche

    • sqlite3

      • Fixed wrong free list comparator pointer type.
        David Carlier

    • standard

      • Fixed GHSA-96wq-48vp-hh57 (Signed integer overflow of char array offset). (CVE-2026-7568)
        TimWolla
      • Fixed GHSA-m8rr-4c36-8gq4 (Consistently pass unsigned char to ctype.h functions). (CVE-2026-7258)
        ilutov

    • streams

      • Fixed bug GH-21468 (Segfault in file_get_contents w/ a https URL and a proxy set). (CVE-2026-12184)
        ndossche

    • uri

      • Fixed CVE-2026-42371 (uriparser before 1.0.1 has numeric truncation in text range comparison). (CVE-2026-42371)
        Joshua W. Windle

  • PHP 8.5.5

    09 Apr, 2026
    View Release Page

    • core

      • Fixed bug GH-20672 (Incorrect property_info sizing for locally shadowed trait properties).
        ilutov
      • Fixed bugs GH-20875, GH-20873, GH-20854 (Propagate IN_GET guard in get_property_ptr_ptr for lazy proxies).
        iliaal

    • bz2

      • Fix truncation of total output size causing erroneous errors.
        ndossche

    • dom

      • Fixed bug GH-21486 (Dom\HTMLDocument parser mangles xml:space and xml:lang attributes).
        ndossche

    • ffi

      • Fixed resource leak in FFI::cdef() onsymbol resolution failure.
        David Carlier

    • gd

      • Fixed bug GH-21431 (phpinfo() to display libJPEG 10.0 support).
        David Carlier

    • opcache

      • Fixed bug GH-21052 (Preloaded constant erroneously propagated to file-cached script).
        ilutov
      • Fixed bug GH-20838 (JIT compiler produces wrong arithmetic results).
        Dmitry
        iliaal
      • Fixed bug GH-21267 (JIT tracing: infinite loop on FETCH_OBJ_R with IS_UNDEF property in polymorphic context).
        Dmitry
        iliaal
      • Fixed bug GH-21395 (uaf in jit).
        ndossche

    • openssl

      • Fixed bug GH-21083 (Skip private_key_bits validation for EC/curve-based keys).
        iliaal
      • Fix missing error propagation for BIO_printf() calls.
        ndossche

    • pcntl

      • Fixed signal handler installation on AIX by bumping the storage size of the num_signals global.
        Calvin Buckley

    • pcre

      • Fixed re-entrancy issue on php_pcre_match_impl, php_pcre_replace_impl, php_pcre_split_impl, and php_pcre_grep_impl.
        David Carlier

    • phar

      • Fixed bug GH-21333 (use after free when unlinking entries during iteration of a compressed phar).
        David Carlier

    • snmp

      • Fixed bug GH-21336 (SNMP::setSecurity() undefined behavior with NULL arguments).
        David Carlier

    • soap

      • Fixed Set-Cookie parsing bug wrong offset while scanning attributes.
        David Carlier

    • spl

      • Fixed bug GH-21454 (missing write lock validation in SplHeap).
        ndossche

    • standard

      • Fixed bug GH-20906 (Assertion failure when messing up output buffers).
        ndossche
      • Fixed bug GH-20627 (Cannot identify some avif images with getimagesize).
        y-guyon
      • Fixed bug GH-22171 (Invalid auth header generation in http(s) stream wrapper).
        David Carlier

    • sysvshm

      • Fix memory leak in shm_get_var() when variable is corrupted.
        ndossche

    • xsl

      • Fix GH-21357 (XSLTProcessor works with DOMDocument, but fails with Dom\XMLDocument).
        ndossche
      • Fixed bug GH-21496 (UAF in dom_objects_free_storage).
        David Carlier/ndossche

  • PHP 8.5.4

    12 Mar, 2026
    View Release Page

    • core

      • Fixed bug GH-21029 (zend_mm_heap corrupted on Aarch64, LTO builds).
        Arnaud
      • Fixed bug GH-21059 (Segfault when preloading constant AST closure).
        ilutov
      • Fixed bug GH-21072 (Crash on (unset) cast in constant expression).
        arshidkv12
      • Fix deprecation now showing when accessing null key of an array with JIT.
        alexandre-daubois
      • Fixed bug GH-20657 (Assertion failure in zend_lazy_object_get_info triggered by setRawValueWithoutLazyInitialization() and newLazyGhost()).
        Arnaud
      • Fixed bug GH-20504 (Assertion failure in zend_get_property_guard when accessing properties on Reflection LazyProxy via isset()).
        Arnaud
      • Fixed OSS-Fuzz #478009707 (Borked assign-op/inc/dec on untyped hooked property backing value).
        ilutov
      • Fixed bug GH-21215 (Build fails with -std=).
        Arnaud
      • Fixed bug GH-13674 (Build system installs libtool wrappers when using slibtool).
        Michael Orlitzky

    • curl

      • Don't truncate length.
        ndossche

    • date

      • Fixed bug GH-20936 (DatePeriod::__set_state() cannot handle null start).
        ndossche
      • Fix timezone offset with seconds losing precision.
        ndossche

    • dom

      • Fixed bug GH-21077 (Accessing Dom\Node::baseURI can throw TypeError).
        ndossche
      • Fixed bug GH-21097 (Accessing Dom\Node properties can can throw TypeError).
        ndossche

    • ldap

      • Fixed bug GH-21262 (ldap_modify() too strict controls argument validation makes it impossible to unset attribute).
        David Carlier

    • mbstring

      • Fixed bug GH-21223; mb_guess_encoding no longer crashes when passed huge list of candidate encodings (with 200,000+ entries).
        Jordi Kroon

    • opcache

      • Fixed bug GH-20718 ("Insufficient shared memory" when using JIT on Solaris).
        Petr Sumbera
      • Fixed bug GH-21227 (Borked SCCP of array containing partial object).
        ilutov

    • openssl

      • Fix a bunch of leaks and error propagation.
        ndossche

    • windows

      • Fixed compilation with clang (missing intrin.h include).
        Kévin Dunglas

  • PHP 8.5.3

    12 Feb, 2026
    View Release Page

    • core

      • Fixed bug GH-20806 (preserve_none feature compatiblity with LTO).
        henderkes
      • Fixed bug GH-20767 (build failure with musttail/preserve_none feature on macOs).
        David Carlier
      • Fixed bug GH-20837 (NULL dereference when calling ob_start() in shutdown function triggered by bailout in php_output_lock_error()).
        timwolla
      • Fix OSS-Fuzz #471533782 (Infinite loop in GC destructor fiber).
        ilutov
      • Fix OSS-Fuzz #472563272 (Borked block_pass JMP[N]Z optimization).
        ilutov
      • Fixed bug GH-20914 (Internal enums can be cloned and compared).
        Arnaud
      • Fix OSS-Fuzz #474613951 (Leaked parent property default value).
        ilutov
      • Fixed bug GH-20895 (ReflectionProperty does not return the PHPDoc of a property if it contains an attribute with a Closure).
        timwolla
      • Fixed bug GH-20766 (Use-after-free in FE_FREE with GC interaction).
        Bob
      • Fix OSS-Fuzz #471486164 (Broken by-ref assignment to uninitialized hooked backing value).
        ilutov
      • Fix OSS-Fuzz #438780145 (Nested finally with repeated return type check may uaf).
        ilutov
      • Fixed bug GH-20905 (Lazy proxy bailing __clone assertion).
        ilutov
      • Fixed bug GH-20479 (Hooked object properties overflow).
        ndossche

    • date

      • Update timelib to 2022.16.
        Derick

    • dom

      • Fixed GH-21041 (Dom\HTMLDocument corrupts closing tags within scripts).
        lexborisov

    • mbstring

      • Fixed bug GH-20833 (mb_str_pad() divide by zero if padding string is invalid in the encoding).
        ndossche
      • Fixed bug GH-20836 (Stack overflow in mb_convert_variables with recursive array references).
        alexandre-daubois

    • opcache

      • Fixed bug GH-20818 (Segfault in Tracing JIT with object reference).
        khasinski

    • openssl

      • Fix memory leaks when sk_X509_new_null() fails.
        ndossche
      • Fix crash when in openssl_x509_parse() when i2s_ASN1_INTEGER() fails.
        ndossche
      • Fix crash in openssl_x509_parse() when X509_NAME_oneline() fails.
        ndossche

    • phar

      • Fixed bug GH-20882 (buildFromIterator breaks with missing base directory).
        ndossche

    • pgsql

      • Fixed INSERT/UPDATE queries building with PQescapeIdentifier() and possible UB.
        David Carlier

    • readline

      • Fixed bug GH-18139 (Memory leak when overriding some settings via readline_info()).
        ndossche

    • spl

      • Fixed bug GH-20856 (heap-use-after-free in SplDoublyLinkedList iterator when modifying during iteration).
        ndossche

    • standard

      • Fixed bug #74357 (lchown fails to change ownership of symlink with ZTS) (Jakub Zelenka)
      • Fixed bug GH-20843 (var_dump() crash with nested objects) (David Carlier)

  • PHP 8.5.2

    15 Jan, 2026
    View Release Page

    • core

      • Fix OSS-Fuzz #465488618 (Wrong assumptions when dumping function signature with dynamic class const lookup default argument).
        ilutov
      • Fixed bug GH-20695 (Assertion failure in normalize_value() when parsing malformed INI input via parse_ini_string()).
        ndossche
      • Fixed bug GH-20714 (Uncatchable exception thrown in generator).
        ilutov
      • Fixed bug GH-20352 (UAF in php_output_handler_free via re-entrant ob_start() during error deactivation).
        ndossche
      • Fixed bug GH-20745 ("Casting out of range floats to int" applies to strings).
        Bob

    • dom

      • Fixed bug GH-20722 (Null pointer dereference in DOM namespace node cloning via clone on malformed objects).
        ndossche
      • Fixed bug GH-20444 (Dom\XMLDocument::C14N() seems broken compared to DOMDocument::C14N()).
        ndossche

    • exif

      • Fixed bug GH-20631 (Integer underflow in exif HEIF parsing when pos.size < 2).
        Oblivionsage

    • intl

      • Fixed IntlListFormatter::getErrorCode() and getErrorMessage() not reflecting format() failures.
        Weilin Du
      • Fix leak in umsg_format_helper().
        ndossche

    • ldap

      • Fix memory leak in ldap_set_options().
        ndossche

    • lexbor

      • Fixed bug GH-20668 (\Uri\WhatWg\Url::withHost() crashes (SEGV) for URLs using the file: scheme).
        lexborisov

    • mbstring

      • Fixed bug GH-20674 (mb_decode_mimeheader does not handle separator).
        Yuya Hamada

    • openssl

      • Fixed bug GH-20802 (undefined behavior with invalid SNI_server_certs options).
        David Carlier

    • pcntl

      • Fixed bug with pcntl_getcpuaffinity() on solaris regarding invalid process ids handling.
        David Carlier

    • phar

      • Fixed bug GH-20732 (Phar::LoadPhar undefined behavior when reading fails).
        ndossche
      • Fix SplFileInfo::openFile() in write mode.
        ndossche
      • Fix build on legacy OpenSSL 1.1.0 systems.
        Giovanni Giacobbi
      • Fixed bug #74154 (Phar extractTo creates empty files).
        ndossche

    • session

      • Fix support for MM module.
        Michael Orlitzky

    • sqlite3

      • Fixed bug GH-20699 (SQLite3Result fetchArray return array|false, null returned).
        ndossche
        plusminmax

    • standard

      • Fix error check for proc_open() command.
        ndossche
      • Fix memory leak in mail() when header key is numeric.
        Girgias
      • Fixed bug GH-20582 (Heap Buffer Overflow in iptcembed).
        ndossche

    • uri

      • Fixed bug GH-20771 (Assertion failure when getUnicodeHost() returns empty string).
        ndossche

    • zlib

      • Fix OOB gzseek() causing assertion failure.
        ndossche

  • PHP 8.5.1

    18 Dec, 2025
    View Release Page

    • core

      • Sync all boost.context files with release 1.86.0.
        mvorisek
      • Fixed bug GH-20435 (SensitiveParameter doesn't work for named argument passing to variadic parameter).
        ndossche
      • Fixed bug GH-20546 (preserve_none attribute configure check on macOs issue).
        David Carlier/cho-m
      • Fixed bug GH-20286 (use-after-destroy during userland stream_close()).
        ndossche
        David Carlier

    • bz2

      • Fix assertion failures resulting in crashes with stream filter object parameters.
        ndossche

    • dom

      • Fix memory leak when edge case is hit when registering xpath callback.
        ndossche
      • Fixed bug GH-20395 (querySelector and querySelectorAll requires elements in $selectors to be lowercase).
        ndossche
      • Fix missing NUL byte check on C14NFile().
        ndossche

    • fibers

      • Fixed bug GH-20483 (ASAN stack overflow with fiber.stack_size INI small value).
        David Carlier

    • intl

      • Fixed bug GH-20426 (Spoofchecker::setRestrictionLevel() error message suggests missing constants).
        DanielEScherzer

    • lexbor

      • Fixed bug GH-20501 (\Uri\WhatWg\Url lose host after calling withPath() or withQuery()).
        lexborisov
      • Fixed bug GH-20502 (\Uri\WhatWg\Url crashes (SEGV) when parsing malformed URL due to Lexbor memory corruption).
        lexborisov

    • libxml

      • Fix some deprecations on newer libxml versions regarding input buffer/parser handling.
        ndossche

    • mysqli

      • Make mysqli_begin_transaction() report errors properly.
        Kamil Tekiela

    • mysqlnd

      • Fixed bug GH-20528 (Regression breaks mysql connexion using an IPv6 address enclosed in square brackets).
        Remi

    • opcache

      • Fixed bug GH-20329 (opcache.file_cache broken with full interned string buffer).
        Arnaud

    • pdo

      • Fixed bug GH-20553 (PDO::FETCH_CLASSTYPE ignores $constructorArgs in PHP 8.5.0).
        Girgias
      • Fixed GHSA-8xr5-qppj-gvwj (PDO quoting result null deref). (CVE-2025-14180)
        Jakub Zelenka

    • phar

      • Fixed bug GH-20442 (Phar does not respect case-insensitiveness of __halt_compiler() when reading stub).
        ndossche
        TimWolla
      • Fix broken return value of fflush() for phar file entries.
        ndossche
      • Fix assertion failure when fseeking a phar file out of bounds.
        ndossche

    • phpdbg

      • Fixed ZPP type violation in phpdbg_get_executable() and phpdbg_end_oplog().
        Girgias

    • spl

      • Fixed bug GH-20614 (SplFixedArray incorrectly handles references in deserialization).
        ndossche

    • standard

      • Fix memory leak in array_diff() with custom type checks.
        ndossche
      • Fixed bug GH-20583 (Stack overflow in http_build_query via deep structures).
        ndossche
      • Fixed GHSA-www2-q4fc-65wf (Null byte termination in dns_get_record()).
        ndossche
      • Fixed GHSA-h96m-rvf9-jgm2 (Heap buffer overflow in array_merge()). (CVE-2025-14178)
        ndossche
      • Fixed GHSA-3237-qqm7-mfv7 (Information Leak of Memory in getimagesize). (CVE-2025-14177)
        ndossche

    • streams

      • Fixed bug GH-20370 (User stream filters could violate typed property constraints).
        alexandre-daubois

    • uri

      • Fixed bug GH-20366 (ext/uri incorrectly throws ValueError when encountering null byte).
        kocsismate
      • Fixed CVE-2025-67899 (uriparser through 0.9.9 allows unbounded recursion and stack consumption).
        Sebastian Pipping

    • xml

      • Fixed bug GH-20439 (xml_set_default_handler() does not properly handle special characters in attributes when passing data to callback).
        ndossche

    • zip

      • Fix crash in property existence test.
        ndossche
      • Don't truncate return value of zip_fread() with user sizes.
        ndossche

    • zlib

      • Fix assertion failures resulting in crashes with stream filter object parameters.
        ndossche

  • PHP 8.5.0

    20 Nov, 2025
    View Release Page

    • core

      • Added the #[\NoDiscard] attribute to indicate that a function's return value is important and should be consumed.
        timwolla
        edorian
      • Added the (void) cast to indicate that not using a value is intentional.
        timwolla
        edorian
      • Added get_error_handler(), get_exception_handler() functions.
        Arnaud
      • Added support for casts in constant expressions.
        nielsdos
      • Added the pipe (|>) operator.
        crell
      • Added support for `final` with constructor property promotion.
        DanielEScherzer
      • Added support for configuring the URI parser for the FTP/FTPS as well as the SSL/TLS stream wrappers as described in https://wiki.php.net/rfc/url_parsing_api#plugability.
        kocsismate
      • Added PHP_BUILD_PROVIDER constant.
        timwolla
      • Added PHP_BUILD_DATE constant.
        cmb
      • Added support for Closures and first class callables in constant expressions.
        timwolla
        edorian
      • Add support for backtraces for fatal errors.
        enorris
      • Add clone-with support to the clone() function.
        timwolla
        edorian
      • Add RFC 3986 and WHATWG URL compliant APIs for URL parsing and manipulation (kocsismate, timwolla)
      • Fixed AST printing for immediately invoked Closure.
        Dmitrii Derepko
      • Properly handle __debugInfo() returning an array reference.
        nielsdos
      • Properly handle reference return value from __toString().
        nielsdos
      • Improved error message of UnhandledMatchError for zend.exception_string_param_max_len=0.
        timwolla
      • Fixed bug GH-15753 and GH-16198 (Bind traits before parent class).
        ilutov
      • Fixed bug GH-17951 (memory_limit is not always limited by max_memory_limit).
        manuelm
      • Fixed bug GH-20183 (Stale EG(opline_before_exception) pointer through eval).
        ilutov
      • Fixed bug GH-20113 (Missing new Foo(...) error in constant expressions).
        ilutov
      • Fixed bug GH-19844 (Don't bail when closing resources on shutdown).
        ilutov
      • Fixed bug GH-20177 (Accessing overridden private property in get_object_vars() triggers assertion error).
        ilutov
      • Fix OSS-Fuzz #447521098 (Fatal error during sccp shift eval).
        ilutov
      • Fixed bug GH-20002 (Broken build on *BSD with MSAN).
        outtersg
      • Fixed bug GH-19352 (Cross-compilation with musl C library).
        henderkes
        Peter Kokot
      • Fixed bug GH-19765 (object_properties_load() bypasses readonly property checks).
        timwolla
      • Fixed hard_timeout with --enable-zend-max-execution-timers.
        Appla
      • Fixed bug GH-19839 (Incorrect HASH_FLAG_HAS_EMPTY_IND flag on userland array).
        ilutov
      • Fixed bug GH-19823 (register_argc_argv deprecation emitted twice when using OPcache).
        timwolla
      • Fixed bug GH-19480 (error_log php.ini cannot be unset when open_basedir is configured).
        nielsdos
      • Fixed bug GH-19719 (Allow empty statements before declare(strict_types)).
        nielsdos
      • Fixed bug GH-19934 (CGI with auto_globals_jit=0 causes uouv).
        ilutov
      • Fixed bug GH-19613 (Stale array iterator pointer).
        ilutov
      • Fixed bug GH-19679 (zend_ssa_range_widening may fail to converge).
        Arnaud
      • Fixed bug GH-19681 (PHP_EXPAND_PATH broken with bash 5.3.0).
        Remi
      • Fixed bug GH-18850 (Repeated inclusion of file with __halt_compiler() triggers "Constant already defined" warning).
        ilutov
      • Fixed bug GH-19476 (pipe operator fails to correctly handle returning by reference).
        alexandre-daubois
      • Fixed bug GH-19081 (Wrong lineno in property error with constructor property promotion).
        ilutov
      • Fixed bug GH-17959 (Relax missing trait fatal error to error exception).
        ilutov
      • Fixed bug GH-18033 (NULL-ptr dereference when using register_tick_function in destructor).
        nielsdos
      • Fixed bug GH-18026 (Improve "expecting token" error for ampersand).
        ilutov
      • The report_memleaks INI directive has been deprecated.
        alexandre-daubois
      • Fixed OSS-Fuzz #439125710 (Pipe cannot be used in write context).
        nielsdos
      • Fixed bug GH-19548 (Shared memory violation on property inheritance).
        alexandre-daubois
      • Fixed bug GH-19544 (GC treats ZEND_WEAKREF_TAG_MAP references as WeakMap references).
        Arnaud
        timwolla
      • Fixed bug GH-18373 (Don't substitute self/parent with anonymous class).
        ilutov
      • Fix support for non-userland stream notifiers.
        timwolla
      • Fixed bug GH-19305 (Operands may be being released during comparison).
        Arnaud
      • Fixed bug GH-19306 (Generator can be resumed while fetching next value from delegated Generator).
        Arnaud
      • Fixed bug GH-19326 (Calling Generator::throw() on a running generator with a non-Generator delegate crashes).
        Arnaud
      • Fix OSS-Fuzz #427814452 (pipe compilation fails with assert).
        nielsdos
        ilutov
      • Fixed bug GH-16665 (\array and \callable should not be usable in class_alias).
        nielsdos
      • Use `clock_gettime_nsec_np()` for high resolution timer on macOS if available.
        timwolla
      • Make `clone()` a function.
        timwolla
        edorian
      • Introduced the TAILCALL VM, enabled by default when compiling with Clang>=19 on x86_64 or aarch64.
        Arnaud
      • Enacted the follow-up phase of the "Path to Saner Increment/Decrement operators" RFC, meaning that incrementing non-numeric strings is now deprecated. (Girgias).
      • Various closure binding issues are now deprecated.
        alexandre-daubois
      • Constant redeclaration has been deprecated.
        alexandre-daubois
      • Marks the stack as non-executable on Haiku.
        David Carlier
      • Deriving $_SERVER['argc'] and $_SERVER['argv'] from the query string is now deprecated.
        timwolla
        nicolasgrekas
      • Using null as an array offset or when calling array_key_exists() is now deprecated.
        alexandre-daubois
      • The disable_classes INI directive has been removed.
        Girgias
      • The locally predefined variable $http_response_header is deprecated.
        Girgias
      • Non-canonical cast names (boolean), (integer), (double), and (binary) have been deprecated.
        Girgias
      • The $exclude_disabled parameter of the get_defined_functions() function has been deprecated, as it no longer has any effect since PHP 8.0.
        Girgias
      • Terminating case statements with a semicolon instead of a colon has been deprecated.
        theodorejb
      • The backtick operator as an alias for shell_exec() has been deprecated.
        timwolla
      • Returning null from __debugInfo() has been deprecated.
        DanielEScherzer
      • Support #[\Override] on properties.
        Jiří Pudil
      • Destructing non-array values (other than NULL) using [] or list() now emits a warning.
        Girgias
      • Casting floats that are not representable as ints now emits a warning.
        Girgias
      • Casting NAN to other types now emits a warning.
        Girgias
      • Implement GH-15680 (Enhance zend_dump_op_array to properly represent non-printable characters in string literals).
        nielsdos
        WangYihang
      • Fixed bug GH-17442 (Engine UAF with reference assign and dtor).
        nielsdos
      • Do not use RTLD_DEEPBIND if dlmopen is available.
        Daniil Gentili
      • Added #[\DelayedTargetValidation] attribute.
        DanielEScherzer
      • Support #[\Deprecated] on traits.
        DanielEScherzer

    • bcmath

      • Simplify `bc_divide()` code.
        SakiTakamachi
      • If the result is 0, n_scale is set to 0.
        SakiTakamachi
      • If size of BC_VECTOR array is within 64 bytes, stack area is now used.
        SakiTakamachi
      • Fixed bug GH-20006 (Power of 0 of BcMath number causes UB).
        nielsdos

    • bz2

      • Fixed bug GH-19810 (Broken bzopen() stream mode validation).
        ilutov

    • cli

      • Add --ini=diff to print INI settings changed from the builtin default.
        timwolla
      • Drop support for -z CLI/CGI flag.
        nielsdos
      • Fixed GH-17956 - development server 404 page does not adapt to mobiles.
        pascalchevrel
      • Fix useless "Failed to poll event" error logs due to EAGAIN in CLI server with PHP_CLI_SERVER_WORKERS.
        leotaku
      • Fixed bug GH-19461 (Improve error message on listening error with IPv6 address).
        alexandre-daubois

    • com

      • Fixed property access of PHP objects wrapped in variant.
        cmb
      • Fixed method calls for PHP objects wrapped in variant.
        cmb

    • curl

      • Added CURLFOLLOW_ALL, CURLFOLLOW_OBEYCODE and CURLFOLLOW_FIRSTONLY values for CURLOPT_FOLLOWLOCATION curl_easy_setopt option.
        David Carlier
      • Added curl_multi_get_handles().
        timwolla
      • Added curl_share_init_persistent().
        enorris
      • Added CURLINFO_USED_PROXY, CURLINFO_HTTPAUTH_USED, and CURLINFO_PROXYAUTH_USED support to curl_getinfo.
        Ayesh Karunaratne
      • Add support for CURLINFO_CONN_ID in curl_getinfo() (thecaliskan)
      • Add support for CURLINFO_QUEUE_TIME_T in curl_getinfo() (thecaliskan)
      • Add support for CURLOPT_SSL_SIGNATURE_ALGORITHMS.
        Ayesh Karunaratne
      • The curl_close() function has been deprecated.
        DanielEScherzer
      • The curl_share_close() function has been deprecated.
        DanielEScherzer
      • Fix cloning of CURLOPT_POSTFIELDS when using the clone operator instead of the curl_copy_handle() function to clone a CurlHandle.
        timwolla

    • date

      • Fix undefined behaviour problems regarding integer overflow in extreme edge cases.
        nielsdos
        cmb
        ilutov
      • The DATE_RFC7231 and DateTimeInterface::RFC7231 constants have been deprecated.
        jorgsowa
      • Fixed date_sunrise() and date_sunset() with partial-hour UTC offset.
        ilutov
      • Fixed GH-17159: "P" format for ::createFromFormat swallows string literals.
        nielsdos
      • The __wakeup() magic method of DateTimeInterface, DateTime, DateTimeImmutable, DateTimeZone, DateInterval, and DatePeriod has been deprecated in favour of the __unserialize() magic method.
        Girgias

    • dom

      • Added Dom\Element::$outerHTML.
        nielsdos
      • Added Dom\Element::insertAdjacentHTML().
        nielsdos
      • Added $children property to ParentNode implementations.
        nielsdos
      • Make cloning DOM node lists, maps, and collections fail.
        nielsdos
      • Added Dom\Element::getElementsByClassName().
        nielsdos
      • Fixed bug GH-18877 (\Dom\HTMLDocument querySelectorAll selecting only the first when using ~ and :has).
        nielsdos
        lexborisov
      • Fix getNamedItemNS() incorrect namespace check.
        nielsdos

    • enchant

      • Added enchant_dict_remove_from_session().
        nielsdos
      • Added enchant_dict_remove().
        nielsdos
      • Fix missing empty string checks.
        nielsdos

    • exif

      • Add OffsetTime* Exif tags.
        acc987
      • Added support to retrieve Exif from HEIF file.
        Benstone Zhang
      • Fix OSS-Fuzz #442954659 (zero-size box in HEIF file causes infinite loop).
        nielsdos
      • Fix OSS-Fuzz #442954659 (Crash in exif_scan_HEIF_header).
        nielsdos
      • Various hardening fixes to HEIF parsing.
        nielsdos

    • fileinfo

      • The finfo_close() function has been deprecated.
        timwolla
      • The $context parameter of the finfo_buffer() function has been deprecated as it is ignored.
        Girgias
      • Upgrade to file 5.46.
        nielsdos
      • Change return type of finfo_close() to true.
        timwolla

    • filter

      • Added support for configuring the URI parser for FILTER_VALIDATE_URL as described in https://wiki.php.net/rfc/url_parsing_api#plugability.
        kocsismate
      • Fixed bug GH-16993 (filter_var_array with FILTER_VALIDATE_INT|FILTER_NULL_ON_FAILURE should emit warning for invalid filter usage).
        alexandre-daubois
      • Added FILTER_THROW_ON_FAILURE flag.
        DanielEScherzer

    • fpm

      • Fixed bug GH-19817 (Decode SCRIPT_FILENAME issue in php 8.5).
        Jakub Zelenka
      • Fixed bug GH-19989 (PHP 8.5 FPM access log lines also go to STDERR).
        Jakub Zelenka
      • Fixed GH-17645 (FPM with httpd ProxyPass does not decode script path).
        Jakub Zelenka
      • Make FPM access log limit configurable using log_limit.
        Jakub Zelenka
      • Fixed failed debug assertion when php_admin_value setting fails.
        ilutov
      • Fixed GH-8157 (post_max_size evaluates .user.ini too late in php-fpm).
        Jakub Zelenka

    • gd

      • Fixed bug #68629 (Transparent artifacts when using imagerotate).
        pierre
        cmb
      • Fixed bug #64823 (ZTS GD fails to find system TrueType font).
        cmb
      • Fix incorrect comparison with result of php_stream_can_cast().
        Girgias
      • The imagedestroy() function has been deprecated.
        DanielEScherzer

    • iconv

      • Extends the ICONV_CONST preprocessor for illumos/solaris.
        jMichaelA

    • intl

      • Bumped ICU requirement to ICU >= 57.1.
        cmb
      • IntlDateFormatter::setTimeZone()/datefmt_set_timezone() throws an exception with uninitialised classes or clone failure.
        David Carlier
      • Added DECIMAL_COMPACT_SHORT/DECIMAL_COMPACT_LONG for NumberFormatter class.
        BogdanUngureanu
      • Added Locale::isRightToLeft to check if a locale is written right to left.
        David Carlier
      • Added null bytes presence in locale inputs for Locale class.
        David Carlier
      • Added grapheme_levenshtein() function.
        Yuya Hamada
      • Added Locale::addLikelySubtags/Locale::minimizeSubtags to handle adding/removing likely subtags to a locale.
        David Carlier
      • Added IntlListFormatter class to format a list of items with a locale, operands types and units.
        BogdanUngureanu
      • Added grapheme_strpos(), grapheme_stripos(), grapheme_strrpos(), grapheme_strripos(), grapheme_substr(), grapheme_strstr(), grapheme_stristr() and grapheme_levenshtein() functions add $locale parameter (Yuya Hamada).
      • Fixed bug GH-11952 (Fix locale strings canonicalization for IntlDateFormatter and NumberFormatter).
        alexandre-daubois
      • Fixed bug GH-18566 ([intl] Weird numeric sort in Collator).
        nielsdos
      • Fix return value on failure for resourcebundle count handler.
        Girgias
      • Fixed bug GH-19307 (PGO builds of shared ext-intl are broken).
        cmb
      • Intl's internal error mechanism has been modernized so that it indicates more accurately which call site caused what error. Moreover, some ext/date exceptions have been wrapped inside a IntlException now.
        Girgias
      • The intl.error_level INI setting has been deprecated.
        Girgias

    • ldap

      • Allow ldap_get_option to retrieve global option by allowing NULL for connection instance ($ldap).
        Remi

    • mbstring

      • Updated Unicode data tables to Unicode 17.0.
        Yuya Hamada

    • mysqli

      • Fixed bugs GH-17900 and GH-8084 (calling mysqli::__construct twice).
        nielsdos
      • The mysqli_execute() alias function has been deprecated.
        timwolla

    • mysqlnd

      • Added mysqlnd.collect_memory_statistics to ini quick reference.
        hauk92

    • odbc

      • Removed driver-specific build flags and support.
        Calvin Buckley
      • Remove ODBCVER and assume ODBC 3.5.
        Calvin Buckley

    • opcache

      • Make OPcache non-optional (Arnaud, timwolla)
      • Added opcache.file_cache_read_only.
        Samuel Melrose
      • Updated default value of opcache.jit_hot_loop.
        Arnaud
      • Log a warning when opcache lock file permissions could not be changed.
        Taavi Eomäe
      • Fixed bug GH-20012 (heap buffer overflow in jit).
        Arnaud
      • Partially fixed bug GH-17733 (Avoid calling wrong function when reusing file caches across differing environments).
        ilutov
      • Disallow changing opcache.memory_consumption when SHM is already set up.
        timwolla
      • Fixed bug GH-15074 (Compiling opcache statically into ZTS PHP fails).
        Arnaud
      • Fixed bug GH-17422 (OPcache bypasses the user-defined error handler for deprecations).
        Arnaud
        timwolla
      • Fixed bug GH-19301 (opcache build failure).
        Remi
      • Fixed bug GH-20081 (access to uninitialized vars in preload_load()).
        Arnaud
      • Fixed bug GH-20121 (JIT broken in ZTS builds on MacOS 15).
        Arnaud
        Shivam Mathur
      • Fixed bug GH-19875 (JIT 1205 segfault on large file compiled in subprocess).
        Arnaud
      • Fixed segfault in function JIT due to NAN to bool warning.
        Girgias
      • Fixed bug GH-19984 (Double-free of EG(errors)/persistent_script->warnings on persist of already persisted file).
        ilutov
        Arnaud
      • Fixed bug GH-19889 (race condition in zend_runtime_jit(), zend_jit_hot_func()).
        Arnaud
      • Fixed bug GH-19669 (assertion failure in zend_jit_trace_type_to_info_ex).
        Arnaud
      • Fixed bug GH-19831 (function JIT may not deref property value).
        Arnaud
      • Fixed bug GH-19486 (Incorrect opline after deoptimization).
        Arnaud
      • Fixed bug GH-19601 (Wrong JIT stack setup on aarch64/clang).
        Arnaud
      • Fixed bug GH-19388 (Broken opcache.huge_code_pages).
        Arnaud
      • Fixed bug GH-19657 (Build fails on non-glibc/musl/freebsd/macos/win platforms).
        Arnaud
      • Fixed ZTS OPcache build on Cygwin.
        cmb
      • Fixed bug GH-19493 (JIT variable not stored before YIELD).
        Arnaud

    • openssl

      • Added openssl.libctx INI that allows to select the OpenSSL library context type and convert various parts of the extension to use the custom libctx.
        Jakub Zelenka
      • Add $digest_algo parameter to openssl_public_encrypt() and openssl_private_decrypt() functions.
        Jakub Zelenka
      • Implement #81724 (openssl_cms_encrypt only allows specific ciphers).
        Jakub Zelenka
      • Implement #80495 (Enable to set padding in openssl_(sign|verify).
        Jakub Zelenka
      • Implement #47728 (openssl_pkcs7_sign ignores new openssl flags).
        Jakub Zelenka
      • Fixed bug GH-19994 (openssl_get_cipher_methods inconsistent with fetching).
        Jakub Zelenka
      • Fixed build when --with-openssl-legacy-provider set.
        Jakub Zelenka
      • Fixed bug GH-19369 (8.5 | Regression in openssl_sign() - support for alias algorithms appears to be broken).
        Jakub Zelenka
      • The $key_length parameter for openssl_pkey_derive() has been deprecated.
        Girgias

    • output

      • Fixed calculation of aligned buffer size.
        cmb

    • pcntl

      • Extend pcntl_waitid with rusage parameter.
        vrza

    • pcre

      • Remove PCRE2_EXTRA_ALLOW_LOOKAROUND_BSK from pcre compile options.
        mvorisek

    • pdo

      • Fixed bug GH-20095 (Incorrect class name in deprecation message for PDO mixins).
        timwolla
      • Driver specific methods and constants in the PDO class are now deprecated.
        Arnaud
      • The "uri:" DSN scheme has been deprecated due to security concerns with DSNs coming from remote URIs.
        timwolla

    • pdo_odbc

      • Fetch larger block sizes and better handle SQL_NO_TOTAL when calling SQLGetData.
        Calvin Buckley
        Saki Takamachi

    • pdo_pgsql

      • Added Iterable support for PDO::pgsqlCopyFromArray.
        KentarouTakeda
      • Implement GH-15387 Pdo\Pgsql::setAttribute(PDO::ATTR_PREFETCH, 0) or Pdo\Pgsql::prepare(…, [ PDO::ATTR_PREFETCH => 0 ]) make fetch() lazy instead of storing the whole result set in memory (Guillaume Outters)

    • pdo_sqlite

      • Add PDO\Sqlite::ATTR_TRANSACTION_MODE connection attribute.
        Samuel Štancl
      • Implement GH-17321: Add setAuthorizer to Pdo\Sqlite.
        nielsdos
      • PDO::sqliteCreateCollation now throws a TypeError if the callback has a wrong return type.
        David Carlier
      • Added Pdo_Sqlite::ATTR_BUSY_STATEMENT constant to check if a statement is currently executing.
        David Carlier
      • Added Pdo_Sqlite::ATTR_EXPLAIN_STATEMENT constant to set a statement in either EXPLAIN_MODE_PREPARED, EXPLAIN_MODE_EXPLAIN, EXPLAIN_MODE_EXPLAIN_QUERY_PLAN modes.
        David Carlier
      • Fix bug GH-13952 (sqlite PDO::quote silently corrupts strings with null bytes) by throwing on null bytes.
        divinity76

    • pgsql

      • Added pg_close_stmt to close a prepared statement while allowing its name to be reused.
        David Carlier
      • Added Iterable support for pgsql_copy_from.
        David Carlier
      • pg_connect checks if connection_string contains any null byte, pg_close_stmt check if the statement contains any null byte.
        David Carlier
      • Added pg_service to get the connection current service identifier.
        David Carlier
      • Fix segfaults when attempting to fetch row into a non-instantiable class name.
        Girgias
        nielsdos

    • phar

      • Fix potential buffer length truncation due to usage of type int instead of type size_t.
        Girgias
      • Fixed memory leaks when verifying OpenSSL signature.
        Girgias

    • posix

      • Added POSIX_SC_OPEN_MAX constant to get the number of file descriptors a process can handle.
        David Carlier
      • posix_ttyname() sets last_error to EBADF on invalid file descriptors, posix_isatty() raises E_WARNING on invalid file descriptors, posix_fpathconf checks invalid file descriptors.
        David Carlier
      • posix_kill and posix_setpgid throws a ValueError on invalid process_id.
        David Carlier
      • posix_setpgid throws a ValueError on invalid process_group_id, posix_setrlimit throws a ValueError on invalid soft_limit and hard_limit arguments.
        David Carlier

    • random

      • Moves from /dev/urandom usage to arc4random_buf on Haiku.
        David Carlier

    • reflection

      • Added ReflectionConstant::getExtension() and ::getExtensionName().
        DanielEScherzer
      • Added ReflectionProperty::getMangledName() method.
        alexandre-daubois
      • ReflectionConstant is no longer final.
        sasezaki
      • The setAccessible() methods of various Reflection objects have been deprecated, as those no longer have an effect.
        timwolla
      • ReflectionClass::getConstant() for constants that do not exist has been deprecated.
        DanielEScherzer
      • ReflectionProperty::getDefaultValue() for properties without default values has been deprecated.
        DanielEScherzer
      • Fixed bug GH-12856 (ReflectionClass::getStaticPropertyValue() returns UNDEF zval for uninitialized typed properties).
        nielsdos
      • Fixed bug GH-15766 (ReflectionClass::__toString() should have better output for enums).
        DanielEScherzer
      • Fix GH-19691 (getModifierNames() not reporting asymmetric visibility).
        DanielEScherzer
      • Fixed bug GH-17927 (Reflection: have some indication of property hooks in `_property_string()`).
        DanielEScherzer
      • Fixed bug GH-19187 (ReflectionNamedType::getName() prints nullable type when retrieved from ReflectionProperty::getSettableType()).
        ilutov
      • Fixed bug GH-20217 (ReflectionClass::isIterable() incorrectly returns true for classes with property hooks).
        alexandre-daubois

    • sapi

      • Fixed bug GH-18582 and #81451: http_response_code() does not override the status code generated by header().
        ilutov
        Jakub Zelenka

    • session

      • session_start() throws a ValueError on option argument if not a hashmap or a TypeError if read_and_close value is not compatible with int.
        David Carlier
      • Added support for partitioned cookies.
        nielsdos
      • Fix RC violation of session SID constant deprecation attribute.
        ilutov
      • Fixed GH-19197: build broken with ZEND_STRL usage with memcpy when implemented as macro.
        David Carlier

    • simplexml

      • Fixed bug GH-12231 (SimpleXML xpath should warn when returning other return types than node lists).
        nielsdos

    • snmp

      • snmpget, snmpset, snmp_get2, snmp_set2, snmp_get3, snmp_set3 and SNMP::__construct() throw an exception on invalid hostname, community timeout and retries arguments.
        David Carlier

    • soap

      • Added support for configuring the URI parser for SoapClient::__doRequest() as described in https://wiki.php.net/rfc/url_parsing_api#plugability.
        kocsismate
      • Implement request #55503 (Extend __getTypes to support enumerations).
        nielsdos
        datibbaw
      • Implement request #61105 (Support Soap 1.2 SoapFault Reason Text lang attribute).
        nielsdos
      • Fixed bug #49169 (SoapServer calls wrong function, although "SOAP action" header is correct).
        nielsdos
      • Fix namespace handling of WSDL and XML schema in SOAP, fixing at least GH-16320 and bug #68576.
        nielsdos
      • Fixed bug #70951 (Segmentation fault on invalid WSDL cache).
        nielsdos
      • Fixed bug GH-19773 (SIGSEGV due to uninitialized soap_globals->lang_en).
        nielsdos
        KaseyJenkins
      • Fixed bug GH-19226 (Segfault when spawning new thread in soap extension).
        Florian Engelhardt

    • sockets

      • Added IPPROTO_ICMP/IPPROTO_ICMPV6 to create raw socket for ICMP usage.
        David Carlier
      • Added TCP_FUNCTION_BLK to change the TCP stack algorithm on FreeBSD.
        David Carlier
      • Added IP_BINDANY for a socket to bind to any address.
        David Carlier
      • Added SO_BUSY_POOL to reduce packets poll latency.
        David Carlier
      • Added UDP_SEGMENT support to optimise multiple large datagrams over UDP if the kernel and hardware supports it.
        David Carlier
      • Added SHUT_RD, SHUT_WR and SHUT_RDWR constants for socket_shutdown().
        David Carlier
      • Added TCP_FUNCTION_ALIAS, TCP_REUSPORT_LB_NUMA, TCP_REUSPORT_LB_NUMA_NODOM, TCP_REUSPORT_LB_CURDOM, TCP_BBR_ALGORITHM constants.
      • socket_set_option() catches possible overflow with SO_RCVTIMEO/SO_SNDTIMEO with timeout setting on windows.
        David Carlier
      • socket_create_listen() throws an exception on invalid port value.
        David Carlier
      • socket_bind() throws an exception on invalid port value.
        David Carlier
      • socket_sendto() throws an exception on invalid port value.
        David Carlier
      • socket_addrinfo_lookup throws an exception on invalid hints value types.
        David Carlier
      • socket_addrinfo_lookup throws an exception if any of the hints value overflows.
        David Carlier
      • socket_addrinfo_lookup throws an exception if one or more hints entries has an index as numeric.
        David Carlier
      • socket_set_option with the options MCAST_LEAVE_GROUP/MCAST_LEAVE_SOURCE_GROUP will throw an exception if its value is not a valid array/object.
        David Carlier
      • socket_getsockname/socket_create/socket_bind handled AF_PACKET family socket.
        David Carlier
      • socket_set_option for multicast context throws a ValueError when the socket family is not of AF_INET/AF_INET6 family.
        David Carlier

    • sodium

      • Fix overall theoretical overflows on zend_string buffer allocations.
        David Carlier/nielsdos

    • spl

      • Fixed bug GH-20101 (SplHeap/SplPriorityQueue serialization exposes INDIRECTs).
        nielsdos
      • Improve __unserialize() hardening for SplHeap/SplPriorityQueue.
        nielsdos
      • Deprecate ArrayObject and ArrayIterator with objects.
        Girgias
      • Unregistering all autoloaders by passing the spl_autoload_call() function as a callback argument to spl_autoload_unregister() has been deprecated. Instead if this is needed, one should iterate over the return value of spl_autoload_functions() and call spl_autoload_unregister() on each value.
        Girgias
      • The SplObjectStorage::contains(), SplObjectStorage::attach(), and SplObjectStorage::detach() methods have been deprecated in favour of SplObjectStorage::offsetExists(), SplObjectStorage::offsetSet(), and SplObjectStorage::offsetUnset() respectively.
        Girgias

    • sqlite

      • Added Sqlite3Stmt::busy to check if a statement is still being executed.
        David Carlier
      • Added Sqlite3Stmt::explain to produce an explain query plan from the statement.
        David Carlier
      • Added Sqlite3Result::fetchAll to return all results at once from a query.
        David Carlier

    • standard

      • Add HEIF/HEIC support to getimagesize.
        Benstone Zhang
      • Added support for partitioned cookies.
        nielsdos
      • Implement #71517 (Implement SVG support for getimagesize() and friends).
        nielsdos
      • Implement GH-19188: Add support for new INI mail.cr_lf_mode.
        alexandre-daubois
      • Optimized PHP html_entity_decode function.
        Artem Ukrainskiy
      • Minor optimization to array_chunk().
        nielsdos
      • Optimized pack().
        nielsdos
        divinity76
      • Fixed crypt() tests on musl when using --with-external-libcrypt (Michael Orlitzky).
      • Fixed bug GH-18062 (is_callable(func(...), callable_name: $name) for first class callables returns wrong name).
        timwolla
      • Added array_first() and array_last().
        nielsdos
      • Fixed bug GH-18823 (setlocale's 2nd and 3rd argument ignores strict_types).
        nielsdos
      • Fixed exit code handling of sendmail cmd and added warnings.
        Jesse Hathaway
      • Fixed bug GH-18897 (printf: empty precision is interpreted as precision 6, not as precision 0).
        nielsdos
      • Fixed bug GH-20257 (mail() heap overflow with an empty message in lf mode).
        David Carlier
      • Fixed bug GH-20201 (AVIF images misdetected as HEIF after introducing HEIF support in getimagesize()).
        nielsdos
      • Fixed bug GH-19926 (reset internal pointer earlier while splicing array while COW violation flag is still set).
        alexandre-daubois
      • Fixed bug GH-19801 (leaks in var_dump() and debug_zval_dump()).
        alexandre-daubois
      • Fixed GH-14402 (SplPriorityQueue, SplMinHeap, and SplMaxHeap lost their data on serialize()).
        alexandre-daubois
      • Fixed GH-19610 (Deprecation warnings in functions taking as argument).
        Girgias
      • Fixed bug GH-19577 (Avoid integer overflow when using a small offset and PHP_INT_MAX with LimitIterator).
        alexandre-daubois
      • Fixed bug GH-19153 (#[\Attribute] validation should error on trait/interface/enum/abstract class).
        DanielEScherzer
      • Fixed bug GH-19070 (setlocale($type, NULL) should not be deprecated).
        nielsdos
      • Fixed bug GH-16649 (UAF during array_splice).
        alexandre-daubois
      • Passing strings which are not one byte long to ord() is now deprecated.
        Girgias
      • Passing integers outside the interval [0, 255] to chr() is now deprecated.
        Girgias
      • The socket_set_timeout() alias function has been deprecated.
        timwolla
      • Passing null to readdir(), rewinddir(), and closedir() to use the last opened directory has been deprecated.
        Girgias

    • streams

      • Fixed bug GH-16889 (stream_select() timeout useless for pipes on Windows).
        cmb
      • Fixed bug GH-19798: XP_SOCKET XP_SSL (Socket stream modules): Incorrect condition for Win32/Win64.
        Jakub Zelenka
      • Fixed bug GH-14506 (Closing a userspace stream inside a userspace handler causes heap corruption).
        nielsdos
      • Avoid double conversion to string in php_userstreamop_readdir().
        nielsdos

    • tests

      • Allow to shuffle tests even in non-parallel mode.
        dhuang00

    • tidy

      • tidy::__construct/parseFile/parseString methods throw an exception if the configuration argument is invalid.
        David Carlier
      • Fixed GH-19021 (improved tidyOptGetCategory detection).
        arjendekorte
        David Carlier
        Peter Kokot

    • tokenizer

      • Fixed bug GH-19507 (Corrupted result after recursive tokenization during token_get_all()).
        kubawerlos
        nielsdos
        Arnaud

    • windows

      • Fixed bug GH-10992 (Improper long path support for relative paths).
        cmb
        nielsdos
      • Fixed bug GH-16843 (Windows phpize builds ignore source subfolders).
        cmb
      • Fix GH-19722 (_get_osfhandle asserts in debug mode when given a socket).
        dktapps

    • xml

      • The xml_parser_free() function has been deprecated.
        DanielEScherzer

    • xmlwriter

      • Improved performance and reduce memory consumption.
        nielsdos

    • xsl

      • Implement request #30622 (make $namespace parameter functional).
        nielsdos

    • zlib

      • gzfile, gzopen and readgzfile, their "use_include_path" argument is now a boolean.
        David Carlier
      • Fixed bug GH-16883 (gzopen() does not use the default stream context when opening HTTP URLs).
        nielsdos
      • Implemented GH-17668 (zlib streams should support locking).
        nielsdos

    • zip

      • Fixed missing zend_release_fcall_info_cache on the following methods ZipArchive::registerProgressCallback() and ZipArchive::registerCancelCallback() on failure.
        David Carlier

PHP 8.5


  Represents a security release