php8.5
/
Download
← All releases
PHP 8.4 Thursday, 02 July 2026

PHP 8.4.23

24 changes across 15 components.

Core

  • Fixed bug GH-22280 (Incorrect compile error for goto to label preceding try/finally block).
  • Fixed bug GH-22290 (AST pretty printing does not correctly handle strings containing NUL).

BCMath

  • Fixed issues with oversized allocations and signed overflow in bcround() and BcMath\Number::round().

Date

  • Fix incorrect recurrence check of DatePeriod::createFromISO8601String().

DOM

  • Fix GH-22219 (Dom\XMLDocument::schemaValidate fails to resolve xs:QName with prefix from imported schema).

Exif

  • Read correct value for single and double tags.

GD

  • Fixed bug GH-22121 (Double free in gdImageSetStyle() after overflow-triggered early return).
  • Fixed bug GH-19666 (imageconvolution() unexpected nan filter value).
  • Fixed bug GH-19739 (imageellipse/imagefilledellipse overflow).
  • Fixed bug GH-19730 (imageaffine overflow).

Intl

  • Fix incorrect argument positions for uninitialized calendar arguments in IntlCalendar::equals(), ::before(), ::after(), and ::isEquivalentTo(), and for invalid start/end arguments in transliterator_transliterate().
  • Fixed IntlTimeZone::getDisplayName() to synchronize object error state for invalid display types.
  • Fixed Spoofchecker restriction-level APIs to only be exposed with ICU 53 and later.

mysqli

  • Fix stmt->query leak in mysqli_execute_query() validation errors.

Opcache

  • Fixed bug GH-20469 (Unsafe inheritance cache replay with reentrant autoloading).
  • Fixed bug GH-22158 (Tracing JIT dispatches the observer begin handler through the wrong run_time_cache slot on megamorphic calls).

OpenSSL

  • Fixed bug GH-22187 (Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD). (CVE-2026-14355)

Phar

  • Fixed a bypass of the magic ".phar" directory protection in Phar::addEmptyDir() for paths starting with "/.phar", while allowing non-magic directory names that merely share the ".phar" prefix.
  • Fixed an integer underflow when parsing ZIP extra fields.

Reflection

  • Preserve class-name case in ReflectionClass::getProperty() error messages and autoloading.

Sqlite

  • Fix error checks for column retrieval.

Zlib

  • Fixed memory leak if deflate initialization fails and there is a dict.
  • Fixed memory leak in inflate_add().

Zip

  • Fixed error-related memory leaks.
← 8.4.24 8.4.22 →