BCMath
- Fixed GHSA-x692-q9x7-8c3f (Out-of-bounds write in bccomp()). (CVE-2026-17544)
Calendar
- Fixed bug GH-22602 (gregoriantojd() and juliantojd() integer overflow with INT_MAX year).
Date
DBA
- Fixed OOB read on malformed length field in dba flatfile handler.
DOM
- Fixed bug GH-22570 (Stack overflow when serializing a deeply nested Dom\XMLDocument).
Exif
- Fixed bug GH-11020 (exif_read_data() emits a spurious "Illegal IFD size" warning when an IFD is not followed by a next-IFD offset).
GD
- Upgrade libgd. (CVE-2026-9672)
Hash
- Fixed bug GH-18173 (ext/hash relies on implementation-defined malloc alignment).
Intl
- Fixed Locale::lookup() and locale_lookup() to return NULL instead of the fallback locale when a language tag cannot be canonicalized.
- Fixed memory leaks when calling Collator::__construct() or Spoofchecker::__construct() twice.
- Fixed IntlChar methods leaving stale global error state after successful calls.
ODBC
- Fixed bug GH-22668 (Heap buffer over-read when a column value exceeds the driver-reported display size).
OpenSSL
- Fixed timeout for supplemental read at end of a blocking stream in SSL stream wrapper.
PDO_ODBC
- Fixed bug GH-20726 (Crash with ODBC connection pooling when the DSN carries no credentials).
- Fixed bug GH-22667 (Heap buffer over-read when a column value exceeds the driver-reported display size).
- Fixed bug GH-22666 (Heap buffer overflow when an output parameter value is longer than the declared maxlen).
- Fixed bug GH-22665 (Out-of-bounds write when the ODBC driver reports a diagnostic message length beyond the error buffer).
PGSQL
- Fixed GHSA-7qpv-r5mr-78m4 (SQL injection via E'...' backslash breakout). (CVE-2026-17543)
Phar
- Fixed inconsistent handling of the magic ".phar" directory. Paths such as "/.phar" remain protected, while non-magic paths that merely start with ".phar" are handled consistently across file and directory creation, copying, ArrayAccess, stream lookup, directory iteration and extraction.
- Fixed GHSA-vc5h-9ppw-p5f3 (Crash via recursive symlinks). (CVE-2026-7260)
PHPDBG
- Fixed bug GH-17387 (Trivial crash in phpdbg lexer).
- Fixed fleaked lowercased lookup keys in phpdbg_resolve_opline_break.
- Fixed off-by-one in phpdbg_safe_class_lookup() causing class lookups to always fail during phpdbg's signal-safe interruption path.
Reflection
- Fixed bug GH-22324 (Ignore leading namespace separator in ReflectionParameter::__construct()).
- Fixed bug GH-22441 (ReflectionClass::hasProperty() and getProperty() ignore dynamic properties shadowing a private parent property).
- Fixed bug GH-22658 (ReflectionConstant::__toString() with a string value with null bytes truncates output).
- Fixed bug GH-22681 (Reflection*::__toString() truncates on null bytes).
Session
- Fixed bug GH-21314 (Different session garbage collector behavior between PHP 8.3 and PHP 8.5).
SPL
- Fix class_parents for classes with leading slash in non-autoload mode.
- Ignore leading back-slash in class_parents(), class_implements(), and class_uses().
- Fixed bug GH-16217 (SplFileObject::fputcsv() on an uninitialized object segfaults).
Standard
- Fixed bug GH-22360 (convert.base64-encode corruption on incremental flush).
- Fixed bug GH-22395 (base_convert() outputs at most 64 characters).
- Fixed integer overflow in getimagesize() and getimagesizefromstring() when parsing an IFF chunk with a size of INT_MAX.
- Fixed bug GH-22678 (Use-after-free in array_multisort() when the comparator mutates the array being sorted).
Streams
- Fixed bug GH-22617 (persistent stream keys truncated at null bytes, causing distinct abstract unix domain sockets to share a resource).