Core
- Fixed bug GH-24184 (System ID not being reinitialized after an Apache graceful restart, potentially causing incompatible OPcache file cache entries to be reused).
- Fixed memory leak when an exception already contains the pending exception in its previous chain.
- Fixed bug GH-23979 (Nullsafe operator must not flush delayed oplines of an enclosing function).
- Fixed memory manager keeping a block reallocated to exactly the size of the next smaller bin in its larger bin, which efree_size() then freed into the wrong one.
- Fixed bug GH-24081 (User opcode handlers resume execution against a stale frame under ZEND_VM_KIND_TAILCALL).
- Fixed bug GH-24218 (Invalid opcode for count() of a literal array without SCCP).
- Fix throwing behaviour with recursive arrays in VM.
- Fixed skipped catch block when switching fibers during exception unwinding (Nicolas Grekas)
- Fix escape analysis for objects implementing ArrayAccess.
- Fix UAF for resolved callable zval.
- Fix memory leak for nested HTTP calls.
- Fix function and constant imports in compile_to_ast and add support for grouping.
- Fixed bug GH-24668 (zend_set_local_var() leaks the previous value of an existing CV).
- Fixed unmapping of an unrelated range when the aligned chunk mmap fails (Marti2203).
- Fixed AST printing dropping final on class constants and properties, and abstract on properties.
- Fixed AST export of readonly anonymous classes dropping the readonly modifier.
- Fixed memory leak of a duplicate named argument in new in initializer.
- Fixed bug GH-25061 ($x = $x - 1 on null is optimized to PRE_DEC).
- Fixed first-class callables to static methods in trait constant expressions resolving to the method of the first using class and bypassing visibility checks.
CLI
COM
- Fixed bug GH-25008 (com_event_sink() and com_print_typeinfo() crash resolving an event source with no loaded typelib).
Curl
- Fix use-after-free of CURLOPT_STDERR stream on cloned curl handle.
- Fix UAF on clone due to callback data pointer mismatch.
Date
DBA
- Fixed bug GH-24641 (ndbm backend never checks dbm_open() return value, NULL deref on first use after a failed open).
DOM
- Fixed a use-after-free when reflected attribute setters replace an attribute whose child still has a live wrapper.
- Fix error paths in dom_xml_serializing_a_document_node().
- Fixed bug GH-25118 (Dom\HTMLDocument::createFromString() crash on OOM).
FFI
- Fixed bug GH-24582 (Memory leaks in ext/ffi parser when finalize_type() bails out).
Fileinfo
- Fixed bug GH-24289 (finfo::file() reports the wrong argument number for an invalid $filename).
FPM
- Fixed bug GH-24229 (fcgi_close() passes shutdown() a literal 1, which is SHUT_RD in WASI).
- Fixed crash and stack memory disclosure in the worker output logging with a pool name longer than the message prefix buffer or log_limit.
- Fixed bug GH-24046 (FPM worker stdio pipe fd closed twice when a child process outlives the worker, breaking a later worker's stdio).
- Fixed memory leaks of the _GET string on the status page error and HEAD request paths.
- Fixed use-after-free of the scoreboard copy when logging invalid status values.
- Fixed null pointer dereference in fpm_get_status() when the scoreboard copy fails.
FTP
- Fix double free in ext/ftp data_accept() on accept failure.
GD
- Fixed imagetruecolortopalette() error message.
Hash
- Fix GOST and Snefru digests of 512 MiB or more.
Intl
- Fixed IntlDateFormatter parse functions truncating an $offset below INT_MIN.
JSON
- Fixed json_encode() leaving the recursion guard set on objects with hooked properties after running out of memory while escaping a property name.
- Fixed json_encode() silently narrowing $depth values outside the int range, which wrapped to an unrelated depth.
- Fixed json_encode() continuing to encode after an array or object key failed to encode.
LDAP
- Fix crash in ldap_exop_sync() when $response_data is omitted.
MBString
- Fixed bug GH-23958 (truncated encoding names resolving to full names).
- Fixed out-of-bounds read in php_mb_rfc1867_getword() on a multibyte lead byte at the end of a multipart field name.
- Fixed negative mbstring.regex_stack_limit and mbstring.regex_retry_limit on 32bit platforms.
MySQLnd
ODBC
- Fixed bug GH-25036 (odbc_prepare() corrupts the heap when the driver cannot describe a parameter).
Opcache
- Fixed bug GH-24397 (Assertion failure when dumping JIT IR).
- Fixed tracing JIT returning a wrapped integer instead of a float on integer overflow after an integer was compared with a float or numeric-string literal.
- Fixed bug GH-17626 (JIT corrupts an opline handler when blacklisting a root trace at the opcache.jit_max_root_traces limit, causing spurious "Too few arguments" errors and crashes).
- Fix type inference of ADD_ARRAY_UNPACK with integer keys.
- Fix too wide type inference for ASSIGN_DIM_OP.
- Fix OSS-Fuzz #568005340 (FETCH_DIM_FUNC_ARG partial conversion).
- Fix exception checks due to NAN warnings and object empty()'s.
- Fixed bug GH-24270 (JIT loses the called scope of self:: and parent:: calls in closures).
- Fixed bug GH-24337 (JIT: segfault when decrementing a non-numeric string property).
- Fixed bug GH-24185 (Windows ZTS: random access violations with OPcache JIT in multi-process setups).
- Fix SIGFPE on LONG_MIN % -1 with a constant divisor.
- Fixed bug GH-24388 (Tracing JIT: segfault when a trace runs out of side exits).
- Fixed bug GH-24391 (JIT switch on constant null takes default instead of case 0).
- Fixed bug GH-24206 (Tracing JIT loses loop-carried CV when its loop PHI is reloaded from memory).
- Fixed bug GH-24386 (JIT: register operand must be loaded before the typed reference check).
- Fixed bug GH-24437 (JIT: Fix OP_DATA read from an unwritten slot in zend_jit_assign_dim_op()).
- Fixed bug GH-24398 (JIT: minimal JIT segfault when a hooked property is passed to a run-time-resolved function).
- Fixed bug GH-24389 (Tracing JIT: type guard on entry of an inlined call exits with an uninitialized opline).
- Fixed use-after-free in JIT ASSIGN_DIM_OP when concatenating into an empty array element.
- Fixed bug GH-24396 (Assertion failure in zend_jit_def_reg() "reg forwarding" with chained Pi nodes).
- Fixed JIT treating an array as packed after a string key write turned it into a hash.
- Fixed bug GH-24436 (Tracing JIT: keep the SEND_VAL type guard after assigning to a reference).
- Fixed bug GH-24745 (File cache loses attributes on constants on 32-bit builds).
- Fixed bug GH-17733 (System entropy does not take into account function order, resulting in wrong functions possibly called in different configurations).
- Fixed bug GH-24438 (Preserve indirect types in JIT side traces).
- Fixed bug GH-24577 (CE-cache flag on interned class name visible before map_ptr offset).
- Fixed tracing JIT losing register-allocated CVs when an interrupt is handled at the end of a loop trace.
- Fixed bug GH-24675 (function with >~1.7 MB of machine code corrupts JIT buffer accounting).
- Call orig_post_shutdown_cb().
- Fixed JIT segfault on switch over a string reference holding a non-string value.
- Fixed AArch64 JIT encoding of invalid logical immediates.
- Fixed JIT crashes when handling a VM interrupt with a stale saved opline in the tailcall VM.
- Fixed function JIT misinterpreting VM-enter results after an interrupt callback in the CALL and TAILCALL VMs.
- Fixed unsound shift_left_overflows range when shift wraps.
- Fixed bug GH-23572 (Tracing JIT calls the wrong method for self::/parent:: static calls in trait methods shared by several classes).
- Fix block pass dropping ZEND_FAST_CALL OP2 definition.
- Fixed bug GH-23626 (orphaned temporaries cause leaks and assertions).
- Fix preloaded functions JIT-compiled on load being overwritten after restart.
- Fix opcache.interned_strings_buffer being 0 in threads started later (ZTS).
- Fixed potential infinite recursion/hang (HYBRID/TAILCALL respectively) when zend_interrupt_function resets EG(vm_interrupt).
- Fix JIT losing the called scope of self::/parent:: calls in included files.
- Fixed preloaded functions not JIT-compiled again after OPcache restart.
- Fixed bug GH-24988 (Incorrect opcode range check causes bugs with exceptions in function JIT).
- Fix opcache phar check.
- Fixed bug GH-22216 (spurious opcache.memory_consumption warning on each new ZTS thread; the directive is also reported as 0 in worker threads).
OpenSSL
- Fixed build and test compatibility with OpenSSL 4.0 and 4.1.
- Fixed bug GH-24784 (openssl_pkcs7_read() and openssl_cms_read() overwrite certificates with CRLs).
PDO
PDO_Firebird
- Fixed bug GH-25006 (getColumnMeta() reads out of bounds for an out-of-range column index).
PDO_PGSQL
- Fixed a use-after-free when a persistent connection receives a notice after the request that called Pdo\Pgsql::setNoticeCallback() has ended.
PDO_SQLite
- Fixed bug GH-24990 (Statement unusable after a failed execute()).
Phar
- Fixed bug GH-25093 (Phar::webPhar() redirect reads past the request URI).
- Fixed bug GH-25089 (Heap buffer over-read via crafted alias size in zip-based phar).
- Fixed bug GH-8469 (Phar::decompressFiles() and Phar::compressFiles() retain compressed contents after changing compression).
- Fixed bug GH-24740 (Oversized tar metadata exhausts the memory limit).
- Fixed bug GH-25090 (UAF in phar rename() of an entry with metadata).
- Fixed bug GH-25091 (UAF in phar rename() when source and destination are equal).
- Fixed bug GH-25092 (Double free in Phar::copy() on link and mounted entries).
- Fixed bug GH-24531 (Crash when modifying a zip-based phar whose file was renamed).
Phpdbg
- Fix wrong command names.
- Fixed bug GH-22480 (Use-after-free when re-watching an already-watched variable).
- Fixed over-read when watching a packed array element.
- Fixed double free of watch element chains.
POSIX
- Fixed posix_setrlimit() rejecting POSIX_RLIMIT_INFINITY on Solaris.
Readline
- Fixed a crash in readline_info() when completion_append_character contains a non-ASCII byte.
SAPI
- Fixed infinite loop in sapi_header_op() for headers of 4 GiB or more.
Session
- Validate whole session ID instead of stopping at the first NUL byte.
- Fixed session data loss in the files save handler when writing the session file fails after it was already truncated.
SPL
- Fixed bug GH-24264 (Unwind/GracefulExit discarded in spl_iterators.c).
Sockets
- Fixed bug GH-24748 (socket_set_option() crashes with declared object properties).
Standard
- Fixed memory leaks in checkdnsrr() and dns_check_record() on Windows.
- Fixed __unserialize() and __wakeup() being called for objects with a missing closing brace.
- Fixed bug GH-24308 (Request shutdown calls closelog() even when syslog was not opened by PHP).
- Fixed password_get_info() and password_needs_rehash() accepting malformed bcrypt costs.
- Fixed proc_open() null descriptor not being inheritable on Windows.
- Don't share the unserialize() context with enum autoloaders.
- Fixed bug GH-24399 (usleep() and time_nanosleep() ignore queued APCs on Windows).
- Fixed glob() not negating bracket expressions that start with "^".
- Fixed bug GH-24552 (Case-insensitive substr_compare(), ksort() and krsort() are still locale-dependent).
- Fixed bug GH-24605 (var_export() crashes on deeply nested arrays and objects).
- Fix use-after-free in Randomizer::shuffleArray() when the engine throws.
Streams
Tidy
- Fixed tidy_repair_string(), tidy_repair_file(), tidy::repairString() and tidy::repairFile() rejecting null for $encoding.
URI
- Fixed bug GH-25019 (Uri\Rfc3986\Uri rejects a port with leading zeros as out of range).
- Upgrade to uriparser 1.0.3. (CVE-2026-48841)
Windows
- Fixed bug GH-25009 (GetConsoleTitleW() buffer size passed in bytes).
- Fixed sapi_windows_cp_set() and sapi_windows_cp_conv() accepting a negative codepage on 32bit platforms.
Zip
- Reject broken libzip versions 1.3.1, 1.7.0 and 1.12.0 during Windows configuration.
- Excluded libzip 1.12.0 due to a regression preventing additions and replacements in torrentzip archives.
- Fixed use-after-free when re-entering ZipArchive during destruction or a close warning, and rejected opening streams while closing.
- Fixed a use-after-free when a ZipArchive method that modifies the archive is called from a progress or cancel callback during close().