PHP NEWS

|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||

12 Nov 2026, PHP 8.6.0RC7

- Core:

. Fixed array_map() optimization not resolving the function name of an FCC.

(ChrisAbner)

- OpenSSL:

. Fixed use-after-free in TLS server ALPN and Windows certificate checks

when the session stream passed to stream_socket_enable_crypto() is closed

before the handshake. (Ilia Alshanetsky)

12 Nov 2026, PHP 8.6.0RC6

- Core:

. Fix potential ABI incompatibility when adding fields in patches by adding

padding to globals. (ilutov)

- Date:

. Update timelib to 2026.03 (Derick)

- Fileinfo:

. Fixed bug GH-25051 (TrueType fonts detected as application/octet-stream

since libmagic 5.48). (Weilin Du)

. Fixed incorrect MIME type detection for HWPX files. (Weilin Du)

- Streams:

. Fixed use-after-free of the previous request's default stream context when

a stream error is raised during request startup, such as when a POST body

cannot be buffered to a temporary file. (Go Kudo)

05 Nov 2026, PHP 8.6.0RC5

- Core:

. Fix function and constant imports in compile_to_ast and add support

for grouping. (Klaas Skelte van der Werf)

. Fixed bug GH-24668 (zend_set_local_var() leaks the previous value of an

existing CV). (yasu20200121web-prog, lazerg)

. Fixed unmapping of an unrelated range when the aligned chunk mmap fails

(Marti2203).

. Fixed bug GH-25023 (ZEND_CONTAINER_OF() fails to compile with -std=c11).

(lazerg)

. Fixed bug GH-25007 (Partial function application: named args in a constant

expression cause out-of-bounds write in zp_compile()). (lazerg)

. Fixed AST printing dropping final on class constants and properties, and

abstract on properties. (Jorg Sowa)

. Fixed AST export of readonly anonymous classes dropping the readonly

modifier. (Jorg Sowa)

. Fixed memory leak of a duplicate named argument in new in initializer.

(Jorg Sowa)

. Fixed bug GH-25061 ($x = $x - 1 on null is optimized to PRE_DEC).

(Lazizbek Ergashev)

. Fixed bug GH-23911 (Don't use static closure cache when called_scope

diverges). (Roman Ondráček)

. Fixed first-class callables to static methods in trait constant

expressions resolving to the method of the first using class and

bypassing visibility checks. (Jorg Sowa)

- CLI:

. Fixed bug GH-24697 (PHP_HTTP_PARSER_STRICT build option doesn't work).

(ndossche, devnexen)

. Fixed bug GH-9670 (List -C and -q in the CLI help). (Juan Versolato Lopes)

- COM:

. Fixed bug GH-25008 (com_event_sink() and com_print_typeinfo() crash

resolving an event source with no loaded typelib). (Ilia Alshanetsky)

- Curl:

. Fix use-after-free of CURLOPT_STDERR stream on cloned curl handle.

(lacatoire)

. Fix UAF on clone due to callback data pointer mismatch. (ndossche)

- DBA:

. Fixed bug GH-24641 (ndbm backend never checks dbm_open() return value,

NULL deref on first use after a failed open). (Girgias)

- DOM:

. Fixed a use-after-free when reflected attribute setters replace an

attribute whose child still has a live wrapper. (Jakub Zelenka)

. Fix error paths in dom_xml_serializing_a_document_node(). (ndossche)

- FFI:

. Fixed bug GH-24582 (Memory leaks in ext/ffi parser when finalize_type()

bails out). (matyapiro31, David Carlier)

- FPM:

. Fixed crash and stack memory disclosure in the worker output logging with

a pool name longer than the message prefix buffer or log_limit.

(Martin Mirchev)

. Fixed bug GH-24046 (FPM worker stdio pipe fd closed twice when a child

process outlives the worker, breaking a later worker's stdio).

(Ian P. Christian, ndossche)

. Fixed memory leaks of the _GET string on the status page error and HEAD

request paths. (Marcel Hernandez)

. Fixed use-after-free of the scoreboard copy when logging invalid status

values. (Marcel Hernandez)

. Fixed null pointer dereference in fpm_get_status() when the scoreboard

copy fails. (Marcel Hernandez)

- GD:

. Fixed imagetruecolortopalette() error message. (Marc Bennewitz)

- Hash:

. Fix GOST and Snefru digests of 512 MiB or more. (Martin Mirchev)

- Intl:

. Fixed IntlDateFormatter parse functions truncating an $offset below

INT_MIN. (Marc Bennewitz)

- JSON:

. Fixed json_encode() leaving the recursion guard set on objects with hooked

properties after running out of memory while escaping a property name.

(adapik)

. Fixed json_encode() silently narrowing $depth values outside the int range,

which wrapped to an unrelated depth. (cuishuang)

. Fixed json_encode() continuing to encode after an array or object key

failed to encode. (Ilia Alshanetsky)

- LDAP:

. Fix crash in ldap_exop_sync() when $response_data is omitted. (lacatoire)

- MBString:

. Fixed negative mbstring.regex_stack_limit and mbstring.regex_retry_limit

on 32bit platforms. (Marc Bennewitz)

- MySQLnd:

. Fixed bug GH-24609 (OK packets without an info message rejected on x32

builds). (lazerg)

- ODBC:

. Fixed bug GH-25036 (odbc_prepare() corrupts the heap when the driver

cannot describe a parameter). (Ilia Alshanetsky)

- Opcache:

. Fixed bug GH-24397 (Assertion failure when dumping JIT IR).

(Ilia Alshanetsky)

. Fixed tracing JIT returning a wrapped integer instead of a float on

integer overflow after an integer was compared with a float or

numeric-string literal. (Ilia Alshanetsky)

. Fixed use-after-free in JIT ASSIGN_DIM_OP when concatenating into an

empty array element. (jorgsowa)

. Fixed bug GH-24396 (Assertion failure in zend_jit_def_reg() "reg forwarding"

with chained Pi nodes). (ndossche)

. Fixed JIT treating an array as packed after a string key write turned it

into a hash. (jorgsowa)

. Fixed bug GH-24436 (Tracing JIT: keep the SEND_VAL type guard after

assigning to a reference). (waroad)

. Fixed bug GH-24745 (File cache loses attributes on constants on 32-bit

builds). (Yannick Decat, Lazizbek Ergashev)

. Fixed bug GH-17733 (System entropy does not take into account function

order, resulting in wrong functions possibly called

in different configurations). (ndossche)

. Fixed bug GH-24438 (Preserve indirect types in JIT side traces). (aasul)

. Fixed bug GH-24577 (CE-cache flag on interned class name visible before

map_ptr offset). (prateekbhujel)

. Fixed tracing JIT losing register-allocated CVs when an interrupt is

handled at the end of a loop trace. (Levi Morrison)

. Fixed bug GH-24675 (function with >~1.7 MB of machine code corrupts JIT

buffer accounting). (ndossche)

. Call orig_post_shutdown_cb(). (ndossche)

. Fixed JIT segfault on switch over a string reference holding a

non-string value. (jorgsowa)

. Fixed AArch64 JIT encoding of invalid logical immediates. (jorgsowa)

. Fixed JIT crashes when handling a VM interrupt with a stale saved opline

in the tailcall VM. (Levi Morrison)

. Fixed function JIT misinterpreting VM-enter results after an interrupt

callback in the CALL and TAILCALL VMs. (Levi Morrison)

. Fixed unsound shift_left_overflows range when shift wraps. (mkrishna793)

. Fixed bug GH-23572 (Tracing JIT calls the wrong method for self::/parent::

static calls in trait methods shared by several classes). (jorgsowa,

mgoulart)

. Fix block pass dropping ZEND_FAST_CALL OP2 definition. (Mrmaxmeier)

. Fixed bug GH-23626 (orphaned temporaries cause leaks and assertions).

(ndossche, khaledalam)

. Fix preloaded functions JIT-compiled on load being overwritten

after restart. (Pavel Gushcha)

. Fix opcache.interned_strings_buffer being 0 in threads started later (ZTS).

(Pavel Gushcha)

. Fixed potential infinite recursion/hang (HYBRID/TAILCALL respectively)

when zend_interrupt_function resets EG(vm_interrupt). (Levi Morrison)

. Fix JIT losing the called scope of self::/parent:: calls in included files.

(ndossche)

. Fixed preloaded functions not JIT-compiled again after OPcache restart.

(Jorg Sowa)

. Fixed bug GH-24988 (Incorrect opcode range check causes bugs with exceptions in

function JIT). (ndossche, Jorg Sowa)

. Fix opcache phar check. (ndossche)

- OpenSSL:

. Fixed build with OpenSSL 4.1. (Weilin Du)

. Fixed bug GH-24784 (openssl_pkcs7_read() and openssl_cms_read() overwrite

certificates with CRLs). (Alexander Danilov)

. Fixed use-after-free in the TLS session remove callback when the listener

stream is closed while a shared context is still in use. (Jakub Zelenka)

. Fixed heap buffer overflow in TLS PSK callbacks. (Jakub Zelenka)

- PDO_Firebird:

. Fixed bug GH-25006 (getColumnMeta() reads out of bounds for an

out-of-range column index). (Ilia Alshanetsky)

- PDO_PGSQL:

. Fixed bug GH-24461 (DISCARD ALL on persistent connection cleanup drops

PgBouncer's prepared statements). (David Carlier, Artem Ukrainskiy)

. Fixed a use-after-free when a persistent connection receives a notice

after the request that called Pdo\Pgsql::setNoticeCallback() has ended.

(Ilia Alshanetsky)

- PDO_SQLite:

. Fixed bug GH-24990 (Statement unusable after a failed execute()). (lazerg)

- Phar:

. Fixed bug GH-25093 (Phar::webPhar() redirect reads past the request URI).

(lazerg)

. Fixed bug GH-25089 (Heap buffer over-read via crafted alias size in

zip-based phar). (Lazizbek Ergashev)

. Fixed bug GH-8469 (Phar::decompressFiles() and Phar::compressFiles() retain

compressed contents after changing compression). (Raphael Paez)

. Fixed bug GH-24740 (Oversized tar metadata exhausts the memory limit).

(Lazizbek Ergashev)

. Fixed bug GH-25090 (UAF in phar rename() of an entry with metadata).

(Lazizbek Ergashev)

. Fixed bug GH-25091 (UAF in phar rename() when source and destination

are equal). (Lazizbek Ergashev)

. Fixed bug GH-25092 (Double free in Phar::copy() on link and

mounted entries). (Lazizbek Ergashev)

. Fixed bug GH-24531 (Crash when modifying a zip-based phar whose file was

renamed). (Ilia Alshanetsky)

. Fixed Phar::buildFromIterator() accepting a negative getMTime() on 32bit

platforms. (Marc Bennewitz)

- Reflection:

. Fixed bug GH-21768 (Assertion failure in ReflectionProperty::isReadable()

and isWritable() on internal virtual properties). (David Carlier)

- SAPI:

. Fixed infinite loop in sapi_header_op() for headers of 4 GiB or more.

(Martin Mirchev)

- Session:

. Validate whole session ID instead of stopping at the first NUL byte.

(Sjoerd Langkemper)

- Sodium:

. Pass sodium_crypto_xof_*() state via objects instead of by-ref strings.

(timwolla)

- SPL:

. Fixed bug GH-24264 (Unwind/GracefulExit discarded in spl_iterators.c).

(Lazizbek Ergashev)

- Sockets:

. Fixed bug GH-24748 (socket_set_option() crashes with declared object

properties). (Lazizbek Ergashev)

- Standard:

. Fixed bug GH-25086 (Io\Poll kqueue backend leaks memory on every

Watcher::modifyEvents() call). (Lazizbek Ergashev, Jakub Zelenka)

. Fixed Io\Poll WSAPoll backend accepting handles that are not sockets, which

were then silently dropped by wait(). Adding them now fails with

ERROR_NOSUPPORT. (Nicolas Grekas)

. Fixed memory leaks in checkdnsrr() and dns_check_record() on Windows.

(Ilia Alshanetsky)

. Fixed __unserialize() and __wakeup() being called for objects with a missing

closing brace. (Ilia Alshanetsky)

. Fixed bug GH-24308 (Request shutdown calls closelog() even when syslog

was not opened by PHP). (lazerg)

. Fixed bug GH-24552 (Case-insensitive substr_compare(), ksort() and

krsort() are still locale-dependent). (Lazizbek Ergashev, Jon Surrell)

. Fix use-after-free in Randomizer::shuffleArray() when the engine throws.

(Marti2203)

- Streams:

. Fixed bug GH-24506 (stream_select() leaks a stream-error operation level

on its FD_SETSIZE failure path). (azjezz)

. Fixed bug GH-24508 (HTTP wrapper leaks the dechunk filter when header

parsing fails after Transfer-Encoding). (bercedev)

. Fixed bug GH-24509 (HTTP wrapper leaks Location buffer on empty

Location header). (bercedev)

. Fix out-of-bounds reads parsing ftp:// wrapper server replies.

(Alejandro Pacheco)

- URI:

. Upgrade to uriparser 1.0.3. (CVE-2026-48841) (Sebastian Pipping, timwolla)

- Windows:

. Fixed bug GH-25009 (GetConsoleTitleW() buffer size passed in bytes).

(Lazizbek Ergashev)

. Fixed sapi_windows_cp_set() and sapi_windows_cp_conv() accepting a negative

codepage on 32bit platforms. (Marc Bennewitz)

- Zip:

. Reject broken libzip versions 1.3.1, 1.7.0 and 1.12.0 during Windows

configuration. (Weilin Du)

. Excluded libzip 1.12.0 due to a regression preventing additions and

replacements in torrentzip archives. (Weilin Du)

- Zlib:

. Fixed bug GH-24533 (zlib.lib could not be found because zlib 1.3.2

CMake build does not emit it). (Lazizbek Ergashev)

21 Oct 2026, PHP 8.6.0RC4

- Core:

. Fixed GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp (Avoid state corruption via

bailout). (CVE-2026-109618, CVE-2026-109619) (Arnaud, ilutov, Jakub Zelenka,

ndossche, Nicolas Grekas)

. Fixed bug GH-24184 (System ID not being reinitialized after an Apache

graceful restart, potentially causing incompatible OPcache file cache

entries to be reused). (Levi Morrison)

. Fixed memory leak when an exception already contains the pending exception

in its previous chain. (Edmond)

. Fixed bug GH-23979 (Nullsafe operator must not flush delayed oplines of an

enclosing function). (ndossche)

. Fixed memory manager keeping a block reallocated to exactly the size of

the next smaller bin in its larger bin, which efree_size() then freed

into the wrong one. (Marc Bennewitz)

. Fix throwing behaviour with recursive arrays in VM. (ndossche)

. Fixed skipped catch block when switching fibers during exception unwinding

(Nicolas Grekas)

. Fix escape analysis for objects implementing ArrayAccess. (ndossche, Arnaud)

. Fixed array_map() optimization not resolving the class name of a static

first-class callable. (Claudio Dekker)

- Date:

. Fixed bug GH-20503 (Assertion failure with ext/date DateInterval property

hash construction). (heathdutton)

. Fixed bug GH-24350 (MINIT reads a stale external tz database after an

in-process module restart). (Lazizbek Ergashev)

- Fileinfo:

. Fixed bug GH-24289 (finfo::file() reports the wrong argument number for

an invalid $filename). (Lazizbek Ergashev)

- FPM:

. Fixed bug GH-24229 (fcgi_close() passes shutdown() a literal 1, which is

SHUT_RD in WASI). (Ryosuke Ishibashi)

- FTP:

. Fix double free in ext/ftp data_accept() on accept failure. (alepacheco)

- MBString:

. Fixed bug GH-23958 (truncated encoding names resolving to full names). (Kamil Tekiela)

. Fixed out-of-bounds read in php_mb_rfc1867_getword() on a multibyte lead

byte at the end of a multipart field name. (Jorg Sowa)

- MySQLnd:

. Fixed bug GH-24293 (Segfault on connect with an empty password to a

MariaDB PAM account). (lazerg)

- Opcache:

. Fixed bug GH-17626 (JIT corrupts an opline handler when blacklisting a

root trace at the opcache.jit_max_root_traces limit, causing spurious

"Too few arguments" errors and crashes). (RV7PR)

. Fix type inference of ADD_ARRAY_UNPACK with integer keys. (ndossche)

. Fix too wide type inference for ASSIGN_DIM_OP. (ndossche)

. Fix OSS-Fuzz #568005340 (FETCH_DIM_FUNC_ARG partial conversion). (ndossche)

. Fix exception checks due to NAN warnings and object empty()'s. (ndossche)

. Fixed bug GH-24270 (JIT loses the called scope of self:: and parent:: calls

in closures). (RV7PR)

. Fixed bug GH-24337 (JIT: segfault when decrementing a non-numeric string

property). (Lazizbek Ergashev)

. Fixed bug GH-24185 (Windows ZTS: random access violations with OPcache JIT

in multi-process setups). (Arnaud, ndossche)

. Fix SIGFPE on LONG_MIN % -1 with a constant divisor. (waroad)

. Fixed bug GH-24388 (Tracing JIT: segfault when a trace runs out of side

exits). (Lazizbek Ergashev)

. Fixed bug GH-24391 (JIT switch on constant null takes default instead of

case 0). (ndossche)

. Fixed bug GH-24206 (Tracing JIT loses loop-carried CV when its loop PHI

is reloaded from memory). (ndossche)

. Fixed bug GH-24386 (JIT: register operand must be loaded before the typed

reference check). (ndossche)

. Fixed bug GH-24437 (JIT: Fix OP_DATA read from an unwritten slot in

zend_jit_assign_dim_op()). (waroad)

. Fixed bug GH-24398 (JIT: minimal JIT segfault when a hooked property is

passed to a run-time-resolved function). (waroad)

. Fixed bug GH-24389 (Tracing JIT: type guard on entry of an inlined call

exits with an uninitialized opline). (waroad)

- PDO:

. Fixed invalid ATTR_ORACLE_NULLS values being accepted and truncated.

(Ilia Alshanetsky)

. Fixed a duplicate warning when ATTR_STATEMENT_CLASS is rejected on a

persistent connection. (Ilia Alshanetsky)

. Fixed constructor option errors naming argument #3 ($password) instead

of argument #4 ($options). (Ilia Alshanetsky)

- Phpdbg:

. Fix wrong command names. (ndossche, Weilin Du)

- Phar:

. Fixed GH-24166 (Double-free in Phar::webPhar() in CGI without PATH_INFO).

(RigelYoung, Jakub Zelenka)

- POSIX:

. Fixed posix_setrlimit() rejecting POSIX_RLIMIT_INFINITY on Solaris.

(Jorg Sowa)

- Readline:

. Fixed a crash in readline_info() when completion_append_character

contains a non-ASCII byte. (Weilin Du)

- Session:

. Fixed session_write_close() keeping the save handler open when the

session data cannot be encoded. (Ilia Alshanetsky)

. Fixed session data loss in the files save handler when writing the session

file fails after it was already truncated. (Ilia Alshanetsky)

- SOAP:

. Fixed bug GH-23686 (SoapClient only strips `Authorization: Basic` when a

WSDL imports from another host). (DanielEScherzer)

- Standard:

. Fixed chown() and lchown() failing to resolve user names in ZTS builds

when getpwnam_r() needs a larger buffer. (Ilia Alshanetsky)

. Fixed password_get_info() and password_needs_rehash() accepting malformed

bcrypt costs. (Ilia Alshanetsky)

. Fixed proc_open() null descriptor not being inheritable on Windows.

(Jorg Sowa)

. Don't share the unserialize() context with enum autoloaders.

(Nicolas Grekas)

. Fixed bug GH-24399 (usleep() and time_nanosleep() ignore queued APCs on

Windows). (Nicolas Grekas)

. Fixed glob() not negating bracket expressions that start with "^".

(Nicolas Grekas)

. Fixed bug GH-24605 (var_export() crashes on deeply nested arrays and

objects). (Labish Bardiya)

- Tidy:

. Fixed tidy_repair_string(), tidy_repair_file(), tidy::repairString() and

tidy::repairFile() rejecting null for $encoding. (lacatoire)

- Zip:

. Fixed use-after-free when re-entering ZipArchive during destruction or

a close warning, and rejected opening streams while closing. (jvoisin)

. Fixed a use-after-free when a ZipArchive method that modifies the archive

is called from a progress or cancel callback during close().

(Ilia Alshanetsky)

- Zlib:

. Fixed use-after-free when an error handler removes a failing zlib.inflate

filter (GH-24176). (Edmond)

08 Oct 2026, PHP 8.6.0RC3

- BCMath:

. Fixed BcMath\Number results that truncate to zero keeping a negative sign

and comparing less than zero. (Ilia Alshanetsky)

- BZ2:

. Fixed double close of the descriptor and use-after-free of the inner

stream when bzopen() is given a stream resource. (Jakub Zelenka)

- CLI

. Fix GH-22567 (Windows ZTS CLI SAPI should refresh its TSRMLS cache during

request activation). (matyhtf)

. Fixed bug GH-23764 (Built-in server leaks a file descriptor on every HEAD

request for a static file). (jakubskopal)

. Fixed crash in the built-in server when a client is reset before being

accepted. (David Carlier)

. Fixed the built-in server truncating an error page and leaking its

unsent part after a partial socket write. (Ilia Alshanetsky)

- Core

. Fixed bug GH-23644 (Optimizer leaves a constant-vs-constant comparison

unfolded, crashing the VM in zval_undefined_cv). (ndossche)

. Fixed OSS-Fuzz 532353396 (assertion failure with static type). (Girgias)

. Fix GH-23662 (Avoid NAN warning in print_r()). (CodedByManish)

. Fix GH-21999: GC inconsistency with lazy object, var_dump(), and object

comparison. (Arnaud)

. Fixed OSS-Fuzz #536440507 (Immutable class incorrect assertion).

(ndossche)

. Fixed bug GH-23628 (Tracing JIT reads undefined property slots of lazy

proxy objects instead of forwarding to the real instance). (lisachenko)

. Fixed bug GH-23882 (array_map() optimization is incorrect for

strict_types=1). (timwolla)

. Fixed OSS-Fuzz #565486253 (coerced arg with '...' on non-variadic

function). (ndossche)

. Fixed AVX being reported as supported when the OS has not enabled AVX

state. (Ilia Alshanetsky)

. Fixed OSS-Fuzz #552682112 (assertion failure wrt

zp_arg_must_be_sent_by_ref()). (ndossche)

. Fixed GH-23921 (Fibers start with error_reporting = 0 when the

error_reporting INI directive is not set). (Girgias)

. Fixed GH-23980 (ZEND_ASSERT violation @ ZEND_INCLUDE_OR_EVAL). (ndossche)

. Deprecated using "let" or "is" as the name of a class, function, or

constant, and as an alias in class_alias() and use declarations. (Girgias)

. Deprecated using "_" as a constant name and as an alias for a class or

constant in use declarations. (Girgias)

. Switch the POSIX high resolution timer back to CLOCK_MONOTONIC from

CLOCK_MONOTONIC_RAW. (nicolas-grekas)

. Fixed array_map optimization with non-literal function or non-literal args.

(Arnaud)

. Fixed memory leak in array_map() foreach optimization when a constant

non-array string argument is passed. (Alexander Danilov)

. Fixed use-after-free when a dl()-loaded extension declares a frameless

function and a later request calls it. (Ilia Alshanetsky)

. Fixed System V shared memory emulation for Windows attaching segments past

the end of their mapping. (Ilia Alshanetsky)

. Fixed exception thrown by destructor during GC in a Fiber not being rethrown

into the frame that triggered the GC. (Nicolas Grekas)

- DOM:

. Fixed DOMXPath and Dom\XPath losing the context node and in-scope

namespaces of an evaluation after a php:function() callback evaluated

another expression on the same object. (Ilia Alshanetsky)

- FFI:

. Fixed crashes with FFI callbacks created from __call() trampolines

and array callables whose object is released. (Ilia Alshanetsky)

- Intl:

. Fixed grapheme_strstr() and grapheme_stristr() returning incorrect substrings

when supplementary characters precede the match. (Weilin Du)

. Fixed grapheme_strstr() and grapheme_strpos() missing canonically

equivalent matches, and grapheme searches reporting ICU errors for empty

haystacks. (Weilin Du)

. Fixed grapheme_strrpos() and grapheme_strripos() skipping overlapping matches

when using a negative offset. (Weilin Du)

. Fixed IntlDateFormatter::parse(), localtime() and parseToCalendar()

treating the offset as UTF-16 code units instead of bytes.

(Ilia Alshanetsky)

- Lexbor:

. Merge patches lexbor/lexbor@859f100, lexbor/lexbor@a36e09a,

lexbor/lexbor@b0f7412, lexbor/lexbor@1b215a8, lexbor/lexbor@385afff,

lexbor/lexbor@e6c068f, lexbor/lexbor@327a8b6, lexbor/lexbor@917742f and

lexbor/lexbor@e89c258, fixing dropped usernames containing an at sign,

uninitialized memory in IDNA buffer growth, the encoding of a space

before a query or fragment in an opaque path, a query or fragment lost

after a dot segment in a path, replacement file drive paths, the output

encoding used for percent-encoding, the URLSearchParams tail pointer and

fragment serialization without a query. (alexandre-daubois)

- MySQLnd:

. Fixed field_count not resetting on OK packet. (Kamil Tekiela)

. Fixed memory leak when closing a prepared statement after its connection

was killed. (Kamil Tekiela)

- Opcache:

. Fix zend_analyze_calls() call_stack buffer overrun. (Mrmaxmeier)

. Fixed bug GH-23679 (Tracing JIT writes a parent private property into a

child's shadowing public property). (Ilia Alshanetsky)

. Fix multiple incorrect DCE due to unsound escape analysis. (ndossche,

arnaud-lb)

. Fixed bug GH-24063 (OPcache optimizer folds `$cond ? -0.0 : 0.0` into a

single `-0.0` constant). (lazerg)

. Fixed crash when a file cache is reused with a different set of

extensions declaring frameless functions. (Ilia Alshanetsky)

. Fixed bug GH-23991 (JIT generates invalid IR for multiple recursive calls).

(ndossche)

. Fix SCCP evaluation of isset()/empty() on dimension of non-escaping object.

(ndossche)

- OpenSSL:

. Fixed stream_socket_enable_crypto() leaving the socket non-blocking

after a handshake timeout. (Ilia Alshanetsky)

. Fix memory leak by doing early salt validation. (adapik)

. Fixed openssl_sign() using the maximum RSA-PSS salt length by default

instead of the OpenSSL default. (adapik)

. Fixed feof() on a TLS stream staying false after a close_notify on Windows.

(Jakub Zelenka)

- PCNTL:

. Fixed pcntl_signal_dispatch() dropping the queued signals when it runs while

an exception is pending. (nicolas-grekas)

. Fixed pcntl_signal_dispatch() dropping the signals queued behind a handler

that throws. (nicolas-grekas)

. Fixed bug GH-23986 (/proc/self paths resolve to the parent process after

pcntl_fork()). (Lazizbek Ergashev)

- PDO:

. Fixed PDO::setAttribute() installing a PDO::ATTR_STATEMENT_CLASS class

whose constructor arguments it rejects. (Ilia Alshanetsky)

. Fixed PDO::ATTR_STATEMENT_CLASS constructor_args type errors reporting

"array given" regardless of the value passed. (Ilia Alshanetsky)

. Fixed PDOStatement::bindParam() and bindColumn() leaking the driver

options value. (Ilia Alshanetsky)

. Fixed PDOStatement not reporting its bound parameters and columns to the

cycle collector. (Ilia Alshanetsky)

. Fixed PDOStatement::setFetchMode() not applying changes atomically.

(Ilia Alshanetsky)

. Fixed PDOStatement::execute() leaving the previous result available

after a failed execution. (Ilia Alshanetsky)

. Fixed a use-after-free when bindValue()/execute()/closeCursor() is called

from a bound parameter's __toString() during execute(). (Ilia Alshanetsky)

- PDO_DBLIB:

. Fixed bug GH-23741 (segfault after a failed query inside a PDO

transaction). Errors raised by beginTransaction(), commit(), rollBack()

and lastInsertId() are now reported instead of being dropped.

(Ilia Alshanetsky)

- PDO_PGSQL:

. Fixed crash when a persistent connection fails. (KentarouTakeda)

- Reflection:

. Fixed bug GH-23842 (ReflectionProperty::skipLazyInitialization() copies

invalid constant defaults with OPcache). (DirkTrunkstar, Lazizbek Ergashev)

- SimpleXML:

. Fixed reconstructing a SimpleXMLElement freeing a child element that

another variable still references. (Ilia Alshanetsky)

- SOAP:

. Fixed bug GH-22895 (Heap use-after-free while encoding a Traversable with

an illegal key). (David Carlier)

. Fixed memory leak when load_wsdl_ex() failed to load. (DanielEScherzer)

- Standard:

. Fixed sha1_file() returning a digest for incomplete data after a stream

read failure. (Ilia Alshanetsky)

. Fixed iptcembed() corrupting JPEG headers when called recursively from an

output handler. (Ilia Alshanetsky)

. Fixed proc_open() leaking descriptor zero when descriptor setup fails.

(Ilia Alshanetsky)

. Fixed StreamPollHandle changing unread_bytes of a TLS stream when it is

added to an Io\Poll\Context. (Jakub Zelenka)

. Fix wordwrap() ignoring an existing break at the end of the string

(Nicolas Grekas)

. Fixed convert.quoted-printable-decode decoding lowercase hex digits to

the wrong byte. (Ilia Alshanetsky)

. Fixed bug GH-23948 (Io\Poll: data buffered by the stream layer is not

reported). (Jakub Zelenka)

- Tidy:

. Fixed a use-after-free when a tidyNode is used after its document is

reparsed. (Ilia Alshanetsky)

- Zip:

. Fixed bug GH-23899 (Assertion failure when a cancel callback returns an

invalid type during shutdown). (Weilin Du)

24 Sep 2026, PHP 8.6.0RC2

- Core:

. Fixed incorrect internal pointer and foreach iterator positions when

compacting arrays with holes. (Weilin Du)

. Fix handling of references to typed properties during unserialization

of various internal classes. (ndossche, timwolla)

. Fixed OSS-Fuzz 532353396 (assertion failure with static type). (Girgias)

. Fix GH-23662 (Avoid NAN warning in print_r()). (CodedByManish)

. Fixed bug GH-23752 (Use scoped diagnostic suppression for the global

register declarations so the caller's -Wvolatile-register-var state is

restored). (yqtian-se)

. Fixed OSS-Fuzz #538730793 (Assertion failure when returning by-ref from

closure invoke). (ndossche)

. Fixed OSS-Fuzz #540904105 (ASSERT: ast->attr == T_CLASS_C). (ndossche)

- CLI

. Fix GH-22567 (Windows ZTS CLI SAPI should refresh its TSRMLS cache during

request activation). (matyhtf)

. Fixed bug GH-23764 (Built-in server leaks a file descriptor on every HEAD

request for a static file). (jakubskopal)

- Date:

. Fix unserialization of Time\Duration. (timwolla)

. Add comparison handler for Time\Duration. (timwolla)

- DOM:

. Fixed use-after-free when re-constructing a DOMXPath whose php:function

registrations are freed while still reachable from the cycle collector.

(Ilia Alshanetsky)

. Fixed Dom\HTMLDocument::getElementById() not finding ids of SVG and

MathML elements. (Ilia Alshanetsky)

. Fixed Dom\HTMLDocument giving attributes the namespace of their element

when a fragment is parsed with an xlink, xml or xmlns context element.

(Ilia Alshanetsky)

- Fileinfo:

. Upgrade to file 5.48. (Weilin Du)

- Intl:

. Fixed cloning IntlDateFormatter and MessageFormatter losing PHP-side state

such as dateType, timeType, calendar and the message pattern.

(Ilia Alshanetsky)

. Fixed a crash when converting with a cloned UConverter that uses

toUCallback/fromUCallback. (Ilia Alshanetsky)

. Fixed Collator attribute and strength methods not rejecting an

unconstructed Collator. (Ilia Alshanetsky)

- Lexbor:

. Merge patches lexbor/lexbor@8a14bc0 and lexbor/lexbor@f67ce4b, fixing a

heap buffer overflow in :lexbor-contains() parsing and buffer overflows

in malformed decode replay. (alexandre-daubois)

- MBString:

. Fixed bug GH-23106 (mb_strpos() reads past the end of a haystack ending in

a truncated UTF-8 sequence). (Lazizbek Ergashev)

. Updated Unicode data tables to Unicode 18.0 (Yuya Hamada)

. Fixed mbstring functions emitting surrogates in UTF-8 output and flagging

it as valid UTF-8. (Nicolas Grekas)

- MySQLi:

. Fix GH-22854: Fixed failed assertion when accessing mysqli property after

failed reconnection. (Kamil Tekiela)

- Opcache:

. Fixed bug GH-23693 (Tracing JIT produces wrong results for a guard on a

loop-invariant addition). (Ilia Alshanetsky)

. Fixed OSS-Fuzz #545352966 (default value AST of an SHM-persisted partial).

(ndossche)

- PDO:

. Fixed PDOStatement::getColumnMeta() reading out of bounds for an invalid

column index. (Ilia Alshanetsky)

. Fixed PDOStatement::bindColumn() registering a binding for a column name

that is not in the result set. (Ilia Alshanetsky)

. Fixed bug GH-23962 (Destroying a persistent PDO instance rolls back a

transaction still in use by another instance). (Lazizbek Ergashev)

- PGSQL:

. Fixed pg_lo_write() rejecting data containing null bytes. (Ilia Alshanetsky)

- Posix:

. Reverted the validity check on the flags argument of posix_access().

(David Carlier)

- Readline:

. Fixed a heap over-read in the interactive shell prompt when cli.prompt is

set to an empty string. (Ilia Alshanetsky)

- Session:

. Fixed session_start() continuing after a failed create_sid() when

session.use_strict_mode rejects the supplied ID. (Ilia Alshanetsky)

. Fixed exceptions from user-defined create_sid() handlers being replaced

by return-value validation errors. (Ilia Alshanetsky)

- SPL:

. Fixed bug GH-23385 (SplDoublyLinkedList::serialize() use-after-free when

__serialize() removes an element). (David Carlier)

- SQLite:

. Fixed a crash when SQLite3::close() is called from a userland callback.

(Ilia Alshanetsky)

- Standard:

. Fixed bug #60110 (fclose(), file_put_contents(), copy() do not return false

properly). (Jakub Zelenka, Ilija Tovilo)

. Fixed three Windows-only proc_open() defects: an uninitialized

PROCESS_INFORMATION, an indeterminate comspec pointer after a failed

lookup, and an unchecked CreateFileA() failure. (Ilia Alshanetsky)

. Fix persistent stream context lifetime during shutdown (Levi Morrison)

. Fixed bug GH-23780 (unserialize('') fails silently). (timwolla)

- URI:

. Fix casing of enum cases in UriHostType and UrlHostType to match the RFC

and PHP’s naming policy. (timwolla)

- Zlib:

. Fixed inflate_init() dropping the preset dictionary for raw streams with

a non-default window. (Ilia Alshanetsky)

10 Sep 2026, PHP 8.6.0beta3

- BCMath:

. Fixed out-of-bounds read in bc_is_zero_for_scale() when scale exceeds

n_scale. (Ilia Alshanetsky)

- Core:

. Fixed out-of-bounds reads during automatic UTF-16/32 encoding detection.

(Yudai Takada)

. Calling is_a() or is_subclass_of() with a string as the first argument

when $allow_string is false is now deprecated. (Daniel Scherzer)

. Fixed bug GH-23232 (lone namespace separator asks the autoloader for an

empty class name). (spawnia)

. Enabled the TAILCALL VM (--disable-gcc-global-regs) when building with GCC >= 16.

(henderkes)

- CLI:

. Fixed bug GH-23242 (PHP development server does not support Expect

100-continue flow control). (Sjoerd Langkemper)

- Calendar:

. Fixed *tojd() functions and cal_to_jd() truncating arguments outside the

int range instead of rejecting them. (lacatoire)

- DOM:

. Fixed NamedNodeMap::getNamedItemNS() with an empty URI not matching

the null namespace in spec-following mode. (Ilia Alshanetsky)

. Fixed stale getElementsByClassName() and other node list caches after

className/classList writes and attribute removals. (Ilia Alshanetsky)

. Fixed reference cycles through DOMXPath and XSLTProcessor php:function

callback arguments and return values not being collectable.

(Ilia Alshanetsky)

- Hash:

. Fixed hash_file() reporting argument #1 ($algo) instead of argument #2

($filename) when the filename contains null bytes. (lacatoire)

- Intl:

. Fixed grapheme_strpos() and grapheme_strrpos() with an empty needle

returning UTF-16 offsets instead of grapheme offsets. (Ilia Alshanetsky)

. Fixed a memory leak when dumping IntlCalendar instances. (Ilia Alshanetsky)

. Fixed Collator::sortWithSortKeys() allocating fixed 2MiB buffers

regardless of array size. (Ilia Alshanetsky)

. Fixed a memory leak when iterating IntlBreakIterator::getPartsIterator()

results. (iliaal)

. Fixed a leak in Locale::getKeywords() when a keyword value cannot be

read. (iliaal)

. Fixed a use-after-free when IntlRuleBasedBreakIterator is constructed

from compiled rules. (iliaal)

. Fixed Spoofchecker methods not recording the ICU error code when an ICU

call fails. (Ilia Alshanetsky)

. Fixed idn_to_ascii() and idn_to_utf8() reporting argument #2 ($flags)

instead of argument #3 ($variant) for an invalid IDNA variant, and the

domain length error message printing a literal "d" instead of the limit.

(lacatoire)

- MBString:

. Fixed mb_ereg_replace() emitting a NUL or out-of-bounds bytes in the

replacement when a \k<name> backref has no closing delimiter.

(Ilia Alshanetsky)

- ODBC:

. Fixed odbc_field_len(), odbc_field_scale() and odbc_field_type()

returning uninitialized memory when SQLColAttribute fails.

(Ilia Alshanetsky)

. odbc_error() and odbc_errormsg() now also report SQLColAttribute

failures. (Ilia Alshanetsky)

- PCNTL:

. Fixed the declared signature of pcntl_signal(), whose $restart_syscalls

argument accepts null and defaults to it. (lacatoire)

- PDO_PGSQL:

. Added Pdo\Pgsql::ATTR_CHUNK_SIZE to fetch a result set in chunks of the

given number of rows. (KentarouTakeda)

- PGSQL:

. Fixed the pg_insert(), pg_update() and pg_delete() flag error messages,

which did not name the set of flags actually accepted. (lacatoire)

- Phar:

. Fixed bug GH-23418 (Use-after-free when looking up mounted directories).

(Weilin Du)

. Fixed bug GH-23477 (Memory leak on duplicate native Phar manifest entries).

(Weilin Du)

- Sockets:

. Fixed socket_set_option() with SO_ATTACH_REUSEPORT_CBPF and a zero value,

which detached the classic BPF filter instead of the reuseport program.

(David Carlier)

- SOAP:

. Fixed WSDL cache corruption when a soap:header defines headerfaults.

(Ilia Alshanetsky)

. Fixed stack overflow when parsing a WSDL with self-referential schema

groups or attributeGroups. (Ilia Alshanetsky)

- Sodium:

. Added support for the libsodium 1.0.22 KEM APIs (X-Wing and ML-KEM768).

(Zachary DuBois)

- Standard:

. Fixed a segfault when a stream filter callback unsets StreamBucket::$data

before re-attaching the bucket. (iliaal)

. Fixed an out-of-bounds read when following a redirect response with an

empty Location header. (iliaal)

. Fixed read buffer compaction in php_stream_filter_flush(). (crystarm)

. Io\Poll\Context::wait() now rejects a $maxEvents value greater than

INT_MAX instead of truncating it. (marc-mabe)

. Fixed GH-23338 (fsockopen()/pfsockopen() ValueError reported wrong

argument number for $timeout). (lacatoire)

. Fixed bug GH-23576 (Next index for array returned from array_keys() is

wrong). (Lazizbek Ergashev)

- SimpleXML:

. Fixed writing to a dimension of the object returned by attributes() not

creating the attribute. (Ilia Alshanetsky)

. Fixed child elements of the element returned by

SimpleXMLElement::addChild() not being accessible by property name when

namespaces are involved. (Ilia Alshanetsky)

- Streams:

. Added so_rcvbuf and so_sndbuf stream socket context options, setting the

socket receive and send buffer sizes in bytes. (David Carlier)

27 Aug 2026, PHP 8.6.0beta2

- Core:

. Fixed bug GH-15375 (Nested "yield from" skips items after a valid() or

next() call on the inner generator). (iliaal)

. Fixed GH-10497 (Allow direct mutation of objects stored in constants or

class constants via OBJ->prop = $val). (Khaled Alam)

. Reverted GH-22833, which attempted to fix bug GH-18985. (ilutov)

. Using the return statement in a finally block is now deprecated.

(aldemeery)

- Curl:

. Set content length using CURLOPT_POSTFIELDSIZE_LARGE instead of

CURLOPT_POSTFIELDSIZE. This makes it possible to post strings larger than

2GB on some platforms, e.g. Windows. (Sjoerd Langkemper)

- DOM:

. Fixed a typo in the DOMException message for INUSE_ATTRIBUTE_ERR.

(Weilin Du)

. Fixed bug GH-22624 (use-after-free via DOMNameSpaceNode after

DOMDocument::xinclude()). (David Carlier)

. Fixed a use-after-free when cloning a DOMNameSpaceNode after

DOMDocument::xinclude(). (iliaal)

. Fixed a crash in DOMXPath when a php:function callback receives a nodeset

and a later callback returns a node from another document. (iliaal)

. Fixed bug GH-23331 (UAF when node_list_unlink() skips attribute children

that still have a live wrapper). (iliaal)

. Fixed a use-after-free when Dom\Element::setAttributeNS() replaces the

value of an attribute whose child still has a live wrapper. (iliaal)

- GD:

. Fixed imageaffinematrixget() and imageaffinematrixconcat() reporting the

wrong argument in error messages. (Weilin Du)

. Fixed imageaffinematrixget() to enforce the documented array|float type

for the $options parameter. (Weilin Du)

- Intl:

. Fixed grapheme_strrev() treating UBRK_DONE as a byte index and leaving

the result without a terminating NUL. (iliaal)

. Fixed a double-free when IntlGregorianCalendar construction fails after

the ICU constructor adopts the TimeZone. (iliaal)

. Fixed bug GH-23094 (NumberFormatter parsing offsets use UTF-16 positions

for UTF-8 strings). (ColumbusLabs)

. Fixed Locale::parseLocale() reading past a trailing '-' or '_'.

(iliaal, Xuyang Zhang)

. Fixed grapheme_str_split() treating UBRK_DONE as a byte index. (iliaal)

- Opcache:

. Fixed a tracing JIT crash when compiling a side trace for a method of a

class that could not be stored in the inheritance cache. (GH-21710)

(Arnaud, iliaal)

- PDO:

. Fixed a leak when a persistent connection failed a liveness check

with no other live PDO handle. (iliaal)

- PDO_PGSQL:

. Fixed several lazy fetch (PDO::ATTR_PREFETCH => 0) defects: an infinite

loop when cleaning up a fetch left in a COPY, a use-after-free when a

statement with emulated or disabled prepares is destroyed, a connection

left busy for the next fetch, and rows delivered from a result another

statement took over. (KentarouTakeda)

- PGSQL:

. Fixed the class name casing of pg_close_stmt()'s connection parameter.

(lacatoire)

- Phar:

. Fixed Phar archives being automatically detected when ".phar" only occurs

in a directory name or is not a filename extension in an included file's

path. (Weilin Du)

- Readline:

. Fixed class constant completion in the interactive shell. (Weilin Du)

- Zip:

. Fixed bug GH-23276 (ZipArchive subclass storing its own stream cannot be

garbage collected). (Weilin Du, ndossche)

- SAPI:

. Fixed fuzzer targets failing to build in isolation. (Mrmaxmeier)

. Fixed returns uninitialized value on LiteSpeed lsapi SAPI (Go Kudo)

- Session:

. Fixed bug GH-23056 (missing handler name in session write warning).

(lazerg)

. SessionHandler::validateId() is now implemented, so

session.use_strict_mode applies to the built-in handler. (Girgias)

. It is now deprecated to pass an object that does not implement the

create_sid() and validateId() methods. (Girgias)

. A deprecation is now emitted when implementing SessionHandlerInterface on a

class which doesn't define the create_sid() or validateId() methods, as

those will be moved from SessionUpdateTimestampHandlerInterface and

SessionIdInterface to SessionHandlerInterface. (Girgias)

- SNMP:

. It is now possible to use the AES192, AES192C, AES256, and AES256C as

SNMPv3 security protocols if the underlying library supports them.

(eskyuu)

. It is now possible to reset the MIB tree using the new snmp_init_mib()

function. (eskyuu)

. Additional MIB parsing and output control functionality has been exposed

via the snmp_set_mib_option(), snmp_set_output_option(),

snmp_set_string_output_format() functions, the $numeric_index,

$numeric_timeticks, $extended_index, $dont_print_units, $escape_quotes,

$print_hex_text SNMP properties, and the SNMP::setOidOutputFormat(),

SNMP::setStringOutputFormat() methods. (eskyuu)

- Sodium:

. Fixed incorrect parameter name in sodium_add(), sodium_memcmp(), and

sodium_compare() length-mismatch error messages. (lacatoire)

- SPL:

. The following SplFileObject methods have been deprecated

SplFileObject::fgetcsv(), SplFileObject::fputcsv(),

SplFileObject::setCsvControl(), and SplFileObject::getCsvControl().

(Girgias)

- Standard: