PHP

Latest 8.5.12 Oct 21, 2026

Latest per track

Track	Latest	Released
8.5	8.5.12	Oct 21, 2026
8.4	8.4.27	Oct 21, 2026
8.3	8.3.36	Oct 21, 2026
8.2	8.2.35	Oct 21, 2026

Lifecycle

Branch	Latest	Released	End of life
8.5	8.5.12	Nov 20, 2025	Dec 31, 2029 · maintained
8.4	8.4.27	Nov 21, 2024	Dec 31, 2028 · maintained
8.3	8.3.36	Nov 23, 2023	Dec 31, 2027 · maintained
8.2	8.2.35	Dec 8, 2022	Dec 31, 2026 · maintained
8.1	8.1.34	Nov 25, 2021	Dec 31, 2025 · ended
8.0	8.0.30	Nov 26, 2020	Nov 26, 2023 · ended
7.4	7.4.33	Nov 28, 2019	Nov 28, 2022 · ended
7.3	7.3.33	Dec 6, 2018	Dec 6, 2021 · ended
7.2	7.2.34	Nov 30, 2017	Nov 30, 2020 · ended
7.1	7.1.33	Dec 1, 2016	Dec 1, 2019 · ended
7.0	7.0.33	Dec 3, 2015	Jan 10, 2019 · ended
5.6	5.6.40	Aug 28, 2014	Dec 31, 2018 · ended
5.5	5.5.38	Jun 20, 2013	Jul 21, 2016 · ended
5.4	5.4.45	Mar 1, 2012	Sep 14, 2015 · ended
5.3	5.3.29	Jun 30, 2009	Aug 14, 2014 · ended
5.2	5.2.17	Nov 2, 2006	Jan 6, 2011 · ended
5.1	5.1.6	Nov 24, 2005	Aug 24, 2006 · ended
5.0	5.0.5	Jul 13, 2004	Sep 5, 2005 · ended

Recent releases

8.5.12 Oct 21, 2026 Release notes ↗ 2security

securityFixes CVE-2026-109618: RCE via OOM corruption

securityFixes CVE-2026-109619: RCE via stale global state

8.5.11 Sep 24, 2026 → 8.5.12 Release notes ↗ 11security

securityFixes CVE-2026-91765: SOAP: Unbounded Recursion in Server-Side cleanup_xml_node

securityFixes CVE-2026-17545: PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS

securityFixes CVE-2026-91768: IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)

8.5.10 Aug 28, 2026 → 8.5.12 Release notes ↗ 1security

securityFixes GHSA-ch8v-r6jh-4vvr: ext/filter: encode 0xFF in FILTER_SANITIZE_ENCODED

8.5.9 Jul 30, 2026 → 8.5.12 Release notes ↗ 3security

securityFixes CVE-2026-7260: Stack overflow in phar with circular symlinks

securityFixes CVE-2026-17544: Out-of-bounds write in bccomp() via crafted operand and scale

securityFixes CVE-2026-17543: SQL injection in ext-pgsql via E'...' backslash breakout

8.5.8 Jul 3, 2026 → 8.5.12 Release notes ↗ 1security

securityFixes CVE-2026-14355: ext/openssl: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD

8.5.7 Jun 4, 2026 → 8.5.12 Release notes ↗

8.5.6 May 7, 2026 → 8.5.12 Release notes ↗ 11security

securityFixes CVE-2026-6722: Use-After-Free in SOAP using Apache map with Remote Code Execution

securityFixes CVE-2025-14179: SQL injection in pdo_firebird via NUL bytes in quoted strings

securityFixes CVE-2026-12184: Failure to setup TLS with a remote server can result in a remote DoS

8.5.5 Apr 9, 2026 → 8.5.12 Release notes ↗

8.5.4 Mar 12, 2026 → 8.5.12 Release notes ↗

8.5.3 Feb 12, 2026 → 8.5.12 Release notes ↗

8.5.2 Feb 6, 2026 → 8.5.12 Release notes ↗

8.5.1 Dec 18, 2025 → 8.5.12 Release notes ↗ 4security

securityFixes CVE-2025-14178: Heap buffer overflow in array_merge()

securityFixes CVE-2025-14180: NULL Pointer Dereference in PDO quoting

securityFixes CVE-2025-14177: Information Leak of Memory in getimagesize

8.5.0 Nov 20, 2025 → 8.5.12 Release notes ↗

8.4.27 Oct 21, 2026 → 8.5.12 Release notes ↗ 2security

securityFixes CVE-2026-109618: RCE via OOM corruption

securityFixes CVE-2026-109619: RCE via stale global state

8.4.26 Sep 24, 2026 → 8.5.12 Release notes ↗ 11security

securityFixes CVE-2026-91765: SOAP: Unbounded Recursion in Server-Side cleanup_xml_node

securityFixes CVE-2026-17545: PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS

securityFixes CVE-2026-91768: IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)

Security advisories

9.2 CVE-2026-109618 RCE via OOM corruption

9.2 CVE-2026-109619 RCE via stale global state

5.3 CVE-2026-93682 Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header

5.9 CVE-2026-92842 OOB read / info leak in convert.* stream filters when line-break-chars contains NUL

3.7 GHSA-ch8v-r6jh-4vvr ext/filter: encode 0xFF in FILTER_SANITIZE_ENCODED

6.5 CVE-2026-91768 IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)

4.3 CVE-2026-91769 TLS Hostname Verification Falls Back to CN After SAN Mismatch

6.5 CVE-2026-91767 Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN

3.1 CVE-2025-1218 Various packet overreads in mysqlnd_writeprotocol.c

5.9 CVE-2026-91766 Cross-origin credential leak in HTTP stream wrapper redirects

7.5 CVE-2026-91765 SOAP: Unbounded Recursion in Server-Side cleanup_xml_node

6.5 CVE-2025-14181 Integer overflow to buffer overflow in soap HTTP parsing

4.0 CVE-2026-6103 Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection

6.9 CVE-2026-17545 PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS

5.5 CVE-2026-7260 Stack overflow in phar with circular symlinks

high CVE-2026-17544 Out-of-bounds write in bccomp() via crafted operand and scale

high CVE-2026-17543 SQL injection in ext-pgsql via E'...' backslash breakout

8.2 CVE-2026-12184 Failure to setup TLS with a remote server can result in a remote DoS

4.8 CVE-2026-14355 ext/openssl: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD

6.3 CVE-2026-7262 NULL pointer dereference in SOAP apache:Map decoder with missing <value>

Sources

github https://github.com/php/php-src/releases
ghsa https://github.com/php/php-src/security/advisories
endoflife https://endoflife.date/php