PHP 8.4.27 → 8.5.12

Breaking changes

None in the release notes.

Security changes

• security Fixes CVE-2026-109618: RCE via OOM corruption in 8.5.12
• security Fixes CVE-2026-109619: RCE via stale global state in 8.5.12
• security Fixes CVE-2026-91765: SOAP: Unbounded Recursion in Server-Side cleanup_xml_node in 8.5.11
• security Fixes CVE-2026-17545: PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS in 8.5.11
• security Fixes CVE-2026-91768: IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes) in 8.5.11
• security Fixes CVE-2026-91767: Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN in 8.5.11
• security Fixes CVE-2025-14181: Integer overflow to buffer overflow in soap HTTP parsing in 8.5.11
• security Fixes CVE-2026-92842: OOB read / info leak in convert.* stream filters when line-break-chars contains NUL in 8.5.11
• security Fixes CVE-2026-91766: Cross-origin credential leak in HTTP stream wrapper redirects in 8.5.11
• security Fixes CVE-2026-93682: Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header in 8.5.11
• security Fixes CVE-2026-91769: TLS Hostname Verification Falls Back to CN After SAN Mismatch in 8.5.11
• security Fixes CVE-2026-6103: Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection in 8.5.11
• security Fixes CVE-2025-1218: Various packet overreads in mysqlnd_writeprotocol.c in 8.5.11
• security Fixes GHSA-ch8v-r6jh-4vvr: ext/filter: encode 0xFF in FILTER_SANITIZE_ENCODED in 8.5.10
• security Fixes CVE-2026-7260: Stack overflow in phar with circular symlinks in 8.5.9
• security Fixes CVE-2026-17544: Out-of-bounds write in bccomp() via crafted operand and scale in 8.5.9
• security Fixes CVE-2026-17543: SQL injection in ext-pgsql via E'...' backslash breakout in 8.5.9
• security Fixes CVE-2026-14355: ext/openssl: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD in 8.5.8
• security Fixes CVE-2026-6722: Use-After-Free in SOAP using Apache map with Remote Code Execution in 8.5.6
• security Fixes CVE-2025-14179: SQL injection in pdo_firebird via NUL bytes in quoted strings in 8.5.6
• security Fixes CVE-2026-12184: Failure to setup TLS with a remote server can result in a remote DoS in 8.5.6
• security Fixes CVE-2026-7263: DoS attack via DOMNode::C14N() in 8.5.6
• security Fixes CVE-2026-6735: XSS within PHP-FPM status endpoint in 8.5.6
• security Fixes CVE-2026-7262: NULL pointer dereference in SOAP apache:Map decoder with missing <value> in 8.5.6
• security Fixes CVE-2026-7261: SoapServer session-persisted object use-after-free via SOAP header fault in 8.5.6
• security Fixes CVE-2026-7258: Out-of-bounds read in urldecode() in 8.5.6
• security Fixes CVE-2026-6104: Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding in 8.5.6
• security Fixes CVE-2026-7259: Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() in 8.5.6
• security Fixes CVE-2026-7568: Signed integer overflow in metaphone() in 8.5.6
• security Fixes CVE-2025-14178: Heap buffer overflow in array_merge() in 8.5.1
• security Fixes CVE-2025-14180: NULL Pointer Dereference in PDO quoting in 8.5.1
• security Fixes CVE-2025-14177: Information Leak of Memory in getimagesize in 8.5.1
• security Fixes GHSA-www2-q4fc-65wf: Null byte termination in dns_get_record() in 8.5.1

Every release in between