PHP 8.5.3 → 8.5.10

Vulnerabilities fixed by this upgrade

• 3.7 GHSA-ch8v-r6jh-4vvr ext/filter: encode 0xFF in FILTER_SANITIZE_ENCODED
• 5.5 CVE-2026-7260 Stack overflow in phar with circular symlinks
• high CVE-2026-17544 Out-of-bounds write in bccomp() via crafted operand and scale
• high CVE-2026-17543 SQL injection in ext-pgsql via E'...' backslash breakout
• 8.2 CVE-2026-12184 Failure to setup TLS with a remote server can result in a remote DoS
• 4.8 CVE-2026-14355 ext/openssl: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD
• 6.3 CVE-2026-7262 NULL pointer dereference in SOAP apache:Map decoder with missing <value>
• 6.3 CVE-2026-7261 SoapServer session-persisted object use-after-free via SOAP header fault
• low CVE-2026-7259 Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()
• 7.6 CVE-2026-6735 XSS within PHP-FPM status endpoint
• 9.4 CVE-2026-6722 Use-After-Free in SOAP using Apache map with Remote Code Execution
• 6.3 CVE-2026-7258 Out-of-bounds read in urldecode()
• 6.3 CVE-2026-6104 Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding
• 9.2 CVE-2025-14179 SQL injection in pdo_firebird via NUL bytes in quoted strings
• low CVE-2026-7568 Signed integer overflow in metaphone()
• 8.2 CVE-2026-7263 DoS attack via DOMNode::C14N()

Breaking changes

None in the release notes.

Security changes

• security Fixes GHSA-ch8v-r6jh-4vvr: ext/filter: encode 0xFF in FILTER_SANITIZE_ENCODED in 8.5.10
• security Fixes CVE-2026-7260: Stack overflow in phar with circular symlinks in 8.5.9
• security Fixes CVE-2026-17544: Out-of-bounds write in bccomp() via crafted operand and scale in 8.5.9
• security Fixes CVE-2026-17543: SQL injection in ext-pgsql via E'...' backslash breakout in 8.5.9
• security Fixes CVE-2026-14355: ext/openssl: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD in 8.5.8
• security Fixes CVE-2026-6722: Use-After-Free in SOAP using Apache map with Remote Code Execution in 8.5.6
• security Fixes CVE-2025-14179: SQL injection in pdo_firebird via NUL bytes in quoted strings in 8.5.6
• security Fixes CVE-2026-12184: Failure to setup TLS with a remote server can result in a remote DoS in 8.5.6
• security Fixes CVE-2026-7263: DoS attack via DOMNode::C14N() in 8.5.6
• security Fixes CVE-2026-6735: XSS within PHP-FPM status endpoint in 8.5.6
• security Fixes CVE-2026-7262: NULL pointer dereference in SOAP apache:Map decoder with missing <value> in 8.5.6
• security Fixes CVE-2026-7261: SoapServer session-persisted object use-after-free via SOAP header fault in 8.5.6
• security Fixes CVE-2026-7258: Out-of-bounds read in urldecode() in 8.5.6
• security Fixes CVE-2026-6104: Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding in 8.5.6
• security Fixes CVE-2026-7259: Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() in 8.5.6
• security Fixes CVE-2026-7568: Signed integer overflow in metaphone() in 8.5.6

Every release in between