PHP 8.5.7 → 8.5.10
3 releases · 0 breaking changes · 5 security fixes · 5 advisories fixed
5security0breaking0deprecated0feature0fix
Vulnerabilities fixed by this upgrade
- 3.7 GHSA-ch8v-r6jh-4vvr ext/filter: encode 0xFF in FILTER_SANITIZE_ENCODED
- 5.5 CVE-2026-7260 Stack overflow in phar with circular symlinks
- high CVE-2026-17544 Out-of-bounds write in bccomp() via crafted operand and scale
- high CVE-2026-17543 SQL injection in ext-pgsql via E'...' backslash breakout
- 4.8 CVE-2026-14355 ext/openssl: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD
Breaking changes
None in the release notes.
Security changes
- security Fixes GHSA-ch8v-r6jh-4vvr: ext/filter: encode 0xFF in FILTER_SANITIZE_ENCODED in 8.5.10
- security Fixes CVE-2026-7260: Stack overflow in phar with circular symlinks in 8.5.9
- security Fixes CVE-2026-17544: Out-of-bounds write in bccomp() via crafted operand and scale in 8.5.9
- security Fixes CVE-2026-17543: SQL injection in ext-pgsql via E'...' backslash breakout in 8.5.9
- security Fixes CVE-2026-14355: ext/openssl: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD in 8.5.8
Every release in between
securityFixes GHSA-ch8v-r6jh-4vvr: ext/filter: encode 0xFF in FILTER_SANITIZE_ENCODED
securityFixes CVE-2026-7260: Stack overflow in phar with circular symlinks
securityFixes CVE-2026-17544: Out-of-bounds write in bccomp() via crafted operand and scale
securityFixes CVE-2026-17543: SQL injection in ext-pgsql via E'...' backslash breakout
securityFixes CVE-2026-14355: ext/openssl: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD