ZendPHP April 2026 Releases

Community Changes

ZendPHP 8.5.5 Changes

• Core
  • Fixed bug GH-20672 (Incorrect property_info sizing for locally shadowed trait properties). (ilutov)
  • Fixed bugs GH-20875, GH-20873, GH-20854 (Propagate IN_GET guard in get_property_ptr_ptr for lazy proxies). (iliaal)
• Bz2
  • Fix truncation of total output size causing erroneous errors. (ndossche)
• DOM
  • Fixed bug GH-21486 (Dom\HTMLDocument parser mangles xml:space and xml:lang attributes). (ndossche)
• FFI
  • Fixed resource leak in FFI::cdef() onsymbol resolution failure. (David Carlier)
• GD
  • Fixed bug GH-21431 (phpinfo() to display libJPEG 10.0 support). (David Carlier)
• Opcache
  • Fixed bug GH-21052 (Preloaded constant erroneously propagated to file-cached script). (ilutov)
  • Fixed bug GH-20838 (JIT compiler produces wrong arithmetic results). (Dmitry, iliaal)
  • Fixed bug GH-21267 (JIT tracing: infinite loop on FETCH_OBJ_R with IS_UNDEF property in polymorphic context). (Dmitry, iliaal)
  • Fixed bug GH-21395 (uaf in jit). (ndossche)
• OpenSSL
  • Fixed bug GH-21083 (Skip private_key_bits validation for EC/curve-based keys). (iliaal)
  • Fix missing error propagation for BIO_printf() calls. (ndossche)
• PCNTL
  • Fixed signal handler installation on AIX by bumping the storage size of the num_signals global. (Calvin Buckley)
• PCRE
  • Fixed re-entrancy issue on php_pcre_match_impl, php_pcre_replace_impl, php_pcre_split_impl, and php_pcre_grep_impl. (David Carlier)
• Phar
  • Fixed bug GH-21333 (use after free when unlinking entries during iteration of a compressed phar). (David Carlier)
• SNMP
  • Fixed bug GH-21336 (SNMP::setSecurity() undefined behavior with NULL arguments). (David Carlier)
• SOAP
  • Fixed Set-Cookie parsing bug wrong offset while scanning attributes. (David Carlier)
• SPL
  • Fixed bug GH-21454 (missing write lock validation in SplHeap). (ndossche)
• Standard
  • Fixed bug GH-20906 (Assertion failure when messing up output buffers). (ndossche)
  • Fixed bug GH-20627 (Cannot identify some avif images with getimagesize). (y-guyon)
• Sysvshm
  • Fix memory leak in shm_get_var() when variable is corrupted. (ndossche)
• XSL
  • Fix GH-21357 (XSLTProcessor works with DOMDocument, but fails with Dom\XMLDocument). (ndossche)
  • Fixed bug GH-21496 (UAF in dom_objects_free_storage). (David Carlier/ndossche)

ZendPHP 8.4.20 Changes

• Bz2

  • Fix truncation of total output size causing erroneous errors. (ndossche)

• Core

  • Fixed bugs GH-20875, GH-20873, GH-20854 (Propagate IN_GET guard in get_property_ptr_ptr for lazy proxies). (iliaal)

• DOM

  • Fixed bug GH-21486 (Dom\HTMLDocument parser mangles xml:space and xml:lang attributes). (ndossche)

• FFI

  • Fixed resource leak in FFI::cdef() onsymbol resolution failure. (David Carlier)

• GD

  • Fixed bug GH-21431 (phpinfo() to display libJPEG 10.0 support). (David Carlier)

• Opcache

  • Fixed bug GH-20838 (JIT compiler produces wrong arithmetic results). (Dmitry, iliaal)
  • Fixed bug GH-21267 (JIT tracing: infinite loop on FETCH_OBJ_R with IS_UNDEF property in polymorphic context). (Dmitry, iliaal)
  • Fixed bug GH-21395 (uaf in jit). (ndossche)

• OpenSSL

  • Fixed bug GH-21083 (Skip private_key_bits validation for EC/curve-based keys). (iliaal)
  • Fix missing error propagation for BIO_printf() calls. (ndossche)

• PCRE

  • Fixed re-entrancy issue on php_pcre_match_impl, php_pcre_replace_impl, php_pcre_split_impl, and php_pcre_grep_impl. (David Carlier)

• PGSQL

  • Fixed preprocessor silently guarding PGSQL_SUPPRESS_TIMESTAMPS support due to a typo. (KentarouTakeda)

• SNMP

  • Fixed bug GH-21336 (SNMP::setSecurity() undefined behavior with NULL arguments). (David Carlier)

• SOAP

  • Fixed Set-Cookie parsing bug wrong offset while scanning attributes. (David Carlier)

• SPL** . Fixed bug GH-21454 (missing write lock validation in SplHeap). (ndossche)

• Standard

  • Fixed bug GH-20906 (Assertion failure when messing up output buffers). (ndossche)
  • Fixed bug GH-20627 (Cannot identify some avif images with getimagesize). (y-guyon)

• Sysvshm

  • Fix memory leak in shm_get_var() when variable is corrupted. (ndossche)

• XSL

  • Fix GH-21357 (XSLTProcessor works with DOMDocument, but fails with Dom\XMLDocument). (ndossche)
  • Fixed bug GH-21496 (UAF in dom_objects_free_storage). (David Carlier/ndossche)