ZendPHP July 2026 Releases

Community Changes

PHP 8.5.8

  • Core
    • Fixed bug GH-22280 (Incorrect compile error for goto to label preceding try/finally block). (Pratik Bhujel)
    • Fixed bug GH-22112 (Assertion when error handler throws during NaN to bool/string coercion). (iliaal)
  • BCMath
    • Fixed issues with oversized allocations and signed overflow in bcround() and BcMath\Number::round(). (edorian)
  • Date
    • Fix incorrect recurrence check of DatePeriod::createFromISO8601String(). (ndossche)
  • Exif
    • Read correct value for single and double tags. (ndossche)
  • GD
    • Fixed bug GH-22121 (Double free in gdImageSetStyle() after overflow-triggered early return). (iliaal)
  • Intl
    • Fix incorrect argument positions for invalid start/end arguments in transliterator_transliterate(). (Weilin Du)
    • Fixed IntlTimeZone::getDisplayName() to synchronize object error state for invalid display types. (Weilin Du)
  • Lexbor
    • Merge patch c3a6847. (ilutov, timwolla)
  • Opcache
    • Fixed bug GH-22265 (Another tailcall vm_interrupt bug). (Levi Morrison)
    • Fixed bug GH-20469 (Unsafe inheritance cache replay with reentrant autoloading). (Levi Morrison)
    • Fixed bug GH-21972 (Corrupted variable type when a typed by-value return contains a reference wrapper). (Weilin Du)
  • OpenSSL
    • Fixed bug GH-22187 (Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD). (CVE-2026-14355) (David Carlier)
  • Phar
    • Fixed a bypass of the magic .phar directory protection in Phar::addEmptyDir() for paths starting with /.phar, while allowing non-magic directory names that merely share the .phar prefix. (Weilin Du)
    • Fixed an integer underflow when parsing ZIP extra fields. (Weilin Du)
  • Reflection
    • Preserve class-name case in ReflectionClass::getProperty() error messages and autoloading. (jorgsowa)
  • SOAP
    • Fixed bug GH-22218 (SoapServer::handle() crash on $_SERVER not being an array). (David Carlier / Rex-Reynolds)
    • Fixed bug GH-22285 (Soap server requires the raw input to be passed to $server->handle). (David Carlier / ndossche)
  • Sqlite
    • Fix error checks for column retrieval. (ndossche)
  • URI
    • Add LEXBOR_STATIC to CFLAGS_URI on Windows so ext/uri does not see LXB_API as __declspec(dllimport) when linked statically into PHP. (Luther Monson)
    • Clean error logs before each Uri\WhatWg\Url wither call so that errors from previous wither calls are not returned the next time a UrlValidationError is thrown. (kocsismate)
  • Zip
    • Fixed error-related memory leaks. (ndossche)
  • Zlib
    • Fixed memory leak if deflate initialization fails and there is a dict. (ndossche)
    • Fixed memory leak in inflate_add(). (ndossche)

PHP 8.4.23

  • Core
    • Fixed bug GH-22280 (Incorrect compile error for goto to label preceding try/finally block). (Pratik Bhujel)
    • Fixed bug GH-22290 (AST pretty printing does not correctly handle strings containing NUL). (iliaal)
  • BCMath
    • Fixed issues with oversized allocations and signed overflow in bcround() and BcMath\Number::round(). (edorian)
  • Date
    • Fix incorrect recurrence check of DatePeriod::createFromISO8601String(). (ndossche)
  • DOM
    • Fix GH-22219 (Dom\XMLDocument::schemaValidate fails to resolve xs:QName with prefix from imported schema). (David Carlier)
  • Exif
    • Read correct value for single and double tags. (ndossche)
  • GD
    • Fixed bug GH-22121 (Double free in gdImageSetStyle() after overflow-triggered early return). (iliaal)
    • Fixed bug GH-19666 (imageconvolution() unexpected nan filter value). (David Carlier)
    • Fixed bug GH-19739 (imageellipse/imagefilledellipse overflow). (David Carlier)
    • Fixed bug GH-19730 (imageaffine overflow). (David Carlier)
  • Intl
    • Fix incorrect argument positions for uninitialized calendar arguments in IntlCalendar::equals(), ::before(), ::after(), and ::isEquivalentTo(), and for invalid start/end arguments in transliterator_transliterate(). (Weilin Du)
    • Fixed IntlTimeZone::getDisplayName() to synchronize object error state for invalid display types. (Weilin Du)
    • Fixed Spoofchecker restriction-level APIs to only be exposed with ICU 53 and later. (Graham Campbell)
  • mysqli
    • Fix stmt->query leak in mysqli_execute_query() validation errors. (David Carlier)
  • Opcache
    • Fixed bug GH-20469 (Unsafe inheritance cache replay with reentrant autoloading). (Levi Morrison)
    • Fixed bug GH-22158 (Tracing JIT dispatches the observer begin handler through the wrong run_time_cache slot on megamorphic calls). (ptondereau, iliaal)
  • OpenSSL
    • Fixed bug GH-22187 (Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD). (CVE-2026-14355) (David Carlier)
  • Phar
    • Fixed a bypass of the magic .phar directory protection in Phar::addEmptyDir() for paths starting with /.phar, while allowing non-magic directory names that merely share the .phar prefix. (Weilin Du)
    • Fixed an integer underflow when parsing ZIP extra fields. (Weilin Du)
  • Reflection
    • Preserve class-name case in ReflectionClass::getProperty() error messages and autoloading. (jorgsowa)
  • Sqlite
    • Fix error checks for column retrieval. (ndossche)
  • Zlib
    • Fixed memory leak if deflate initialization fails and there is a dict. (ndossche)
    • Fixed memory leak in inflate_add(). (ndossche)
  • Zip
    • Fixed error-related memory leaks. (ndossche)

PHP 8.3.32

  • Streams
    • Fixed bug GH-21468 (Segfault in file_get_contents w/ a https URL and a proxy set). (CVE-2026-12184) (ndossche)
  • OpenSSL
    • Fixed bug GH-22187 (Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD). (CVE-2026-14355) (David Carlier)

PHP 8.2.32

  • OpenSSL
    • Fixed bug GH-22187 (Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD). (CVE-2026-14355) (David Carlier)

Security Changes

ZendPHP 8.1.34.2

  • OpenSSL
    • Fixed bug GH-22187 (Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD). (CVE-2026-14355) (David Carlier)

ZendPHP 7.4.33.14

  • OpenSSL
    • Fixed bug GH-22187 (Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD). (CVE-2026-14355) (David Carlier)

ZendPHP 7.3.33.20

  • OpenSSL
    • Fixed bug GH-22187 (Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD). (CVE-2026-14355) (David Carlier)

ZendPHP 7.2.34.28

  • OpenSSL
    • Fixed bug GH-22187 (Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD). (CVE-2026-14355) (David Carlier)