ZendPHP June 2026 Releases

Community Changes

PHP 8.5.7

  • CLI
    • Fixed bug GH-21901: Stale getopt() optional value. (onthebed)
  • Core
    • Fixed bug GH-22071: JIT assertion on abstract static method call. (David Carlier)
  • Date
    • Fixed bug GH-18422: int overflow in php_date_llabs. (iliaal)
  • DOM
    • Fixed bug GH-22077: UAF in custom XPath function. (afflerbach/David Carlier)
  • Opcache
    • Fixed tracing JIT crash when a VM interrupt is handled during an observed user function call. (Levi Morrison)
    • Fixed bug GH-21746: Segfault with tracing JIT. (Arnaud)
    • Fixed bug GH-22004: Assertion failure at ext/opcache/jit/zend_jit_trace.c. (Arnaud)
    • Fixed tailcall VM crash when a VM interrupt is handled from a VM helper. (Levi Morrison, Arnaud)
  • OpenSSL
    • Fix compatibility issues with OpenSSL 4.0. (jordikroon, Remi)
  • Standard
    • Fixed bug GH-21689: version_compare() incorrectly handles versions ending with a dot. (timwolla)
  • URI
    • Fixed CVE-2026-44927: In uriparser before 1.0.2, there is pointer difference truncation to int in various places. (Sebastian Pipping)
    • Fixed CVE-2026-44928: In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal. (Sebastian Pipping)

PHP 8.4.22

  • Date

    • Fixed bug GH-18422: int overflow in php_date_llabs. (iliaal)

  • Intl

    • Fix incorrect argument positions in out-of-bounds errors for IntlCalendar::set(), IntlCalendar::setDate(), IntlCalendar::setDateTime(), and IntlGregorianCalendar date/time construction. (Weilin Du)
    • Expose Spoofchecker restriction-level APIs on all supported ICU versions. (Weilin Du)
    • Fix SpoofChecker::setAllowedChars() and IntlDateFormatter::__construct() to report PHP constant names instead of ICU constant names in user-visible error messages. (Weilin Du)

  • MySQLnd

    • Fix persistent free of non-persistent connect_attr key (David Carlier).

  • Opcache

    • Fixed tracing JIT crash when a VM interrupt is handled during an observed user function call. (Levi Morrison)
    • Fixed bug GH-22004: Assertion failure at ext/opcache/jit/zend_jit_trace.c. (Arnaud)

  • OpenSSL

    • Fix compatibility issues with OpenSSL 4.0. (jordikroon, Remi)

  • Phar

    • Fixed bug GH-21986: PharData::getContent() crash on infinite recursion with symlinks. (David Carlier)

  • SOAP

    • Fixed integer overflow when decoding SOAP array indexes. (Weilin Du)

  • SPL

    • Fix SplFixedArray::setSize leak when destructor grows during clear. (David Carlier)
    • Fixed bug GH-21933: use after free of self-freeing MultipleIterator children. (David Carlier)

  • Standard

    • Fixed bug GH-21689: version_compare() incorrectly handles versions ending with a dot. (timwolla)
    • Fixed ip2long() leading zeros handling inconsistency on AIX. (ayappanec)