ZendPHP October 2026 Second Release

Security Release

This release is a coordinated security release with the PHP Security Team. While there are other changes present in these releases, the important pieces are around 2 Critical severity RCE (remote code execution) vulnerabilities:

  • RCE via OOM corruption, CVE-2026-109618 (GHSA-w8hw-w9fx-j79w): out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
  • RCE via stale global state, CVE-2026-109619 (GHSA-6wmf-4rv5-p3rp): request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.

Each of the following versions has been patched to mitigate these issues:

  • 8.5.12
  • 8.4.27
  • 8.3.36
  • 8.2.35
  • 8.1.34.4
  • 7.4.33.17
  • 7.3.33.23
  • 7.2.34.31

Community Releases

PHP 8.5.12

  • Core
    • Fixed GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp (Avoid state corruption via bailout).
    • Fixed bug GH-23644 (Optimizer leaves a constant-vs-constant comparison unfolded, crashing the VM in zval_undefined_cv).
    • Fixed OSS-Fuzz 532353396 (assertion failure with static type).
    • Fix GH-23662 (Avoid NAN warning in print_r()).
    • Fix GH-21999: GC inconsistency with lazy object, var_dump(), and object comparison.
    • Fixed OSS-Fuzz #536440507 (Immutable class incorrect assertion).
    • Fixed AVX being reported as supported when the OS has not enabled AVX state.
    • Fixed GH-23980 (ZEND_ASSERT violation @ ZEND_INCLUDE_OR_EVAL).
    • Fixed use-after-free when a dl()-loaded extension declares a frameless function and a later request calls it.
    • Fixed System V shared memory emulation for Windows attaching segments past the end of their mapping.
    • Fixed exception thrown by destructor during GC in a Fiber not being rethrown into the frame that triggered the GC.
  • BCMath
    • Fixed BcMath\Number results that truncate to zero keeping a negative sign and comparing less than zero.
  • BZ2
    • Fixed double close of the descriptor and use-after-free of the inner stream when bzopen() is given a stream resource.
  • CLI
    • Fix GH-22567 (Windows ZTS CLI SAPI should refresh its TSRMLS cache during request activation).
    • Fixed bug GH-23764 (Built-in server leaks a file descriptor on every HEAD request for a static file).
    • Fixed crash in the built-in server when a client is reset before being accepted.
    • Fixed the built-in server truncating an error page and leaking its unsent part after a partial socket write.
  • DOM
    • Fixed use-after-free when re-constructing a DOMXPath whose php:function registrations are freed while still reachable from the cycle collector.
    • Fixed Dom\HTMLDocument::getElementById() not finding ids of SVG and MathML elements.
    • Fixed Dom\HTMLDocument giving attributes the namespace of their element when a fragment is parsed with an xlink, xml or xmlns context element.
    • Fixed bug GH-23887 (Dom\HTMLCollection::namedItem() assertion failure, hang, or missed first element).
    • Fixed DOMXPath and Dom\XPath losing the context node and in-scope namespaces of an evaluation after a php:function() callback evaluated another expression on the same object.
  • FFI
    • Fixed crashes with FFI callbacks created from __call() trampolines and array callables whose object is released.
  • FTP
    • Fixed bug GH-23619 (cryptic error on servers that don't support TLS session resumption on data connection).
  • GD
    • Fixed undefined behavior with GD2 images with INT_MAX-sized chunks.
    • Fixed undefined behavior with GIFs with problematic LZW compression data.
  • Intl
    • Fixed cloning IntlDateFormatter and MessageFormatter losing PHP-side state such as dateType, timeType, calendar and the message pattern.
    • Fixed a crash when converting with a cloned UConverter that uses to UCallback/fromUCallback.
    • Fixed Collator attribute and strength methods not rejecting an unconstructed Collator.
    • Fixed crash in intl_error_set_custom_msg() without an active call frame.
    • Fixed grapheme_strstr() and grapheme_stristr() returning incorrect substrings when supplementary characters precede the match.
    • Fixed grapheme_strstr() and grapheme_strpos() missing canonically equivalent matches, and grapheme searches reporting ICU errors for empty haystacks.
    • Fixed grapheme_strrpos() and grapheme_strripos() skipping overlapping matches when using a negative offset.
    • Fixed IntlDateFormatter::parse(), localtime() and parseToCalendar() treating the offset as UTF-16 code units instead of bytes.
  • Lexbor
    • Merge patches lexbor/lexbor@8a14bc0 and lexbor/lexbor@f67ce4b, fixing a heap buffer overflow in lexbor-contains() parsing and buffer overflows in malformed decode replay.
    • Merge patches lexbor/lexbor@859f100, lexbor/lexbor@a36e09a, lexbor/lexbor@b0f7412, lexbor/lexbor@1b215a8, lexbor/lexbor@385afff, lexbor/lexbor@e6c068f, lexbor/lexbor@327a8b6, lexbor/lexbor@917742f and lexbor/lexbor@e89c258, fixing dropped usernames containing an at sign, uninitialized memory in IDNA buffer growth, the encoding of a space before a query or fragment in an opaque path, a query or fragment lost after a dot segment in a path, replacement file drive paths, the output encoding used for percent-encoding, the URLSearchParams tail pointer and fragment serialization without a query.
  • MBString
    • Fixed bug GH-23106 (mb_strpos() reads past the end of a haystack ending in a truncated UTF-8 sequence).
    • Fixed mbstring functions emitting surrogates in UTF-8 output and flagging it as valid UTF-8.
  • MySQLi
    • Fix GH-22854: Fixed failed assertion when accessing mysqli property after failed reconnection.
  • MySQLnd
    • Fixed field_count not resetting on OK packet.
    • Fixed memory leak when closing a prepared statement after its connection was killed.
  • Opcache
    • Fixed OSS-Fuzz #546798343 (Heap-buffer-overflow in optimizer with FCCs and inlining).
    • Fixed bug GH-23693 (Tracing JIT produces wrong results for a guard on a loop-invariant addition).
    • Fixed OSS-Fuzz #5674034779193344 (Read of uninitialized memory in is_cacheable_stream_path()).
    • Fix zend_analyze_calls() call_stack buffer overrun.
    • Fixed bug GH-23628 (Tracing JIT reads undefined property slots of lazy proxy objects instead of forwarding to the real instance).
    • Fixed bug GH-23679 (Tracing JIT writes a parent private property into a child's shadowing public property).
    • Fix multiple incorrect DCE due to unsound escape analysis.
    • Fixed bug GH-24063 (OPcache optimizer folds $cond ? -0.0 : 0.0 into a single -0.0 constant).
    • Fixed crash when a file cache is reused with a different set of extensions declaring frameless functions.
    • Fixed bug GH-23991 (JIT generates invalid IR for multiple recursive calls).
    • Fix SCCP evaluation of isset()/empty() on dimension of non-escaping object.
    • Fixed bug GH-20890 (Segfault in zval_undefined_cv with non-simple property hook with minimal tracing JIT).
  • OpenSSL
    • Fixed stream_socket_enable_crypto() leaving the socket non-blocking after a handshake timeout.
    • Fixed feof() on a TLS stream staying false after a close_notify on Windows.
  • PCNTL
    • Fixed pcntl_signal_dispatch() dropping the queued signals when it runs while an exception is pending.
    • Fixed pcntl_signal_dispatch() dropping the signals queued behind a handler that throws.
    • Fixed bug GH-23986 (/proc/self paths resolve to the parent process after pcntl_fork()).
  • PDO
    • Fixed PDOStatement::getColumnMeta() reading out of bounds for an invalid column index.
    • Fixed PDOStatement::bindColumn() registering a binding for a column name that is not in the result set.
    • Fixed PDOStatement::execute() leaving the previous result available after a failed execution.
    • Fixed a use-after-free when bindValue()/execute()/closeCursor() is called from a bound parameter's __toString() during execute().
    • Fixed bug GH-23962 (Destroying a persistent PDO instance rolls back a transaction still in use by another instance).
    • Fixed PDO::setAttribute() installing a PDO::ATTR_STATEMENT_CLASS class whose constructor arguments it rejects.
    • Fixed PDO::ATTR_STATEMENT_CLASS constructor_args type errors reporting "array given" regardless of the value passed.
    • Fixed PDOStatement::bindParam() and bindColumn() leaking the driver options value.
    • Fixed PDOStatement not reporting its bound parameters and columns to the cycle collector.
    • Fixed PDOStatement::setFetchMode() not applying changes atomically.
  • PDO_DBLIB
    • Fixed bug GH-23741 (segfault after a failed query inside a PDO transaction). Errors raised by beginTransaction(), commit(), rollBack() and lastInsertId() are now reported instead of being dropped.
  • PDO_Firebird
    • Fixed bug GH-23758 (PDO_Firebird returns null for non-null empty BLOBs).
  • PGSQL
    • Fixed pg_lo_write() rejecting data containing null bytes.
    • Removed pg_service(), unavailable with any released libpq.
  • Readline
    • Fixed a heap over-read in the interactive shell prompt when cli.prompt is set to an empty string.
  • Reflection
    • Fixed bug GH-23842 (ReflectionProperty::skipLazyInitialization() copies invalid constant defaults with OPcache).
  • Session
    • Fixed session_start() continuing after a failed create_sid() when session.use_strict_mode rejects the supplied ID.
    • Fixed exceptions from user-defined create_sid() handlers being replaced by return-value validation errors.
  • SimpleXML
    • Fixed reconstructing a SimpleXMLElement freeing a child element that another variable still references.
  • SOAP
    • Fixed bug GH-22895 (Heap use-after-free while encoding a Traversable with an illegal key).
    • Fixed memory leak when load_wsdl_ex() failed to load.
  • SQLite
    • Fixed a crash when SQLite3::close() is called from a userland callback.
  • Standard
    • Fixed sha1_file() returning a digest for incomplete data after a stream read failure.
    • Fixed iptcembed() corrupting JPEG headers when called recursively from an output handler.
    • Fixed proc_open() leaking descriptor zero when descriptor setup fails.
    • Fixed three Windows-only proc_open() defects: an uninitialized PROCESS_INFORMATION, an indeterminate comspec pointer after a failed lookup, and an unchecked CreateFileA() failure.
    • Fix persistent stream context lifetime during shutdown (Levi Morrison)
    • Fix wordwrap() ignoring an existing break at the end of the string (Nicolas Grekas)
    • Fixed convert.quoted-printable-decode decoding lowercase hex digits to the wrong byte.
    • Fixed chown() and lchown() failing to resolve user names in ZTS builds when getpwnam_r() needs a larger buffer.
  • Tidy
    • Fixed a use-after-free when a tidyNode is used after its document is reparsed.
  • Zlib
    • Fixed inflate_init() dropping the preset dictionary for raw streams with a non-default window.

PHP 8.4.27

  • Core
    • Fixed GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp (Avoid state corruption via bailout).
    • Fix GH-21999: GC inconsistency with lazy object, var_dump(), and object comparison.
    • Fixed OSS-Fuzz #536440507 (Immutable class incorrect assertion).
    • Fixed AVX being reported as supported when the OS has not enabled AVX state.
    • Fixed GH-23980 (ZEND_ASSERT violation @ ZEND_INCLUDE_OR_EVAL).
    • Fixed bug GH-23896 (Assertion failure in zend_call_function() after a throwing deprecation).
    • Fixed use-after-free when a dl()-loaded extension declares a frameless function and a later request calls it.
    • Fixed System V shared memory emulation for Windows attaching segments past the end of their mapping.
    • Fixed bug GH-24050 (GC frees an object still held by a resurrected closure when (object) and use share an array).
    • Fixed exception thrown by destructor during GC in a Fiber not being rethrown into the frame that triggered the GC.
  • BCMath
    • Fixed BcMath\Number results that truncate to zero keeping a negative sign and comparing less than zero.
  • BZ2
    • Fixed double close of the descriptor and use-after-free of the inner stream when bzopen() is given a stream resource.
  • CLI
    • Fix GH-22567 (Windows ZTS CLI SAPI should refresh its TSRMLS cache during request activation).
    • Fixed bug GH-23764 (Built-in server leaks a file descriptor on every HEAD request for a static file).
    • Fixed crash in the built-in server when a client is reset before being accepted.
    • Fixed the built-in server truncating an error page and leaking its unsent part after a partial socket write.
  • DOM
    • Fixed use-after-free when re-constructing a DOMXPath whose php:function registrations are freed while still reachable from the cycle collector.
    • Fixed bug GH-23365 (DOMNode::insertBefore($n, $n) drops the node and leaves a self-referencing sibling list).
    • Fixed Dom\HTMLDocument::getElementById() not finding ids of SVG and MathML elements.
    • Fixed Dom\HTMLDocument giving attributes the namespace of their element when a fragment is parsed with an xlink, xml or xmlns context element.
    • Fixed bug GH-23729 (DOMXPath::__construct() use-after-free during an evaluation).
    • Fixed bug GH-23897 (php:function() assertion failure after a failed registerPHPFunctions()).
    • Fixed DOMXPath and Dom\XPath losing the context node and in-scope namespaces of an evaluation after a php:function() callback evaluated another expression on the same object.
  • FFI
    • Fixed crashes with FFI callbacks created from __call() trampolines and array callables whose object is released.
  • FTP
    • Fixed bug GH-23619 (cryptic error on servers that don't support TLS session resumption on data connection).
  • GD
    • Fixed undefined behavior with GD2 images with INT_MAX-sized chunks.
    • Fixed undefined behavior with GIFs with problematic LZW compression data.
  • Intl
    • Fixed IntlDateFormatter::parse(), localtime() and parseToCalendar() treating the offset as UTF-16 code units instead of bytes.
    • Fixed cloning IntlDateFormatter and MessageFormatter losing PHP-side state such as dateType, timeType, calendar and the message pattern.
    • Fixed Collator attribute and strength methods not rejecting an unconstructed Collator.
    • Fixed grapheme_strstr() and grapheme_stristr() returning incorrect substrings when supplementary characters precede the match.
    • Fixed grapheme_strstr() and grapheme_strpos() missing canonically equivalent matches, and grapheme searches reporting ICU errors for empty haystacks.
    • Fixed grapheme_strrpos() and grapheme_strripos() skipping overlapping matches when using a negative offset.
  • Lexbor
    • Merge patches lexbor/lexbor@8a14bc0 and lexbor/lexbor@f67ce4b, fixing a heap buffer overflow in :lexbor-contains() parsing and buffer overflows in malformed decode replay.
  • MBString
    • Fixed bug GH-23106 (mb_strpos() reads past the end of a haystack ending in a truncated UTF-8 sequence).
    • Fixed mbstring functions emitting surrogates in UTF-8 output and flagging it as valid UTF-8.
  • MySQLi
    • Fix GH-22854: Fixed failed assertion when accessing mysqli property after failed reconnection.
  • MySQLnd
    • Fixed field_count not resetting on OK packet.
    • Fixed memory leak when closing a prepared statement after its connection was killed.
  • Opcache
    • Fixed OSS-Fuzz #546798343 (Heap-buffer-overflow in optimizer with FCCs and inlining).
    • Fixed bug GH-23693 (Tracing JIT produces wrong results for a guard on a loop-invariant addition).
    • Fixed OSS-Fuzz #5674034779193344 (Read of uninitialized memory in is_cacheable_stream_path()).
    • Fix zend_analyze_calls() call_stack buffer overrun.
    • Fixed bug GH-23637 (PHP-FPM worker SIGSEGV: run_time_cache map_ptr offset beyond CG(map_ptr_last) when a class is reached through the CE cache).
    • Fix multiple incorrect DCE due to unsound escape analysis.
    • Fixed bug GH-24063 (OPcache optimizer folds $cond ? -0.0 : 0.0 into a single -0.0 constant).
    • Fixed crash when a file cache is reused with a different set of extensions declaring frameless functions.
    • Fixed bug GH-23991 (JIT generates invalid IR for multiple recursive calls).
    • Fix SCCP evaluation of isset()/empty() on dimension of non-escaping object.
  • OpenSSL
    • Fixed stream_socket_enable_crypto() leaving the socket non-blocking after a handshake timeout.
    • Fixed feof() on a TLS stream staying false after a close_notify on Windows.
  • PCNTL
    • Fixed pcntl_signal_dispatch() dropping the queued signals when it runs while an exception is pending.
    • Fixed pcntl_signal_dispatch() dropping the signals queued behind a handler that throws.
    • Fixed pcntl_setcpuaffinity() error message advertising the cpu count as the inclusive upper bound.
    • Fixed pcntl_setqos_class() requiring its optional $qos_class argument.
    • Fixed bug GH-23986 (/proc/self paths resolve to the parent process after pcntl_fork()).
  • PDO
    • Fixed PDOStatement::getColumnMeta() reading out of bounds for an invalid column index.
    • Fixed PDOStatement::bindColumn() registering a binding for a column name that is not in the result set.
    • Fixed PDOStatement::execute() leaving the previous result available after a failed execution.
    • Fixed a use-after-free when bindValue()/execute()/closeCursor() is called from a bound parameter's __toString() during execute().
    • Fixed bug GH-23962 (Destroying a persistent PDO instance rolls back a transaction still in use by another instance).
    • Fixed PDO::setAttribute() installing a PDO::ATTR_STATEMENT_CLASS class whose constructor arguments it rejects.
    • Fixed PDO::ATTR_STATEMENT_CLASS constructor_args type errors reporting "array given" regardless of the value passed.
    • Fixed PDOStatement::bindParam() and bindColumn() leaking the driver options value.
    • Fixed PDOStatement not reporting its bound parameters and columns to the cycle collector.
    • Fixed PDOStatement::setFetchMode() not applying changes atomically.
  • PDO_DBLIB
    • Fixed bug GH-23741 (segfault after a failed query inside a PDO transaction). Errors raised by beginTransaction(), commit(), rollBack() and lastInsertId() are now reported instead of being dropped.
  • PDO_Firebird
    • Fixed bug GH-23758 (PDO_Firebird returns null for non-null empty BLOBs).
  • Readline
    • Fixed a heap over-read in the interactive shell prompt when cli.prompt is set to an empty string.
  • Session
    • Fixed session_start() continuing after a failed create_sid() when session.use_strict_mode rejects the supplied ID.
    • Fixed exceptions from user-defined create_sid() handlers being replaced by return-value validation errors.
  • SimpleXML
    • Fixed reconstructing a SimpleXMLElement freeing a child element that another variable still references.
  • SOAP
    • Fixed bug GH-22895 (Heap use-after-free while encoding a Traversable with an illegal key).
    • Fixed memory leak when load_wsdl_ex() failed to load.
  • Sockets
    • Fixed socket_select() silently truncating sets larger than FD_SETSIZE on Windows.
  • SPL
    • Fixed SplFixedArray::setSize() doing nothing on subclasses whose constructor does not call parent::__construct().
    • Fixed memory leak when __construct(), __wakeup() or __unserialize() is called from an element destructor during setSize(0).
  • SQLite
    • Fixed a crash when SQLite3::close() is called from a userland callback.
  • Standard
    • Fixed sha1_file() returning a digest for incomplete data after a stream read failure.
    • Fixed iptcembed() corrupting JPEG headers when called recursively from an output handler.
    • Fixed proc_open() leaking descriptor zero when descriptor setup fails.
    • Fixed three Windows-only proc_open() defects: an uninitialized PROCESS_INFORMATION, an indeterminate comspec pointer after a failed lookup, and an unchecked CreateFileA() failure.
    • Fix persistent stream context lifetime during shutdown (Levi Morrison)
    • Fix wordwrap() ignoring an existing break at the end of the string (Nicolas Grekas)
    • Fixed convert.quoted-printable-decode decoding lowercase hex digits to the wrong byte.
  • Tidy
    • Fixed a use-after-free when a tidyNode is used after its document is reparsed.
  • XSL
    • Fixed bug GH-23730 (use-after-free when XSLTProcessor::importStylesheet() is called during a transformation).
  • Zip
    • Fixed ZipArchive::extractTo() ignoring files given in a non-list array.
    • Fixed bug GH-23747 (ZipArchive::close() use-after-free from a progress or cancel callback).

Security Releases

PHP versions 8.3.36, 8.2.35, 8.1.34.5, 7.4.33.17, 7.3.33.23, and 7.2.34.31

  • Core
    • Fixed GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp (Avoid state corruption via bailout; these are CVE-2026-109618 and CVE-2026-109619, respectively, as noted above)