• Zend Server 2019.1.2

    CVE Fixes for PHP versions: 7.1.33.16, 7.2.34.11, 7.3.33.3

    • Hash
      • Fixed bug #81738: buffer overflow in hash_update() on long parameter. (CVE-2022-37454)

    CVE Fixes for PHP versions 7.1.33.16, 7.2.34.11, 7.3.33.3

    • Core
      • Fixed bug #81726: phar wrapper: DOS when using quine gzip file. (CVE-2022-31628).
      • Fixed bug #81727: Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning. (CVE-2022-31629).

  • Zend Server 8.5.19

    PHP version 5.6.40.16.

    Backported CVE fixes

    • mysqlnd:
      • Fixed bug #81719: mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
    • pgsql
      • Fixed bug #81720: Uninitialized array in pg_query_params(). (CVE-2022-31625)

  • Zend Server 9.1.14

    PHP version 7.1.33.15.

    Backported CVE fixes

    • mysqlnd
      • Fixed bug #81719: mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
    • pgsql
      • Fixed bug #81720: Uninitialized array in pg_query_params(). (CVE-2022-31625)

  • Zend Server 2019.1.1

    Updated PHP versions

    • 7.1.33.15 (incl. TLSv1.2 support for mysql)
    • 7.2.34.10
    • 7.3.33.2

    CVE Fixes

    • mysqlnd
      • Fixed bug #81719: mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
    • pgsql
      • Fixed bug #81720: Uninitialized array in pg_query_params(). (CVE-2022-31625)

  • Zend Server 2021.2.0

    Added

    • webp support for gd extension, linux and IBM i (ZEND-2255,2084)

    Fixed

    • jobqueueAddJob output in JSON format (ZEND-2244)
    • ZendServer MonitorNode schema check with invalid version  (ZEND-2077)
    • Vhost attach functionality with Nginx (ZEND-2351)
    • Installation on RHEL8, apache php-fpm setup (ZEND-2454)
    • Removed php-fpm binary from IBM i package (ZEND-2369)
    • IBM i green screen ZS info page errors (ZEND-2166)
    • PHP version check failure on zpk install (ZEND-1961)
    • Unable to Save changes after switching GUI tabs in ZS Settings (ZEND-2249)
    • Change UI License Expiration information for IBM i (suggesting ZendPHP) (ZEND-1141)
    • ZDD lock issues (zend_deployment.detect_apps ignored) (ZEND-1952)
    • Application defining failures (ZEND-2291)

    Updated

    • PHP versions 7.1.33.15 (incl. TLSv1.2 support for mysql), 7.2.34.10, 7.3.33.2, 7.4.30.
    • ZendServerSDK v.1.2.1 (ZEND-2451)
    • PHPToolkit for IBM i v.1.9.1 (ZEND-2161)
    • angularJs update to 1.8.2 Perforce release (ZEND-2423,2434)

    CVE fixes

    • mysqlnd: Fixed bug #81719: mysqlnd/pdo password buffer overflow. (CVE-2022-31626)
    • pgsql: Fixed bug #81720: Uninitialized array in pg_query_params(). (CVE-2022-31625)

    PECL extensions updated

    • IBM_DB2 extension v.2.1.5 for PHP v>=7.3 (not compatible with PHP 7.2) (ZEND-2172)
    • ssh2 extension v.1.3.1 (ZEND-2165)
    • pdo_ibm v.1.4.2
    • imagick v.3.7.0 (Windows v.3.5.0)
    • mongodb v. 1.11.1
    • redis v.5.3.5

    Windows

    • Windows installer: changed misleading message during upgrade (PHP version change) (ZEND-2230)
    • installer contains Apache 2.4.53
    • MS ODBC drivers v.17 (for sqlsrv ext)
    • vcredist c++ 64 bit VS2017

    Linux

    • lighttpd v.1.4.64

    IBM i

    • Support tool improvements: display created spool file location (ZEND-2167)
    • Added php-cli.sh shell script on IBM i for running php scripts from green screen (ZEND-2374)
      • Sample use: CALL PGM(QP2SHELL) PARM('/usr/local/zendphp74/bin/php-cli.sh' 'test.php')
      • Script output is stored as process print file, not displayed on the terminal screen.

    Extra notes

    Upgrade from 2019.x.x to 2021.2.0 on RHEL8 may fail, reporting:

    Problem: cannot install the best update candidate for package liboci8-zend-11.2.0.4-8.x86_64

    • nothing provides libaio.so.1 needed by liboci8-zend-21.1.0.0-25.x86_64

    To continue from such a situation, liboci8-zend package (new version) should be installed manually.

    sudo yum install -y liboci8-zend

    Then restart the upgrade sequence from the step (including) that caused the error (re-run repository installer or other method you have chosen for ZendServer upgrade).

    Known problems (fix postponed)

    • php-fpm restart on Linux.

      Related to PHP version change through GUI. php-fpm processes do not restart automatically. As a workaround, php-fpm should be restarted manually from the console after switching PHP version:

      sudo /usr/local/zend/bin/php-fpm.sh restart

    • JobQueue misbehavior during DST change (DST end in October).

      Jobs scheduled during the hour of DST change get executed large number of times. No known easy workaround. One option is to temporarily disable specific jobs for the specific DST change time period.

  • ZendPHP June 2026 Releases

    Community Changes

    PHP 8.5.7

    • CLI
      • Fixed bug GH-21901: Stale getopt() optional value. (onthebed)
    • Core
      • Fixed bug GH-22071: JIT assertion on abstract static method call. (David Carlier)
    • Date
      • Fixed bug GH-18422: int overflow in php_date_llabs. (iliaal)
    • DOM
      • Fixed bug GH-22077: UAF in custom XPath function. (afflerbach/David Carlier)
    • Opcache
      • Fixed tracing JIT crash when a VM interrupt is handled during an observed user function call. (Levi Morrison)
      • Fixed bug GH-21746: Segfault with tracing JIT. (Arnaud)
      • Fixed bug GH-22004: Assertion failure at ext/opcache/jit/zend_jit_trace.c. (Arnaud)
      • Fixed tailcall VM crash when a VM interrupt is handled from a VM helper. (Levi Morrison, Arnaud)
    • OpenSSL
      • Fix compatibility issues with OpenSSL 4.0. (jordikroon, Remi)
    • Standard
      • Fixed bug GH-21689: version_compare() incorrectly handles versions ending with a dot. (timwolla)
    • URI
      • Fixed CVE-2026-44927: In uriparser before 1.0.2, there is pointer difference truncation to int in various places. (Sebastian Pipping)
      • Fixed CVE-2026-44928: In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal. (Sebastian Pipping)

    PHP 8.4.22

    • Date

      • Fixed bug GH-18422: int overflow in php_date_llabs. (iliaal)

    • Intl

      • Fix incorrect argument positions in out-of-bounds errors for IntlCalendar::set(), IntlCalendar::setDate(), IntlCalendar::setDateTime(), and IntlGregorianCalendar date/time construction. (Weilin Du)
      • Expose Spoofchecker restriction-level APIs on all supported ICU versions. (Weilin Du)
      • Fix SpoofChecker::setAllowedChars() and IntlDateFormatter::__construct() to report PHP constant names instead of ICU constant names in user-visible error messages. (Weilin Du)

    • MySQLnd

      • Fix persistent free of non-persistent connect_attr key (David Carlier).

    • Opcache

      • Fixed tracing JIT crash when a VM interrupt is handled during an observed user function call. (Levi Morrison)
      • Fixed bug GH-22004: Assertion failure at ext/opcache/jit/zend_jit_trace.c. (Arnaud)

    • OpenSSL

      • Fix compatibility issues with OpenSSL 4.0. (jordikroon, Remi)

    • Phar

      • Fixed bug GH-21986: PharData::getContent() crash on infinite recursion with symlinks. (David Carlier)

    • SOAP

      • Fixed integer overflow when decoding SOAP array indexes. (Weilin Du)

    • SPL

      • Fix SplFixedArray::setSize leak when destructor grows during clear. (David Carlier)
      • Fixed bug GH-21933: use after free of self-freeing MultipleIterator children. (David Carlier)

    • Standard

      • Fixed bug GH-21689: version_compare() incorrectly handles versions ending with a dot. (timwolla)
      • Fixed ip2long() leading zeros handling inconsistency on AIX. (ayappanec)

  • ZendPHP May 2026 Releases

    Community Changes

    ZendPHP 8.5.6 Changes

    • Core

      • Fixed bug GH-19983: GC assertion failure with fibers, generators and destructors. (iliaal)
      • Fixed ZEND_API mismatch on zend_ce_closure forward decl for Windows+Clang (henderkes)
      • Fixed bug GH-21504: Incorrect RC-handling for ZEND_EXT_STMT op1. (ilutov)
      • Fixed bug GH-21478: Forward property operations to real instance for initialized lazy proxies. (iliaal)
      • Fixed bug GH-21605: Missing addref for Countable::count(). (ilutov)
      • Fixed bug GH-21699: Assertion failure in shutdown_executor when resolving self::/parent::/static:: callables if the error handler throws. (macoaure)
      • Fixed bug GH-21603: Missing addref for __unset. (ilutov)
      • Fixed bug GH-21760: Trait with class constant name conflict against enum case causes SEGV. (Pratik Bhujel)

    • CLI

      • Fixed bug GH-21754: --rf command line option with a method triggers ext/reflection deprecation warnings. (DanielEScherzer)

    • Curl

      • Add support for brotli and zstd on Windows. (Shivam Mathur)

    • DOM

      • Fixed GHSA-4jhr-8w89-j733 and GH-21566: Dom\XMLDocument::C14N() emits duplicate xmlns declarations after setAttributeNS(). (CVE-2026-7263) (David Carlier)

    • FPM

      • Fixed GHSA-7qg2-v9fj-4mwv: XSS within status endpoint. (CVE-2026-6735) (Jakub Zelenka)

    • Iconv

      • Fixed bug GH-17399: iconv memory leak on bailout. (iliaal)

    • Lexbor

      • Upgrade to lexbor v2.7.0. (CVE-2026-29078, CVE-2026-29079) (ndossche, ilutov)

    • MBString

      • Fixed GHSA-wm6j-2649-pv75: Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init(). (CVE-2026-7259) (vi3tL0u1s)
      • Fixed GHSA-74r9-qxhc-fx53: Out-of-bounds access in mbfl_name2encoding_ex(). (CVE-2026-6104) (ilutov)

    • Opcache

      • Fixed bug GH-21158: JIT: Assertion jit->ra[var].flags & (10) failed in zend_jit_use_reg. (Arnaud)
      • Fixed bug GH-21593: Borked function JIT JMPNZ smart branch. (ilutov)
      • Fixed bug GH-21460: COND optimization regression. (Dmitry, Arnaud)
      • Fixed faulty returns out of zend_try block in zend_jit_trace(). (ilutov)

    • OpenSSL

      • Fix memory leak regression in openssl_pbkdf2(). (ndossche)
      • Fix a bunch of memory leaks and crashes on edge cases. (ndossche)

    • PDO_Firebird

      • Fixed GHSA-w476-322c-wpvm: SQL injection via NUL bytes in quoted strings. (CVE-2025-14179) (SakiTakamachi)

    • PDO_PGSQL

      • Fixed bug GH-21683: pdo_pgsql throws with ATTR_PREFETCH=0 on empty result set. (thomasschiet)

    • Phar

      • Restore is_link handler in phar_intercept_functions_shutdown. (iliaal)
      • Fixed bug GH-21797: NULL dereference in Phar::webPhar() when SCRIPT_NAME is absent from SAPI environment. (iliaal)
      • Fix memory leak in Phar::offsetGet(). (iliaal)
      • Fix memory leak in phar_add_file(). (iliaal)
      • Fixed bug GH-21799: propagate phar_stream_flush return value from phar_stream_close. (iliaal)
      • Fix memory leak in phar_verify_signature() when md_ctx is invalid.(JarneClauw)

    • Random

      • Fixed bug GH-21731: Random\Engine\Xoshiro256StarStar::__unserialize() accepts all-zero state. (iliaal)

    • Session . Fixed memory leak when session GC callback return a refcounted value. (jorgsowa)

    • SOAP

      • Fixed GHSA-85c2-q967-79q5: Stale SOAP_GLOBAL(ref_map) pointer with Apache Map. (CVE-2026-6722) (ilutov)
      • Fixed GHSA-m33r-qmcv-p97q: Use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION. (CVE-2026-7261) (ilutov)
      • Fixed GHSA-hmxp-6pc4-f3vv: Broken Apache map value NULL check. (CVE-2026-7262) (ilutov)

    • SPL

      • Fixed bug GH-21499: RecursiveArrayIterator getChildren UAF after parent free. (Girgias)
      • Fix concurrent iteration and deletion issues in SplObjectStorage. (ndossche)

    • Sqlite3

      • Fixed wrong free list comparator pointer type. (David Carlier)

    • Standard

      • Fixed GHSA-96wq-48vp-hh57: Signed integer overflow of char array offset. (CVE-2026-7568) (TimWolla)
      • Fixed GHSA-m8rr-4c36-8gq4: Consistently pass unsigned char to ctype.h functions. (CVE-2026-7258) (ilutov)

    • Streams

      • Fixed bug GH-21468: Segfault in file_get_contents with https URL and a proxy set. (ndossche)

    • URI

      • Fixed CVE-2026-42371: uriparser before 1.0.1 has numeric truncation in text range comparison. (CVE-2026-42371) (Joshua W. Windle)

    ZendPHP 8.4.21 Changes

    • Core

      • Fixed bug GH-19983: GC assertion failure with fibers, generators and destructors. (iliaal)
      • Fixed bug GH-21478: Forward property operations to real instance for initialized lazy proxies. (iliaal)
      • Fixed bug GH-21605: Missing addref for Countable::count(). (ilutov)
      • Fixed bug GH-21699: Assertion failure in shutdown_executor when resolving self::/parent::/static:: callables if the error handler throws. (macoaure)
      • Fixed bug GH-21603: Missing addref for __unset. (ilutov)
      • Fixed bug GH-21760: Trait with class constant name conflict against enum case causes SEGV. (Pratik Bhujel)

    • CLI

      • Fixed bug GH-21754: --rf command line option with a method triggers ext/reflection deprecation warnings. (DanielEScherzer)

    • Curl

      • Add support for brotli and zstd on Windows. (Shivam Mathur)

    • DOM

      • Fixed GHSA-4jhr-8w89-j733 and GH-21566: Dom\XMLDocument::C14N() emits duplicate xmlns declarations after setAttributeNS(). (CVE-2026-7263) (David Carlier)
      • Fixed bug GH-21688: segmentation fault on empty HTMLDocument. (David Carlier)
      • Upgrade to lexbor v2.7.0. (CVE-2026-29078, CVE-2026-29079) (ndossche, ilutov)

    • FPM

      • Fixed GHSA-7qg2-v9fj-4mwv: XSS within status endpoint. (CVE-2026-6735) (Jakub Zelenka)

    • Iconv

      • Fixed bug GH-17399: iconv memory leak on bailout. (iliaal)

    • MBString

      • Fixed GHSA-wm6j-2649-pv75: Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init(). (CVE-2026-7259) (vi3tL0u1s)
      • Fixed GHSA-74r9-qxhc-fx53: Out-of-bounds access in mbfl_name2encoding_ex(). (CVE-2026-6104) (ilutov)

    • Opcache

      • Fixed bug GH-21158: JIT: Assertion jit->ra[var].flags & (10) failed in zend_jit_use_reg. (Arnaud)
      • Fixed bug GH-21593: Borked function JIT JMPNZ smart branch. (ilutov)
      • Fixed bug GH-21460: COND optimization regression. (Dmitry, Arnaud)
      • Fixed faulty returns out of zend_try block in zend_jit_trace(). (ilutov)

    • OpenSSL

      • Fix a bunch of memory leaks and crashes on edge cases. (ndossche)

    • PDO_Firebird:

      • Fixed GHSA-w476-322c-wpvm: SQL injection via NUL bytes in quoted strings. (CVE-2025-14179) (SakiTakamachi)

    • Phar

      • Restore is_link handler in phar_intercept_functions_shutdown. (iliaal)
      • Fixed bug GH-21797: NULL dereference in Phar::webPhar() when SCRIPT_NAME is absent from SAPI environment. (iliaal)
      • Fix memory leak in Phar::offsetGet(). (iliaal)
      • Fix memory leak in phar_add_file(). (iliaal)
      • Fixed bug GH-21799: propagate phar_stream_flush return value from phar_stream_close. (iliaal)
      • Fix memory leak in phar_verify_signature() when md_ctx is invalid. (JarneClauw)

    • Random

      • Fixed bug GH-21731: Random\Engine\Xoshiro256StarStar::__unserialize() accepts all-zero state. (iliaal)

    • Session

      • Fixed memory leak when session GC callback return a refcounted value. (jorgsowa)

    • SOAP

      • Fixed GHSA-85c2-q967-79q5: Stale SOAP_GLOBAL(ref_map) pointer with Apache Map. (CVE-2026-6722) (ilutov)
      • Fixed GHSA-m33r-qmcv-p97q: Use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION. (CVE-2026-7261) (ilutov)
      • Fixed GHSA-hmxp-6pc4-f3vv: Broken Apache map value NULL check. (CVE-2026-7262) (ilutov)

    • SPL

      • Fixed bug GH-21499: RecursiveArrayIterator getChildren UAF after parent free. (Girgias)
      • Fix concurrent iteration and deletion issues in SplObjectStorage. (ndossche)

    • Standard

      • Fixed GHSA-96wq-48vp-hh57: Signed integer overflow of char array offset. (CVE-2026-7568) (TimWolla)
      • Fixed GHSA-m8rr-4c36-8gq4: Consistently pass unsigned char to ctype.h functions. (CVE-2026-7258) (ilutov)

    • Streams

      • Fixed bug GH-21468: Segfault in file_get_contents with https URL and a proxy set. (ndossche)

    • XSL

      • Fixed bug GH-21600: Segfault on module shutdown. (David Carlier)

    • Zip

      • Fixed bug GH-21698: memory leak with ZipArchive::addGlob() early return statements. (David Carlier)

    ZendPHP 8.3.31 and 8.2.31 Security Releases

    • Curl

      • Add support for brotli and zstd on Windows. (Shivam Mathur)

    • FPM

      • Fixed GHSA-7qg2-v9fj-4mwv: XSS within status endpoint. (CVE-2026-6735) (Jakub Zelenka)

    • MBString

      • Fixed GHSA-wm6j-2649-pv75: Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init(). (CVE-2026-7259) (vi3tL0u1s)

    • OpenSSL

      • Fix compatibility issues with OpenSSL 4.0. (jordikroon, Remi)

    • PDO_Firebird

      • Fixed GHSA-w476-322c-wpvm: SQL injection via NULL bytes in quoted strings. (CVE-2025-14179) (SakiTakamachi)

    • SOAP

      • Fixed GHSA-85c2-q967-79q5: Stale SOAP_GLOBAL (ref_map) pointer with Apache Map. (CVE-2026-6722) (ilutov)
      • Fixed GHSA-m33r-qmcv-p97q: Use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION. (CVE-2026-7261) (ilutov)
      • Fixed GHSA-hmxp-6pc4-f3vv: Broken Apache map value NULL check. (CVE-2026-7262) (ilutov)

    • Standard

      • Fixed GHSA-96wq-48vp-hh57: Signed integer overflow of char array offset. (CVE-2026-7568) (TimWolla)
      • Fixed GHSA-m8rr-4c36-8gq4: Consistently pass unsigned char to ctype.h functions. (CVE-2026-7258) (ilutov)

    ZendPHP LTS Changes

    ZendPHP 8.1.34.1 LTS Security Release

    • FPM

      • Fixed GHSA-7qg2-v9fj-4mwv: XSS within status endpoint. (CVE-2026-6735) (Jakub Zelenka)

    • MBString

      • Fixed GHSA-wm6j-2649-pv75: Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init(). (CVE-2026-7259) (vi3tL0u1s)

    • PDO_Firebird

      • Fixed GHSA-w476-322c-wpvm: SQL injection via NULL bytes in quoted strings. (CVE-2025-14179) (SakiTakamachi)

    • SOAP

      • Fixed GHSA-85c2-q967-79q5: Stale SOAP_GLOBAL (ref_map) pointer with Apache Map. (CVE-2026-6722) (ilutov)
      • Fixed GHSA-m33r-qmcv-p97q: Use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION. (CVE-2026-7261) (ilutov)
      • Fixed GHSA-hmxp-6pc4-f3vv: Broken Apache map value NULL check. (CVE-2026-7262) (ilutov)

    • Standard

      • Fixed GHSA-96wq-48vp-hh57: Signed integer overflow of char array offset. (CVE-2026-7568) (TimWolla)
      • Fixed GHSA-m8rr-4c36-8gq4: Consistently pass unsigned char to ctype.h functions. (CVE-2026-7258) (ilutov)

    ZendPHP 7.4.33.13, 7.3.33.19, and 7.2.34.27 LTS Security Releases

    • FPM

      • Fixed GHSA-7qg2-v9fj-4mwv: XSS within status endpoint. (CVE-2026-6735) (Jakub Zelenka)

    • SOAP

      • Fixed GHSA-85c2-q967-79q5: Stale SOAP_GLOBAL (ref_map) pointer with Apache Map. (CVE-2026-6722) (ilutov)
      • Fixed GHSA-m33r-qmcv-p97q: Use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION. (CVE-2026-7261) (ilutov)
      • Fixed GHSA-hmxp-6pc4-f3vv: Broken Apache map value NULL check. (CVE-2026-7262) (ilutov)

    • Standard

      • Fixed GHSA-96wq-48vp-hh57: Signed integer overflow of char array offset. (CVE-2026-7568) (TimWolla)
      • Fixed GHSA-m8rr-4c36-8gq4: Consistently pass unsigned char to ctype.h functions. (CVE-2026-7258) (ilutov)

  • ZendPHP April 2026 Releases

    Community Changes

    ZendPHP 8.5.5 Changes

    • Core
      • Fixed bug GH-20672 (Incorrect property_info sizing for locally shadowed trait properties). (ilutov)
      • Fixed bugs GH-20875, GH-20873, GH-20854 (Propagate IN_GET guard in get_property_ptr_ptr for lazy proxies). (iliaal)
    • Bz2
      • Fix truncation of total output size causing erroneous errors. (ndossche)
    • DOM
      • Fixed bug GH-21486 (Dom\HTMLDocument parser mangles xml:space and xml:lang attributes). (ndossche)
    • FFI
      • Fixed resource leak in FFI::cdef() onsymbol resolution failure. (David Carlier)
    • GD
      • Fixed bug GH-21431 (phpinfo() to display libJPEG 10.0 support). (David Carlier)
    • Opcache
      • Fixed bug GH-21052 (Preloaded constant erroneously propagated to file-cached script). (ilutov)
      • Fixed bug GH-20838 (JIT compiler produces wrong arithmetic results). (Dmitry, iliaal)
      • Fixed bug GH-21267 (JIT tracing: infinite loop on FETCH_OBJ_R with IS_UNDEF property in polymorphic context). (Dmitry, iliaal)
      • Fixed bug GH-21395 (uaf in jit). (ndossche)
    • OpenSSL
      • Fixed bug GH-21083 (Skip private_key_bits validation for EC/curve-based keys). (iliaal)
      • Fix missing error propagation for BIO_printf() calls. (ndossche)
    • PCNTL
      • Fixed signal handler installation on AIX by bumping the storage size of the num_signals global. (Calvin Buckley)
    • PCRE
      • Fixed re-entrancy issue on php_pcre_match_impl, php_pcre_replace_impl, php_pcre_split_impl, and php_pcre_grep_impl. (David Carlier)
    • Phar
      • Fixed bug GH-21333 (use after free when unlinking entries during iteration of a compressed phar). (David Carlier)
    • SNMP
      • Fixed bug GH-21336 (SNMP::setSecurity() undefined behavior with NULL arguments). (David Carlier)
    • SOAP
      • Fixed Set-Cookie parsing bug wrong offset while scanning attributes. (David Carlier)
    • SPL
      • Fixed bug GH-21454 (missing write lock validation in SplHeap). (ndossche)
    • Standard
      • Fixed bug GH-20906 (Assertion failure when messing up output buffers). (ndossche)
      • Fixed bug GH-20627 (Cannot identify some avif images with getimagesize). (y-guyon)
    • Sysvshm
      • Fix memory leak in shm_get_var() when variable is corrupted. (ndossche)
    • XSL
      • Fix GH-21357 (XSLTProcessor works with DOMDocument, but fails with Dom\XMLDocument). (ndossche)
      • Fixed bug GH-21496 (UAF in dom_objects_free_storage). (David Carlier/ndossche)

    ZendPHP 8.4.20 Changes

    • Bz2

      • Fix truncation of total output size causing erroneous errors. (ndossche)

    • Core

      • Fixed bugs GH-20875, GH-20873, GH-20854 (Propagate IN_GET guard in get_property_ptr_ptr for lazy proxies). (iliaal)

    • DOM

      • Fixed bug GH-21486 (Dom\HTMLDocument parser mangles xml:space and xml:lang attributes). (ndossche)

    • FFI

      • Fixed resource leak in FFI::cdef() onsymbol resolution failure. (David Carlier)

    • GD

      • Fixed bug GH-21431 (phpinfo() to display libJPEG 10.0 support). (David Carlier)

    • Opcache

      • Fixed bug GH-20838 (JIT compiler produces wrong arithmetic results). (Dmitry, iliaal)
      • Fixed bug GH-21267 (JIT tracing: infinite loop on FETCH_OBJ_R with IS_UNDEF property in polymorphic context). (Dmitry, iliaal)
      • Fixed bug GH-21395 (uaf in jit). (ndossche)

    • OpenSSL

      • Fixed bug GH-21083 (Skip private_key_bits validation for EC/curve-based keys). (iliaal)
      • Fix missing error propagation for BIO_printf() calls. (ndossche)

    • PCRE

      • Fixed re-entrancy issue on php_pcre_match_impl, php_pcre_replace_impl, php_pcre_split_impl, and php_pcre_grep_impl. (David Carlier)

    • PGSQL

      • Fixed preprocessor silently guarding PGSQL_SUPPRESS_TIMESTAMPS support due to a typo. (KentarouTakeda)

    • SNMP

      • Fixed bug GH-21336 (SNMP::setSecurity() undefined behavior with NULL arguments). (David Carlier)

    • SOAP

      • Fixed Set-Cookie parsing bug wrong offset while scanning attributes. (David Carlier)

    • SPL** . Fixed bug GH-21454 (missing write lock validation in SplHeap). (ndossche)

    • Standard

      • Fixed bug GH-20906 (Assertion failure when messing up output buffers). (ndossche)
      • Fixed bug GH-20627 (Cannot identify some avif images with getimagesize). (y-guyon)

    • Sysvshm

      • Fix memory leak in shm_get_var() when variable is corrupted. (ndossche)

    • XSL

      • Fix GH-21357 (XSLTProcessor works with DOMDocument, but fails with Dom\XMLDocument). (ndossche)
      • Fixed bug GH-21496 (UAF in dom_objects_free_storage). (David Carlier/ndossche)

  • ZendPHP March 2026 Releases

    Community Changes

    ZendPHP 8.5.4 Changes

    • Core

      • Fixed bug GH-21029 (zend_mm_heap corrupted on Aarch64, LTO builds). (Arnaud)
      • Fixed bug GH-21059 (Segfault when preloading constant AST closure). (ilutov)
      • Fixed bug GH-21072 (Crash on (unset) cast in constant expression). (arshidkv12)
      • Fix deprecation now showing when accessing null key of an array with JIT. (alexandre-daubois)
      • Fixed bug GH-20657 (Assertion failure in zend_lazy_object_get_info triggered by setRawValueWithoutLazyInitialization() and newLazyGhost()). (Arnaud)
      • Fixed bug GH-20504 (Assertion failure in zend_get_property_guard when accessing properties on Reflection LazyProxy via isset()). (Arnaud)
      • Fixed OSS-Fuzz #478009707 (Borked assign-op/inc/dec on untyped hooked property backing value). (ilutov)
      • Fixed bug GH-21215 (Build fails with -std=). (Arnaud)
      • Fixed bug GH-13674 (Build system installs libtool wrappers when using slibtool). (Michael Orlitzky)

    • Curl

      • Don't truncate length. (ndossche)

    • Date

      • Fixed bug GH-20936 (DatePeriod::__set_state() cannot handle null start). (ndossche)
      • Fix timezone offset with seconds losing precision. (ndossche)

    • DOM

      • Fixed bug GH-21077 (Accessing Dom\Node::baseURI can throw TypeError). (ndossche)
      • Fixed bug GH-21097 (Accessing Dom\Node properties can can throw TypeError). (ndossche)

    • LDAP

      • Fixed bug GH-21262 (ldap_modify() too strict controls argument validation makes it impossible to unset attribute). (David Carlier)

    • MBString

      • Fixed bug GH-21223; mb_guess_encoding no longer crashes when passed huge list of candidate encodings (with 200,000+ entries). (Jordi Kroon)

    • Opcache

      • Fixed bug GH-20718 ("Insufficient shared memory" when using JIT on Solaris). (Petr Sumbera)
      • Fixed bug GH-21227 (Borked SCCP of array containing partial object). (ilutov)

    • OpenSSL

      • Fix a bunch of leaks and error propagation. (ndossche)

    • Windows

      • Fixed compilation with clang (missing intrin.h include). (Kévin Dunglas)

    ZendPHP 8.4.19 Changes

    • Core

      • Fixed bug GH-21029 (zend_mm_heap corrupted on Aarch64, LTO builds). (Arnaud)
      • Fixed bug GH-20657 (Assertion failure in zend_lazy_object_get_info triggered by setRawValueWithoutLazyInitialization() and newLazyGhost()). (Arnaud)
      • Fixed bug GH-20504 (Assertion failure in zend_get_property_guard when accessing properties on Reflection LazyProxy via isset()). (Arnaud)
      • Fixed OSS-Fuzz #478009707 (Borked assign-op/inc/dec on untyped hooked property backing value). (ilutov)
      • Fixed bug GH-21215 (Build fails with -std=). (Arnaud)
      • Fixed bug GH-13674 (Build system installs libtool wrappers when using slibtool). (Michael Orlitzky)

    • Curl

      • Fixed bug GH-21023 (CURLOPT_XFERINFOFUNCTION crash with a null callback). (David Carlier)
      • Don't truncate length. (ndossche)

    • Date

      • Fixed bug GH-20936 (DatePeriod::__set_state() cannot handle null start). (ndossche)
      • Fix timezone offset with seconds losing precision. (ndossche)

    • DOM

      • Fixed bug GH-21077 (Accessing Dom\Node::baseURI can throw TypeError). (ndossche)
      • Fixed bug GH-21097 (Accessing Dom\Node properties can can throw TypeError). (ndossche)

    • MBString

      • Fixed bug GH-21223; mb_guess_encoding no longer crashes when passed huge list of candidate encodings (with 200,000+ entries). (Jordi Kroon)

    • Opcache

      • Fixed bug GH-20718 ("Insufficient shared memory" when using JIT on Solaris). (Petr Sumbera)
      • Fixed bug GH-21227 (Borked SCCP of array containing partial object). (ilutov)
      • Fixed bug GH-21052 (Preloaded constant erroneously propagated to file-cached script). (ilutov)

    • OpenSSL

      • Fix a bunch of leaks and error propagation. (ndossche)

    • PCNTL

      • Fixed pcntl_setns() internal errors handling regarding errnos. (David Carlier/ndossche)
      • Fixed cpuset leak in pcntl_setcpuaffinity on out-of-range CPU ID on NetBSD/Solaris platforms. (David Carlier)
      • Fixed pcntl_signal() signal table registering the callback first OS-wise before the internal list. (David Carlier)
      • Fixed pcntl_signal_dispatch() stale pointer and exception handling. (David Carlier)

    • PCRE

      • Fixed preg_match memory leak with invalid regexes. (David Carlier)
      • Fixed pcre2_code leak when pcre2_pattern_info() fails after a successful pcre2_compile(), and match_sets/match_data/marks leaks in php_pcre_match_impl(). (David Carlier)

    • PDO_PGSQL

      • Fixed bug GH-21055 (connection attribute status typo for GSS negotiation). (lsaos)

    • PGSQL

      • Fixed bug GH-21162 (pg_connect() memory leak on error). (David Carlier)

    • Sockets

      • Fixed bug GH-21161 (socket_set_option() crash with array 'addr' entry as null). (David Carlier)
      • Fixed possible addr length overflow with socket_connect() and AF_UNIX family sockets (David Carlier)

    • Windows

      • Fixed compilation with clang (missing intrin.h include). (Kévin Dunglas)

  • ZendPHP February 2026 Releases

    Community Changes

    ZendPHP 8.5.3 Changes

    • Core

      • Fixed bug GH-20806 (preserve_none feature compatiblity with LTO). (henderkes)
      • Fixed bug GH-20767 (build failure with musttail/preserve_none feature on macOs). (David Carlier)
      • Fixed bug GH-20837 (NULL dereference when calling ob_start() in shutdown function triggered by bailout in php_output_lock_error()). (timwolla)
      • Fix OSS-Fuzz #471533782 (Infinite loop in GC destructor fiber). (ilutov)
      • Fix OSS-Fuzz #472563272 (Borked block_pass JMP[N]Z optimization). (ilutov)
      • Fixed bug GH-20914 (Internal enums can be cloned and compared). (Arnaud)
      • Fix OSS-Fuzz #474613951 (Leaked parent property default value). (ilutov)
      • Fixed bug GH-20895 (ReflectionProperty does not return the PHPDoc of a property if it contains an attribute with a Closure). (timwolla)
      • Fixed bug GH-20766 (Use-after-free in FE_FREE with GC interaction). (Bob)
      • Fix OSS-Fuzz #471486164 (Broken by-ref assignment to uninitialized hooked backing value). (ilutov)
      • Fix OSS-Fuzz #438780145 (Nested finally with repeated return type check may uaf). (ilutov)
      • Fixed bug GH-20905 (Lazy proxy bailing __clone assertion). (ilutov)
      • Fixed bug GH-20479 (Hooked object properties overflow). (ndossche)

    • Date

      • Update timelib to 2022.16. (Derick)

    • DOM

      • Fixed GH-21041 (Dom\HTMLDocument corrupts closing tags within scripts). (lexborisov)

    • MbString

      • Fixed bug GH-20833 (mb_str_pad() divide by zero if padding string is invalid in the encoding). (ndossche)
      • Fixed bug GH-20836 (Stack overflow in mb_convert_variables with recursive array references). (alexandre-daubois)

    • Opcache

      • Fixed bug GH-20818 (Segfault in Tracing JIT with object reference). (khasinski)

    • OpenSSL

      • Fix memory leaks when sk_X509_new_null() fails. (ndossche)
      • Fix crash when in openssl_x509_parse() when i2s_ASN1_INTEGER() fails. (ndossche)
      • Fix crash in openssl_x509_parse() when X509_NAME_oneline() fails. (ndossche)

    • Phar

      • Fixed bug GH-20882 (buildFromIterator breaks with missing base directory). (ndossche)

    • PGSQL

      • Fixed INSERT/UPDATE queries building with PQescapeIdentifier() and possible UB. (David Carlier)

    • Readline

      • Fixed bug GH-18139 (Memory leak when overriding some settings via readline_info()). (ndossche)

    • SPL

      • Fixed bug GH-20856 (heap-use-after-free in SplDoublyLinkedList iterator when modifying during iteration). (ndossche)

    • Standard

      • Fixed bug #74357 (lchown fails to change ownership of symlink with ZTS). (Jakub Zelenka)
      • Fixed bug GH-20843 (var_dump() crash with nested objects). (David Carlier)

    ZendPHP 8.4.18 Changes

    • Core

      • Fixed bug GH-20837 (NULL dereference when calling ob_start() in shutdown function triggered by bailout in php_output_lock_error()). (timwolla)
      • Fix OSS-Fuzz #471533782 (Infinite loop in GC destructor fiber). (ilutov)
      • Fix OSS-Fuzz #472563272 (Borked block_pass JMP[N]Z optimization). (ilutov)
      • Fixed bug GH-20914 (Internal enums can be cloned and compared). (Arnaud)
      • Fix OSS-Fuzz #474613951 (Leaked parent property default value). (ilutov)
      • Fixed bug GH-20766 (Use-after-free in FE_FREE with GC interaction). (Bob)
      • Fix OSS-Fuzz #471486164 (Broken by-ref assignment to uninitialized hooked backing value). (ilutov)
      • Fix OSS-Fuzz #438780145 (Nested finally with repeated return type check may uaf). (ilutov)
      • Fixed bug GH-20905 (Lazy proxy bailing __clone assertion). (ilutov)
      • Fixed bug GH-20479 (Hooked object properties overflow). (ndossche)

    • Date

      • Update timelib to 2022.16. (Derick)

    • DOM

      • Fixed GH-21041 (Dom\HTMLDocument corrupts closing tags within scripts). (lexborisov)

    • MbString

      • Fixed bug GH-20833 (mb_str_pad() divide by zero if padding string is invalid in the encoding). (ndossche)
      • Fixed bug GH-20836 (Stack overflow in mb_convert_variables with recursive array references). (alexandre-daubois)

    • Opcache

      • Fixed bug GH-20818 (Segfault in Tracing JIT with object reference). (khasinski)

    • OpenSSL

      • Fix memory leaks when sk_X509_new_null() fails. (ndossche)
      • Fix crash when in openssl_x509_parse() when i2s_ASN1_INTEGER() fails. (ndossche)
      • Fix crash in openssl_x509_parse() when X509_NAME_oneline() fails. (ndossche)

    • Phar

      • Fixed bug GH-20882 (buildFromIterator breaks with missing base directory). (ndossche)

    • PGSQL

      • Fixed INSERT/UPDATE queries building with PQescapeIdentifier() and possible UB. (David Carlier)

    • Readline

      • Fixed bug GH-18139 (Memory leak when overriding some settings via readline_info()). (ndossche)

    • SPL

      • Fixed bug GH-20856 (heap-use-after-free in SplDoublyLinkedList iterator when modifying during iteration). (ndossche)

    • Standard

      • Fixed bug #74357 (lchown fails to change ownership of symlink with ZTS). (Jakub Zelenka)
      • Fixed bug GH-20843 (var_dump() crash with nested objects). (David Carlier)