PHP Release Notes

BCMath

• Fixed out-of-bounds read in bc_is_zero_for_scale() when scale exceeds n_scale.

Core

• Fixed out-of-bounds reads during automatic UTF-16/32 encoding detection.
• Fixed bug GH-15375 (Nested "yield from" skips items after a valid() or next() call on the inner generator).
• Fixed bug GH-23232 (lone namespace separator asks the autoloader for an empty class name).
• Fixed bug GH-23301 (Nested "yield from" yields a value twice when the middle generator delegates again).

DOM

• Fixed NamedNodeMap::getNamedItemNS() with an empty URI not matching the null namespace in spec-following mode.
• Fixed stale getElementsByClassName() and other node list caches after className/classList writes and attribute removals.
• Fixed a use-after-free when cloning a DOMNameSpaceNode after DOMDocument::xinclude().
• Fixed a crash in DOMXPath when a php:function callback receives a nodeset and a later callback returns a node from another document.
• Fixed bug GH-23331 (UAF when node_list_unlink() skips attribute children that still have a live wrapper).
• Fixed a use-after-free when Dom\Element::setAttributeNS() replaces the value of an attribute whose child still has a live wrapper.

GD

• Fixed imageaffinematrixget() and imageaffinematrixconcat() reporting the wrong argument in error messages.

FPM

• Fixed bug GH-19320 (FPM UID and GID overflow).
• Fixed GHSA-62xp-839h-2637 (IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison). (CVE-2026-91768)

Intl

• Fixed grapheme_strpos() and grapheme_strrpos() with an empty needle returning UTF-16 offsets instead of grapheme offsets.
• Fixed a memory leak when dumping IntlCalendar instances.
• Fixed a memory leak when iterating IntlBreakIterator::getPartsIterator() results.
• Fixed a double-free when IntlGregorianCalendar construction fails after the ICU constructor adopts the TimeZone.
• Fixed bug GH-23094 (NumberFormatter parsing offsets use UTF-16 positions for UTF-8 strings).
• Fixed Locale::parseLocale() reading past a trailing '-' or '_'.
• Fixed grapheme_str_split() treating UBRK_DONE as a byte index.
• Fixed a leak in Locale::getKeywords() when a keyword value cannot be read.
• Fixed a use-after-free when IntlRuleBasedBreakIterator is constructed from compiled rules.

MBString

• Fixed mb_ereg_replace() emitting a NUL or out-of-bounds bytes in the replacement when a \k backref has no closing delimiter.

MySQLnd

• Fixed GHSA-r6x9-5r99-36j7 (Various packet overreads in mysqlnd wire protocol). (CVE-2025-1218)

ODBC

• Fixed odbc_field_len(), odbc_field_scale() and odbc_field_type() returning uninitialized memory when SQLColAttribute fails.

Opcache

• Fixed opcache.protect_memory race under ZTS.
• Fixed a tracing JIT crash when compiling a side trace for a method of a class that could not be stored in the inheritance cache.
• Fixed a crash when the huge page SHM remap discarded mappings outside the reserved address range.

OpenSSL

• Fixed GHSA-vvx9-73fr-5jjx (TLS hostname verification falls back to CN after SAN mismatch). (CVE-2026-91769)
• Fixed GHSA-xr7j-rvgx-xq5p (Heap buffer overflow in php_openssl_matches_wildcard_name() on crafted server certificate wildcard CN). (CVE-2026-91767)

PDO

• Fixed a leak when a persistent connection failed a liveness check with no other live PDO handle.

PDO_PGSQL

• Fixed PDO::CURSOR_SCROLL statements failing under lazy fetching (PDO::ATTR_PREFETCH => 0).

PDO Sqlite

• Fixed bug GH-20214 (PDO::FETCH_DEFAULT unexpected behavior with PDOStatement::setFetchMode).

Phar

• Fixed bug GH-23418 (Use-after-free when looking up mounted directories).
• Fixed bug GH-23477 (Memory leak on duplicate native Phar manifest entries).
• Fixed GHSA-j3wh-g957-2m85 (Integer overflow in phar_tar_number() allowing TAR archive entry injection). (CVE-2026-6103)

Readline

• Fixed the interactive shell not waiting for the pager process to exit.

SOAP

• Fixed WSDL cache corruption when a soap:header defines headerfaults.
• Fixed stack overflow when parsing a WSDL with self-referential schema groups or attributeGroups.
• Fixed GHSA-rgrp-mwpx-f6rm (Unbounded recursion in server-side cleanup_xml_node()). (CVE-2026-91765)
• Fixed GHSA-cj93-vc83-wgqv (Integer overflow to buffer overflow in SOAP HTTP parsing). (CVE-2025-14181)

Standard

• Fixed a segfault when a stream filter callback unsets StreamBucket::$data before re-attaching the bucket.
• Fixed GHSA-7875-c8px-7q5f (Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header). (CVE-2026-93682)
• Fixed a memory leak in array_merge_recursive() when the recursive merge of an object converted to an array fails.
• Fixed read buffer compaction in php_stream_filter_flush().
• Fixed bug GH-22410 (Incorrect float behavior with large numbers).
• Fixed GH-23338 (fsockopen()/pfsockopen() ValueError reported wrong argument number for $timeout).
• Fixed bug GH-23576 (Next index for array returned from array_keys() is wrong).
• Fixed GHSA-88hq-2827-7pg6 (Out-of-bounds read in convert.* stream filters when line-break-chars contains NUL). (CVE-2026-92842)
• Fixed GHSA-fpwc-w8rq-cr92 (Cross-origin credential leak in HTTP stream wrapper redirects). (CVE-2026-91766)

SimpleXML

• Fixed writing to a dimension of the object returned by attributes() not creating the attribute.
• Fixed child elements of the element returned by SimpleXMLElement::addChild() not being accessible by property name when namespaces are involved.

Windows

• Fixed GHSA-9f67-6fw4-hpfp (Reserved device names are not rejected before file and stream I/O). (CVE-2026-17545)

Zip

• Fixed bug GH-17787 (ZipArchive stream stops reading early when the archive is freed while the stream is still open).
• Fixed bug GH-23276 (ZipArchive subclass storing its own stream cannot be garbage collected).

SAPI

• Fixed fuzzer targets failing to build in isolation.
• Fixed returns uninitialized value on LiteSpeed lsapi SAPI (Go Kudo)

Core

• Fixed bug GH-22782 (Const expr FCC crashes under preloading).
• Fixed bug GH-23088 (Stack overflow when comparing deeply nested arrays).

Date

• Fixed leak on double DatePeriod::__construct() call.

DOM

• Fixed bug GH-23116 (Stack overflow when normalizing a deeply nested DOMDocument).
• Fixed bug GH-23117 (Stack overflow when normalizing a deeply nested Dom\XMLDocument).
• Fixed bug GH-22825 (DOMElement::setAttribute() fails silently when the DTD declares a default value for the attribute).
• Fixed bug GH-23120 (Stack overflow when comparing deeply nested DOM nodes with DOMNode::isEqualNode()).

Exif

• Fixed exif_read_data() allocating a HEIF meta box larger than the file it came from.

Intl

• Fixed IntlListFormatter::__construct() leaving stale global error state after successful calls.

Opcache

• Fixed GH-22693 (DT_TEXTREL in JIT-generated TLS access on x86_64).
• Fixed bug GH-22763 (JIT fails to clear ZREG_TYPE_ONLY after setting reg).
• Fixed bug GH-22857 (Function JIT emits wrong code for FETCH_OBJ_FUNC_ARG on a property hook getter, losing register-held variables).
• Fixed bug GH-22916 (Preserve parent regs in zend_jit_deoptimizer_start()).

OpenSSL

• Fix missing error check on invalid alpn protocols.

MBString

• Fixed bug GH-22779 (mb_strrpos() returns the wrong position for a negative offset in a non-UTF-8 encoding).
• Fixed bug GH-21036 (mb_ereg_search_getregs() crashes after mb_eregi() invalidates the regex cache).

PCRE

• Fixed bug GH-21134 (Crash with \C + UTF-8). Using \C in UTF-8 patterns is now forbidden.

PDO_ODBC

• Fixed bug GH-23016 (NULL values in long columns come back as garbage binary strings).

PDO_PGSQL

• Fixed several lazy fetch (PDO::ATTR_PREFETCH => 0) defects: an infinite loop when cleaning up a fetch left in a COPY, a use-after-free when a statement with emulated or disabled prepares is destroyed, a connection left busy for the next fetch, and rows delivered from a result another statement took over.

Reflection

• Fixed bug GH-22905 (Reflection exception messages truncate on null bytes).
• Fixed ReflectionProperty::isLazy() and skipLazyInitialization() using the parent slot when a child class hooks an inherited property.
• Fixed segfault in ReflectionMethod::createFromMethodName() on an uninstantiable subclass.

Session

• Fix corruption in mod_mm.
• Fixed bug GH-23043 (broken session id code can cause zend_mm_heap corrupted).

SimpleXML

• Fixed integer element offsets that cannot resolve aliasing an existing element.
• Fixed segfault when comparing uninitialized SimpleXMLElement instances.

Sockets

• Fixed socket_set_option() validation error messages for UDP_SEGMENT and SO_LINGER options.
• Fixed various memory related issues in ext/sockets.

SQLite

• Fix leak when trying to close db if blob stream is still open.

Standard

• Fixed bug GH-23111 (Stack overflow in array_walk_recursive() with deeply nested arrays).
• Fixed bug GH-23113 (Stack overflow in array_replace_recursive() with deeply nested arrays).
• Fixed bug GH-23115 (Stack overflow in compact() with deeply nested arrays).

Streams

• Fixed bug GH-15836 (Use-after-free when a user stream filter accesses $this->stream during the close flush).

XSL

• Fixed use-after-free when a DOMDocument subclass __clone() retains the stylesheet copy made by XSLTProcessor::importStylesheet().

BCMath

• Fixed GHSA-x692-q9x7-8c3f (Out-of-bounds write in bccomp()). (CVE-2026-17544)

Calendar

• Fixed bug GH-22602 (gregoriantojd() and juliantojd() integer overflow with INT_MAX year).

Date

• Update timelib to 2022.17.
• Fixed bug GH-19803 (Parsing a string with a single white space does create an error).
• Fixed Unix timestamps in February of the year 0 are misparsed with @-notation.
• Fixed bug GH-11310 (__debugInfo does nothing on userland classes extending Date classes).

DBA

• Fixed OOB read on malformed length field in dba flatfile handler.

DOM

• Fixed bug GH-22570 (Stack overflow when serializing a deeply nested Dom\XMLDocument).

Exif

• Fixed bug GH-11020 (exif_read_data() emits a spurious "Illegal IFD size" warning when an IFD is not followed by a next-IFD offset).

GD

• Upgrade libgd. (CVE-2026-9672)

Hash

• Fixed bug GH-18173 (ext/hash relies on implementation-defined malloc alignment).

Intl

• Fixed Locale::lookup() and locale_lookup() to return NULL instead of the fallback locale when a language tag cannot be canonicalized.
• Fixed memory leaks when calling Collator::__construct() or Spoofchecker::__construct() twice.
• Fixed IntlChar methods leaving stale global error state after successful calls.

ODBC

• Fixed bug GH-22668 (Heap buffer over-read when a column value exceeds the driver-reported display size).

OpenSSL

• Fixed timeout for supplemental read at end of a blocking stream in SSL stream wrapper.

PDO_ODBC

• Fixed bug GH-20726 (Crash with ODBC connection pooling when the DSN carries no credentials).
• Fixed bug GH-22667 (Heap buffer over-read when a column value exceeds the driver-reported display size).
• Fixed bug GH-22666 (Heap buffer overflow when an output parameter value is longer than the declared maxlen).

PGSQL

• Fixed GHSA-7qpv-r5mr-78m4 (SQL injection via E'...' backslash breakout). (CVE-2026-17543)

Phar

• Fixed inconsistent handling of the magic ".phar" directory. Paths such as "/.phar" remain protected, while non-magic paths that merely start with ".phar" are handled consistently across file and directory creation, copying, ArrayAccess, stream lookup, directory iteration and extraction.
• Fixed GHSA-vc5h-9ppw-p5f3 (Crash via recursive symlinks). (CVE-2026-7260)

PHPDBG

• Fixed bug GH-17387 (Trivial crash in phpdbg lexer).

Core

• Fixed bug GH-22290 (AST pretty printing does not correctly handle strings containing NUL).
• Fixed bug GH-22206 (missing return in global register detection).
• Lock unmodified readonly properties for modification after clone-with.

BCMath

• Fixed GHSA-x692-q9x7-8c3f (Out-of-bounds write in bccomp()). (CVE-2026-17544)

Calendar

• Fixed bug GH-22602 (gregoriantojd() and juliantojd() integer overflow with INT_MAX year).

Date

• Update timelib to 2022.17.
• Fixed bug GH-19803 (Parsing a string with a single white space does create an error).
• Fixed Unix timestamps in February of the year 0 are misparsed with @-notation.
• Fixed bug GH-11310 (__debugInfo does nothing on userland classes extending Date classes).

DBA

• Fixed OOB read on malformed length field in dba flatfile handler.

DOM

• Fixed bug GH-22570 (Stack overflow when serializing a deeply nested Dom\XMLDocument).
• Fixed getElementsByClassName() item() returning the wrong element on random access.

Exif

• Fixed bug GH-11020 (exif_read_data() emits a spurious "Illegal IFD size" warning when an IFD is not followed by a next-IFD offset).

GD

• Upgrade libgd. (CVE-2026-9672)

Hash

• Fixed bug GH-18173 (ext/hash relies on implementation-defined malloc alignment).

ODBC

• Fixed bug GH-22668 (Heap buffer over-read when a column value exceeds the driver-reported display size).

Opcache

• Fixed bug GH-22158 (Tracing JIT dispatches the observer begin handler through the wrong run_time_cache slot on megamorphic calls).
• Fixed bug GH-22443 (Tracing JIT SIGSEGV on megamorphic dynamic calls from an undereferenced run_time_cache map_ptr offset).
• Fixed bug GH-21770 (Infinite recursion in property hook getter in opcache preloaded trait).

OpenSSL

• Fixed timeout for supplemental read at end of a blocking stream in SSL stream wrapper.

Intl

• Fixed Locale::lookup() and locale_lookup() to return NULL instead of the fallback locale when a language tag cannot be canonicalized.
• Fixed memory leaks when calling Collator::__construct() or Spoofchecker::__construct() twice.
• Fixed memory leak when calling IntlListFormatter::__construct() twice.
• Fixed IntlChar methods leaving stale global error state after successful calls.

PDO_ODBC

• Fixed bug GH-20726 (Crash with ODBC connection pooling when the DSN carries no credentials).
• Fixed bug GH-22667 (Heap buffer over-read when a column value exceeds the driver-reported display size).
• Fixed bug GH-22666 (Heap buffer overflow when an output parameter value is longer than the declared maxlen).
• Fixed bug GH-22665 (Out-of-bounds write when the ODBC driver reports a diagnostic message length beyond the error buffer).

PGSQL

• Fixed GHSA-7qpv-r5mr-78m4 (SQL injection via E'...' backslash breakout). (CVE-2026-17543)

Phar

• Fixed inconsistent handling of the magic ".phar" directory. Paths such as "/.phar" remain protected, while non-magic paths that merely start with ".phar" are handled consistently across file and directory creation, copying, ArrayAccess, stream lookup, directory iteration and extraction.
• Fixed GHSA-vc5h-9ppw-p5f3 (Crash via recursive symlinks). (CVE-2026-7260)

PHPDBG

• Fixed bug GH-17387 (Trivial crash in phpdbg lexer).
• Fixed fleaked lowercased lookup keys in phpdbg_resolve_opline_break.
• Fixed off-by-one in phpdbg_safe_class_lookup() causing class lookups to always fail during phpdbg's signal-safe interruption path.

Reflection

• Fixed bug GH-22324 (Ignore leading namespace separator in ReflectionParameter::__construct()).
• Fixed bug GH-22441 (ReflectionClass::hasProperty() and getProperty() ignore dynamic properties shadowing a private parent property).
• Fixed bug GH-22658 (ReflectionConstant::__toString() with a string value with null bytes truncates output).
• Fixed bug GH-22683 (Reflection(Class)Constant::__toString() should not warn on NAN conversions).
• Fixed bug GH-22681 (Reflection*::__toString() truncates on null bytes).

Session

• Fixed bug GH-21314 (Different session garbage collector behavior between PHP 8.3 and PHP 8.5).

SPL

• Fix class_parents for classes with leading slash in non-autoload mode.
• Ignore leading back-slash in class_parents(), class_implements(), and class_uses().
• Fixed bug GH-16217 (SplFileObject::fputcsv() on an uninitialized object segfaults).

Standard

• Fixed bug GH-22395 (base_convert() outputs at most 64 characters).
• Fixed bug GH-22678 (Use-after-free in array_multisort() when the comparator mutates the array being sorted).

URI

• Fixed behavior of Uri\WhatWg\Url wither methods with regards to empty opaque hosts.
• Fixed bug GH-22628 (Percent-encoding of caret in WHATWG URL paths is not performed).
• Fixed bug GH-22629 (WHATWG Validation error incorrect with empty host and non-empty userinfo).

Zip

• Fixed bug GH-22649 (ZipArchive::setCommentName() and setCommentIndex() could crash after overwriting an entry and resetting its inherited unchanged comment).
• Fixed bug GH-21705 (ZipArchive::getFromIndex() ignores ZipArchive::FL_UNCHANGED for deleted entries).

Core

• Fixed bug GH-22280 (Incorrect compile error for goto to label preceding try/finally block).

BCMath

• Fixed issues with oversized allocations and signed overflow in bcround() and BcMath\Number::round().

Date

• Fix incorrect recurrence check of DatePeriod::createFromISO8601String().

DOM

• Fix GH-22219 (Dom\XMLDocument::schemaValidate fails to resolve xs:QName with prefix from imported schema).

Exif

• Read correct value for single and double tags.

GD

• Fixed bug GH-22121 (Double free in gdImageSetStyle() after overflow-triggered early return).

Intl

• Fix incorrect argument positions for uninitialized calendar arguments in IntlCalendar::equals(), ::before(), ::after(), and ::isEquivalentTo(), and for invalid start/end arguments in transliterator_transliterate().
• Fixed IntlTimeZone::getDisplayName() to synchronize object error state for invalid display types.
• Fixed Spoofchecker restriction-level APIs to only be exposed with ICU 53 and later.

mysqli

• Fix stmt->query leak in mysqli_execute_query() validation errors.

Opcache

• Fixed bug GH-20469 (Unsafe inheritance cache replay with reentrant autoloading).
• Fixed tracing JIT crash when a VM interrupt is handled during an observed user function call.

OpenSSL

• Fix a bunch of memory leaks and crashes on edge cases.

PDO_Firebird

• Fixed GHSA-w476-322c-wpvm (SQL injection via NUL bytes in quoted strings). (CVE-2025-14179)

Phar

• Restore is_link handler in phar_intercept_functions_shutdown.
• Fixed bug GH-21797 (phar: NULL dereference in Phar::webPhar() when SCRIPT_NAME is absent from SAPI environment).
• Fix memory leak in Phar::offsetGet().

Random

• Fixed bug GH-21731 (Random\Engine\Xoshiro256StarStar::__unserialize() accepts all-zero state).

SOAP

• Fixed bug GH-21314 (Different session garbage collector behavior between PHP 8.3 and PHP 8.5).

SPL

• Fix class_parents for classes with leading slash in non-autoload mode.
• Ignore leading back-slash in class_parents(), class_implements(), and class_uses().

Standard

• Fixed bug GH-22360 (convert.base64-encode corruption on incremental flush).
• Fixed bug GH-22395 (base_convert() outputs at most 64 characters).
• Fixed bug GH-22678 (Use-after-free in array_multisort() when the comparator mutates the array being sorted).

Core

• Fixed bug GH-22280 (Incorrect compile error for goto to label preceding try/finally block).
• Fixed bug GH-22112 (Assertion when error handler throws during NaN to bool/string coercion).

BCMath

• Fixed issues with oversized allocations and signed overflow in bcround() and BcMath\Number::round().

Date

• Fix incorrect recurrence check of DatePeriod::createFromISO8601String().

Exif

• Read correct value for single and double tags.

GD

• Fixed bug GH-22121 (Double free in gdImageSetStyle() after overflow-triggered early return).

Intl

• Fix incorrect argument positions for invalid start/end arguments in transliterator_transliterate().
• Fixed IntlTimeZone::getDisplayName() to synchronize object error state for invalid display types.

Lexbor

• Merge patch c3a6847.

Opcache

• Fixed bug GH-22265 (Another tailcall vm_interrupt bug).
• Fixed bug GH-20469 (Unsafe inheritance cache replay with reentrant autoloading).
• Fixed bug GH-21972 (Corrupted variable type when a typed by-value return contains a reference wrapper).

OpenSSL

• Fixed bug GH-22187 (Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD). (CVE-2026-14355)

Phar

• Fixed a bypass of the magic ".phar" directory protection in Phar::addEmptyDir() for paths starting with "/.phar", while allowing non-magic directory names that merely share the ".phar" prefix.

Reflection

• Preserve class-name case in ReflectionClass::getProperty() error messages and autoloading.

SOAP

• Fixed bug GH-22218 (SoapServer::handle() crash on $_SERVER not being an array).
• Fixed bug GH-22285 (Soap server requires the raw input to be passed to $server->handle).

Sqlite

• Fix error checks for column retrieval.

URI

• Add LEXBOR_STATIC to CFLAGS_URI on Windows so ext/uri does not see LXB_API as __declspec(dllimport) when linked statically into PHP.
• Clean error logs before each Uri\WhatWg\Url wither call so that errors from previous wither calls are not returned the next time a UrlValidationError is thrown.

Zip

• Fixed error-related memory leaks.

Zlib

• Fixed memory leak if deflate initialization fails and there is a dict.
• Fixed memory leak in inflate_add().

Date

• Fixed bug GH-18422 (int overflow in php_date_llabs).

Intl

• Fix incorrect argument positions in out-of-bounds errors for IntlCalendar::set(), IntlCalendar::setDate(), IntlCalendar::setDateTime(), and IntlGregorianCalendar date/time construction.
• Expose Spoofchecker restriction-level APIs on all supported ICU versions.
• Fix SpoofChecker::setAllowedChars() and IntlDateFormatter::__construct() to report PHP constant names instead of ICU constant names in user-visible error messages.

MySQLnd

• Fix persistent free of non-persistent connect_attr key (David Carlier).

Opcache

• Fixed tracing JIT crash when a VM interrupt is handled during an observed user function call.
• Fixed bug GH-22004 (Assertion failure at ext/opcache/jit/zend_jit_trace.c).

OpenSSL

• Fix compatibility issues with OpenSSL 4.0.

SPL

• Fix SplFixedArray::setSize leak when destructor grows during clear.
• Fixed bug GH-21933 (use after free of self-freeing MultipleIterator children).

Standard

• Fixed bug GH-21689 (version_compare() incorrectly handles versions ending with a dot).
• Fixed ip2long leading zeros handling inconsistency on AIX.

CLI

• Fixed bug GH-21901 (Stale getopt() optional value).

Date

• Fixed bug GH-18422 (int overflow in php_date_llabs).

DOM

• Fixed bug GH-22077 (UAF in custom XPath function).

Opcache

• Fixed tracing JIT crash when a VM interrupt is handled during an observed user function call.
• Fixed bug GH-21746 (Segfault with tracing JIT).
• Fixed bug GH-22004 (Assertion failure at ext/opcache/jit/zend_jit_trace.c).
• Fixed tailcall VM crash when a VM interrupt is handled from a VM helper.

OpenSSL

• Fix compatibility issues with OpenSSL 4.0.

Standard

• Fixed bug GH-21689 (version_compare() incorrectly handles versions ending with a dot).

URI

• Fixed CVE-2026-44927 (In uriparser before 1.0.2, there is pointer difference truncation to int in various places). (CVE-2026-44927)
• Fixed CVE-2026-44928 (In uriparser before 1.0.2, the function family EqualsUri can misclassify two unequal URIs as equal). (CVE-2026-44928)

Core

• Fixed bug GH-19983 (GC assertion failure with fibers, generators and destructors).
• Fixed ZEND_API mismatch on zend_ce_closure forward decl for Windows+Clang.
• Fixed bug GH-21504 (Incorrect RC-handling for ZEND_EXT_STMT op1).
• Fixed bug GH-21478 (Forward property operations to real instance for initialized lazy proxies).
• Fixed bug GH-21605 (Missing addref for Countable::count()).
• Fixed bug GH-21699 (Assertion failure in shutdown_executor when resolving self::/parent::/static:: callables if the error handler throws).
• Fixed bug GH-21603 (Missing addref for __unset).
• Fixed bug GH-21760 (Trait with class constant name conflict against enum case causes SEGV).

CLI

• Fixed bug GH-21754 (--rf command line option with a method triggers ext/reflection deprecation warnings).

Curl

• Add support for brotli and zstd on Windows.

DOM

• Fixed GHSA-4jhr-8w89-j733 and GH-21566 (Dom\XMLDocument::C14N() emits duplicate xmlns declarations after setAttributeNS()). (CVE-2026-7263)

FPM

• Fixed GHSA-7qg2-v9fj-4mwv (XSS within status endpoint). (CVE-2026-6735)

Iconv

• Fixed bug GH-17399 (iconv memory leak on bailout).

Lexbor

• Upgrade to lexbor v2.7.0.

MBString

• Fixed GHSA-wm6j-2649-pv75 (Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()). (CVE-2026-7259)
• Fixed GHSA-74r9-qxhc-fx53 (Out-of-bounds access in mbfl_name2encoding_ex()). (CVE-2026-6104)

Opcache

• Fixed bug GH-21158 (JIT: Assertion jit->ra[var].flags & (1<<0) failed in zend_jit_use_reg).
• Fixed bug GH-21593 (Borked function JIT JMPNZ smart branch).
• Fixed bug GH-21460 (COND optimization regression).
• Fixed faulty returns out of zend_try block in zend_jit_trace().

OpenSSL

• Fix memory leak regression in openssl_pbkdf2().
• Fix a bunch of memory leaks and crashes on edge cases.

PDO_Firebird

• Fixed GHSA-w476-322c-wpvm (SQL injection via NUL bytes in quoted strings). (CVE-2025-14179)

PDO_PGSQL

• Fixed bug GH-21683 (pdo_pgsql throws with ATTR_PREFETCH=0 on empty result set).

Phar

• Restore is_link handler in phar_intercept_functions_shutdown.
• Fixed bug GH-21797 (phar: NULL dereference in Phar::webPhar() when SCRIPT_NAME is absent from SAPI environment).
• Fix memory leak in Phar::offsetGet().
• Fix memory leak in phar_add_file().
• Fixed bug GH-21799 (phar: propagate phar_stream_flush return value from phar_stream_close).
• Fix memory leak in phar_verify_signature() when md_ctx is invalid.

Random

• Fixed bug GH-21731 (Random\Engine\Xoshiro256StarStar::__unserialize() accepts all-zero state).

Session

• Fixed memory leak when session GC callback return a refcounted value.

SOAP

• Fixed GHSA-85c2-q967-79q5 (Stale SOAP_GLOBAL(ref_map) pointer with Apache Map). (CVE-2026-6722)
• Fixed GHSA-m33r-qmcv-p97q (Use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION). (CVE-2026-7261)
• Fixed GHSA-hmxp-6pc4-f3vv (Broken Apache map value NULL check). (CVE-2026-7262)

SPL

• Fixed bug GH-21499 (RecursiveArrayIterator getChildren UAF after parent free).
• Fix concurrent iteration and deletion issues in SplObjectStorage.

Sqlite3

• Fixed wrong free list comparator pointer type.

Standard

• Fixed GHSA-96wq-48vp-hh57 (Signed integer overflow of char array offset). (CVE-2026-7568)
• Fixed GHSA-m8rr-4c36-8gq4 (Consistently pass unsigned char to ctype.h functions). (CVE-2026-7258)

Streams

• Fixed bug GH-21468 (Segfault in file_get_contents w/ a https URL and a proxy set). (CVE-2026-12184)

URI

• Fixed CVE-2026-42371 (uriparser before 1.0.1 has numeric truncation in text range comparison). (CVE-2026-42371)

Core

• Fixed bug GH-20672 (Incorrect property_info sizing for locally shadowed trait properties).
• Fixed bugs GH-20875, GH-20873, GH-20854 (Propagate IN_GET guard in get_property_ptr_ptr for lazy proxies).

Bz2

• Fix truncation of total output size causing erroneous errors.

DOM

• Fixed bug GH-21486 (Dom\HTMLDocument parser mangles xml:space and xml:lang attributes).

FFI

• Fixed resource leak in FFI::cdef() onsymbol resolution failure.

GD

• Fixed bug GH-21431 (phpinfo() to display libJPEG 10.0 support).

Opcache

• Fixed bug GH-21052 (Preloaded constant erroneously propagated to file-cached script).
• Fixed bug GH-20838 (JIT compiler produces wrong arithmetic results).
• Fixed bug GH-21267 (JIT tracing: infinite loop on FETCH_OBJ_R with IS_UNDEF property in polymorphic context).
• Fixed bug GH-21395 (uaf in jit).

OpenSSL

• Fixed bug GH-21083 (Skip private_key_bits validation for EC/curve-based keys).
• Fix missing error propagation for BIO_printf() calls.

PCNTL

• Fixed signal handler installation on AIX by bumping the storage size of the num_signals global.

PCRE

• Fixed re-entrancy issue on php_pcre_match_impl, php_pcre_replace_impl, php_pcre_split_impl, and php_pcre_grep_impl.

Phar

• Fixed bug GH-21333 (use after free when unlinking entries during iteration of a compressed phar).

SNMP

• Fixed bug GH-21336 (SNMP::setSecurity() undefined behavior with NULL arguments).

SOAP

• Fixed Set-Cookie parsing bug wrong offset while scanning attributes.

SPL

• Fixed bug GH-21454 (missing write lock validation in SplHeap).

Standard

• Fixed bug GH-20906 (Assertion failure when messing up output buffers).
• Fixed bug GH-20627 (Cannot identify some avif images with getimagesize).

Sysvshm

• Fix memory leak in shm_get_var() when variable is corrupted.

XSL

• Fix GH-21357 (XSLTProcessor works with DOMDocument, but fails with Dom\XMLDocument).
• Fixed bug GH-21496 (UAF in dom_objects_free_storage).

Core

• Fixed bug GH-21029 (zend_mm_heap corrupted on Aarch64, LTO builds).
• Fixed bug GH-21059 (Segfault when preloading constant AST closure).
• Fixed bug GH-21072 (Crash on (unset) cast in constant expression).
• Fix deprecation now showing when accessing null key of an array with JIT.
• Fixed bug GH-20657 (Assertion failure in zend_lazy_object_get_info triggered by setRawValueWithoutLazyInitialization() and newLazyGhost()).
• Fixed bug GH-20504 (Assertion failure in zend_get_property_guard when accessing properties on Reflection LazyProxy via isset()).
• Fixed bug OSS-Fuzz #478009707 (Borked assign-op/inc/dec on untyped hooked property backing value).
• Fixed bug GH-21215 (Build fails with -std=).
• Fixed bug GH-13674 (Build system installs libtool wrappers when using slibtool).

Curl

• Don't truncate length.

Date

• Fixed bug GH-20936 (DatePeriod::__set_state() cannot handle null start).
• Fix timezone offset with seconds losing precision.

DOM

• Fixed bug GH-21077 (Accessing Dom\Node::baseURI can throw TypeError).
• Fixed bug GH-21097 (Accessing Dom\Node properties can can throw TypeError).

LDAP

• Fixed bug GH-21262 (ldap_modify() too strict controls argument validation makes it impossible to unset attribute).

MBString

• Fixed bug GH-21223; mb_guess_encoding no longer crashes when passed huge list of candidate encodings (with 200,000+ entries).

Opcache

• Fixed bug GH-20718 ("Insufficient shared memory" when using JIT on Solaris).
• Fixed bug GH-21227 (Borked SCCP of array containing partial object).

OpenSSL

• Fix a bunch of memory leaks and crashes on edge cases.

Windows

• Fixed compilation with clang (missing intrin.h include).

Core

• Fixed bug GH-20806 (preserve_none feature compatiblity with LTO).
• Fixed bug GH-20767 (build failure with musttail/preserve_none feature on macOs).
• Fixed bug GH-20837 (NULL dereference when calling ob_start() in shutdown function triggered by bailout in php_output_lock_error()).
• Fix OSS-Fuzz #471533782 (Infinite loop in GC destructor fiber).
• Fix OSS-Fuzz #472563272 (Borked block_pass JMP[N]Z optimization).
• Fixed bug GH-20914 (Internal enums can be cloned and compared).
• Fix OSS-Fuzz #474613951 (Leaked parent property default value).
• Fixed bug GH-20895 (ReflectionProperty does not return the PHPDoc of a property if it contains an attribute with a Closure).
• Fixed bug GH-20766 (Use-after-free in FE_FREE with GC interaction).
• Fix OSS-Fuzz #471486164 (Broken by-ref assignment to uninitialized hooked backing value).
• Fix OSS-Fuzz #438780145 (Nested finally with repeated return type check may uaf).
• Fixed bug GH-20905 (Lazy proxy bailing __clone assertion).
• Fixed bug GH-20479 (Hooked object properties overflow).

Date

• Update timelib to 2022.16.

DOM

• Fixed GH-21041 (Dom\HTMLDocument corrupts closing tags within scripts).

MbString

• Fixed bug GH-20833 (mb_str_pad() divide by zero if padding string is invalid in the encoding).
• Fixed bug GH-20836 (Stack overflow in mb_convert_variables with recursive array references).

Opcache

• Fixed bug GH-20818 (Segfault in Tracing JIT with object reference).

OpenSSL

• Fix memory leaks when sk_X509_new_null() fails.
• Fix crash when in openssl_x509_parse() when i2s_ASN1_INTEGER() fails.
• Fix crash in openssl_x509_parse() when X509_NAME_oneline() fails.

Phar

• Fixed bug GH-20882 (buildFromIterator breaks with missing base directory).

PGSQL

• Fixed INSERT/UPDATE queries building with PQescapeIdentifier() and possible UB.

Readline

• Fixed bug GH-18139 (Memory leak when overriding some settings via readline_info()).

SPL

• Fixed bug GH-20856 (heap-use-after-free in SplDoublyLinkedList iterator when modifying during iteration).

Standard

• Fixed bug #74357 (lchown fails to change ownership of symlink with ZTS) (Jakub Zelenka)
• Fixed bug GH-20843 (var_dump() crash with nested objects) (David Carlier)

Core

• Fix OSS-Fuzz #465488618 (Wrong assumptions when dumping function signature with dynamic class const lookup default argument).
• Fixed bug GH-20695 (Assertion failure in normalize_value() when parsing malformed INI input via parse_ini_string()).
• Fixed bug GH-20714 (Uncatchable exception thrown in generator).
• Fixed bug GH-20352 (UAF in php_output_handler_free via re-entrant ob_start() during error deactivation).
• Fixed bug GH-20745 ("Casting out of range floats to int" applies to strings).

DOM

• Fixed bug GH-20722 (Null pointer dereference in DOM namespace node cloning via clone on malformed objects).
• Fixed bug GH-20444 (Dom\XMLDocument::C14N() seems broken compared to DOMDocument::C14N()).

EXIF

• Fixed bug GH-20631 (Integer underflow in exif HEIF parsing when pos.size < 2).

Intl

• Fix leak in umsg_format_helper().

LDAP

• Fixed bug GH-18529 (ldap_set_options memory leak).

Lexbor

• Fixed bug GH-20668 (\Uri\WhatWg\Url::withHost() crashes (SEGV) for URLs using the file: scheme).

Mbstring

• Fixed bug GH-20674 (mb_decode_mimeheader does not handle separator).

PCNTL

• Fixed bug with pcntl_getcpuaffinity() on solaris regarding invalid process ids handling.

Phar

• Fixed bug GH-20732 (Phar::LoadPhar undefined behavior when reading fails).
• Fix SplFileInfo::openFile() in write mode.
• Fixed bug #74154 (Phar extractTo creates empty files).

PDO_ODBC

• Fixed bug GH-20726 (Crash with ODBC connection pooling when the DSN carries no credentials).
• Fixed bug GH-22667 (Heap buffer over-read when a column value exceeds the driver-reported display size).

PGSQL

• Fixed bug GHSA-7qpv-r5mr-78m4 (SQL injection via E'...' backslash breakout). (CVE-2026-17543)

SOAP

• Fixed bug GH-22218 (SoapServer::handle() crash on $_SERVER not being an array).
• Fixed bug GH-22285 (Soap server requires the raw input to be passed to $server->handle).

Standard

• Fixed bug GH-22395 (base_convert() outputs at most 64 characters).
• Fixed bug GH-22678 (Use-after-free in array_multisort() when the comparator mutates the array being sorted).

Core

• Sync all boost.context files with release 1.86.0.
• Fixed bug GH-20435 (SensitiveParameter doesn't work for named argument passing to variadic parameter).
• Fixed hard_timeout with --enable-zend-max-execution-timers.
• Fixed bug GH-19792 (SCCP causes UAF for return value if both warning and exception are triggered).
• Fixed bug GH-19839 (Incorrect HASH_FLAG_HAS_EMPTY_IND flag on userland array).
• Fixed bug GH-20177 (Accessing overridden private property in get_object_vars() triggers assertion error).
• Fixed bug GH-19823 (register_argc_argv deprecation emitted twice when using OPcache).
• Fixed bug GH-19480 (error_log php.ini cannot be unset when open_basedir is configured).
• Fixed bug GH-19934 (CGI with auto_globals_jit=0 causes uouv).
• Fixed bug GH-19613 (Stale array iterator pointer).
• Fixed bug GH-19679 (zend_ssa_range_widening may fail to converge).
• Fixed bug GH-19681 (PHP_EXPAND_PATH broken with bash 5.3.0).
• Fixed bug GH-18850 (Repeated inclusion of file with __halt_compiler() triggers "Constant already defined" warning).
• Fixed bug GH-19476 (pipe operator fails to correctly handle returning by reference).
• Fixed bug GH-19081 (Wrong lineno in property error with constructor property promotion).
• Fixed bug GH-17959 (Relax missing trait fatal error to error exception).
• Fixed bug GH-18033 (NULL-ptr dereference when using register_tick_function in destructor).
• Fixed bug GH-19388 (Broken opcache.huge_code_pages).
• Fixed bug GH-19301 (opcache build failure).
• Fixed bug GH-20081 (access to uninitialized vars in preload_load()).
• Fixed bug GH-20121 (JIT broken in ZTS builds on MacOS 15).
• Fixed bug GH-19875 (JIT 1205 segfault on large file compiled in subprocess).
• Fixed bug GH-19984 (Double-free of EG(errors)/persistent_script->warnings on persist of already persisted file).
• Fixed bug GH-19889 (race condition in zend_runtime_jit(), zend_jit_hot_func()).

Core

• Sync all boost.context files with release 1.86.0.
• Fixed bug GH-20435 (SensitiveParameter doesn't work for named argument passing to variadic parameter).
• Fixed bug GH-20286 (use-after-destroy during userland stream_close()).

Bz2

• Fix assertion failures resulting in crashes with stream filter object parameters.

Date

• Fix crashes when trying to instantiate uninstantiable classes via date static constructors.

DOM

• Fix memory leak when edge case is hit when registering xpath callback.
• Fixed bug GH-20395 (querySelector and querySelectorAll requires elements in $selectors to be lowercase).
• Fix missing NUL byte check on C14NFile().

Fibers

• Fixed bug GH-20483 (ASAN stack overflow with fiber.stack_size INI small value).

FTP

• Fixed bug GH-20601 (ftp_connect overflow on timeout).

GD

• Fixed bug GH-20511 (imagegammacorrect out of range input/output values).
• Fixed bug GH-20602 (imagescale overflow with large height values).

Intl

• Fixed bug GH-20426 (Spoofchecker::setRestrictionLevel() error message suggests missing constants).

LibXML

• Fix some deprecations on newer libxml versions regarding input buffer/parser handling.

MbString

• Fixed bug GH-20491 (SLES15 compile error with mbstring oniguruma).
• Fixed bug GH-20492 (mbstring compile warning due to non-strings).

MySQLnd

• Fixed bug GH-20528 (Regression breaks mysql connexion using an IPv6 address enclosed in square brackets).

Opcache

• Fixed bug GH-20329 (opcache.file_cache broken with full interned string buffer).

PDO

• Fixed bug GHSA-8xr5-qppj-gvwj (PDO quoting result null deref). (CVE-2025-14180)

Phar

• Fixed bug GH-20442 (Phar does not respect case-insensitiveness of __halt_compiler() when reading stub).
• Fix broken return value of fflush() for phar file entries.
• Fix assertion failure when fseeking a phar file out of bounds.

PHPDBG

• Fixed ZPP type violation in phpdbg_get_executable() and phpdbg_end_oplog().

SPL

• Fixed bug GH-20614 (SplFixedArray incorrectly handles references in deserialization).

Standard

• Fix memory leak in array_diff() with custom type checks.
• Fixed bug GH-20583 (Stack overflow in http_build_query via deep structures).
• Fixed GHSA-www2-q4fc-65wf (Null byte termination in dns_get_record()).
• Fixed GHSA-h96m-rvf9-jgm2 (Heap buffer overflow in array_merge()). (CVE-2025-14178)
• Fixed GHSA-3237-qqm7-mfv7 (Information Leak of Memory in getimagesize). (CVE-2025-14177)

Tidy

• Fixed bug GH-20374 (PHP with tidy and custom-tags).

XML

• Fixed bug GH-20439 (xml_set_default_handler() does not properly handle special characters in attributes when passing data to callback).

Zip

• Fix crash in property existence test.
• Don't truncate return value of zip_fread() with user sizes.

Zlib

• Fix assertion failures resulting in crashes with stream filter object parameters.