PHP 8.1.3, 8.0.28, and 7.4.28 released with security and bug fixes

Published On2022-02-19

PHP 8.1.3, 8.0.28, and 7.4.28 released with security and bug fixes

PHP versions 8.1.3, 8.0.16, and 7.4.28 are now available to download/deploy. PHP 8.1.3 and 8.0.28 contain several bug fixes, and 8.1.3, 8.0.28, 7.4.28 all also contain a fix for a Use-After-Free security vulnerability discovered in PHP.

The Use-After-Free vulnerability, announced as CVE-2021-21708, could be exploited if a maliciously crafted string containing an integer value (commonly called a numeric string) was passed to PHP filter functions, resulting in a server crash.

Note that PHP 7.3 reached its End-Of-Life, and will not receive an update for this vulnerability, or any of the future potential security releases.

[PHP.Watch]() verified that the particular vulnerability is not exploitable on PHP 7.3 series.


Full Changelog of PHP 8.1.3

  • Core:
    • Fix: Attribute instantiation leaves dangling pointer (#81430).
    • Fix: Environment vars may be mangled on Windows (#7896).
    • Fix: Segfault when INI file is not readable (#7883).
  • FFI:
    • Fix: FFI::cast() from pointer to array is broken (#7867).
  • Filter:
  • FPM:
    • Fix: memory leak on invalid port.
    • Fix: Invalid OpenMetrics response format returned by FPM status page (#7842).
  • MBString:
    • Fix: mb_send_mail may delimit headers with LF only (#7902).
  • MySQLnd:
    • Fix: MariaDB version prefix 5.5.5- is not stripped (#7972).
  • pcntl:
    • Fix: pcntl_rfork build for DragonFlyBSD.
  • Sockets:
    • Fix: sockets extension compilation errors (#7978).
  • Standard:
    • Fix: Regression in unpack for negative int value (#7899).
    • Fix: mails are sent even if failure to log throws exception (#7875).

Full Changelog of PHP 8.0.16

  • Core:
    • Fix: Attribute instantiation leaves dangling pointer (#81430).
    • Fix: Environment vars may be mangled on Windows (#7896).
  • FFI:
    • Fix: FFI::cast() from pointer to array is broken (#7867).
  • Filter:
  • FPM:
    • Fix: memory leak on invalid port.
  • MBString:
    • Fix: mb_send_mail may delimit headers with LF only (#7902).
  • MySQLnd:
    • Fix: MariaDB version prefix 5.5.5- is not stripped (#7972).
  • Sockets:
    • Fix: sockets extension compilation errors (#7978).
    • Fix: ext/sockets build on Haiku.
  • Standard:
    • Fix: mails are sent even if failure to log throws exception (#7875).

Full Changelog of PHP 7.4.28

In other news on PHP.Watch

All NewsFeed
PHP 8.2.0 Release Rescheduled to December 8

PHP 8.2.0 Release Rescheduled to December 8

PHP 8.2 Release managers announced today that due to a newly found bug in PHP's Opcache, PHP 8.2.0 release will be rescheduled to December 8th.
PHP 8.1.11, 8.0.24, and 7.4.32 released with security and bug fixes

PHP 8.1.11, 8.0.24, and 7.4.32 released with security and bug fixes

New PHP versions 8.1.1, 8.0.24, and 7.4.32 released, and they contain bug fixes and security fixes how PHP handles gzip files and cookies.
Longhorn PHP 2022 CFP Open

Longhorn PHP 2022 CFP Open

Longhorn PHP, one of the biggest PHP conferences in Texas, is now accepting talks for Longhorn PHP 2022, scheduled for November 3-5 in Austin, Texas.
Subscribe to PHP.Watch newsletter for monthly updates

You will receive an email on last Wednesday of every month and on major PHP releases with new articles related to PHP, upcoming changes, new features and what's changing in the language. No marketing emails, no selling of your contacts, no click-tracking, and one-click instant unsubscribe from any email you receive.