PHP 7.3.6: Downloads, Changelog, News

Release Information

Release
7.3.6
PHP Version
PHP 7.3
Release Date
Release Type
Security Update
Release Status
EOL, Use PHP 7.3.33
Branch Status
Unsupported

PHP 7.3 reached EOL on , and all releases of this version no longer receive security or bug fixes. Using PHP 7.3.6 is not recommended. PHP 7.3.33 is the latest version in the series.

Downloads

Source Code

Git Clone
Use Git to clone the 7.3.6 tag from the PHP Git repository.
git clone https://github.com/php/php-src.git --depth 1 --branch php-7.3.6
How to compile PHP
PHP can be compiled by setting up the dependencies, building the configure script (./buildconf), configuring the build ./configure, and running make.
Detailed articles on how to compile PHP are available for Ubuntu/Debian based systems and Fedora/RHEL based systems.

Windows binaries
Non-Thread Safe Builds
Non-Thread Safe (NTS) builds are single-threaded PHP builds. They can be used on web servers that integrate PHP over FastCGI protocol, such as Nginx, Caddy, and IIS.
Thread-Safe Builds
Thread-Safe (TS) builds are multi-thread PHP builds, often used to integrate PHP as a Server API for multithreaded servers. The most common use case is using PHP as an Apache module.

Docker/Podman Containers

PHP CLI
PHP CLI Containers images only include the PHP CLI, and no FPM or Apache modules. The Alpine builds are lightweight, but may introduce incompatibilities due to their musl builds. Albeit their larger size, the Debian-based (without the "-alpine" suffix) images are more complete, and widely used.

Alpine-based: Lightweight, but may introduce incompatibilities due to their musl builds.
docker pull php:7.3.6-cli-alpine

Debian-based: More compatible with other components, complete, and are widely used.
docker pull php:7.3.6-cli
PHP CLI + Web Server Integration
These container images include PHP CLI, and a web server integration. FPM container images can be integrated with web servers such as Nginx, Caddy, and Apache with Event MPM. The Apache container images include Apache web server, integrating PHP as an Apache module.

Alpine-based: Lightweight, but may introduce incompatibilities due to their musl builds.
docker pull php:7.3.6-fpm-alpine

Debian-based ZTS Apache: Includes Apache web server integrating PHP as an Apache module.
docker pull php:7.3.6-apache

Debian-based NTS FPM: PHP-FPM, can be integrated with Nginx, Caddy, and other web servers over Fast CGI.
docker pull php:7.3.6-fpm

ChangeLog

cURL

  • Implemented FR #72189 (Add missing CURLVERSION* constants).

Date

  • Fixed bug #77909 (DatePeriod::__construct() with invalid recurrence count value).

EXIF

FPM

  • Fixed bug #77934 (php-fpm kill -USR2 not working).
  • Fixed bug #77921 (static.php.net doesn't work anymore).

GD

  • Fixed bug #77943 (imageantialias($image, false); does not work).
  • Fixed bug #77973 (Uninitialized read in gdImageCreateFromXbm). (CVE-2019-11038)

Iconv

  • Fixed bug #78069 (Out-of-bounds read in iconv.c:_php_iconv_mime_decode() due to integer overflow). (CVE-2019-11039).

JSON

  • Fixed bug #77843 (Use after free with json serializer).

Opcache

  • Fixed possible crashes, because of inconsistent PCRE cache and opcache SHM reset.

PDO_MySQL

  • Fixed bug #77944 (Wrong meta pdo_type for bigint on LLP64).

Reflection

  • Fixed bug #75186 (Inconsistent reflection of Closure:::__invoke()).

Session

  • Fixed bug #77911 (Wrong warning for session.sid_bits_per_character).

SOAP

  • Fixed bug #77945 (Segmentation fault when constructing SoapClient with WSDL_CACHE_BOTH).

SPL

  • Fixed bug #77024 (SplFileObject::__toString() may return array).

SQLite

  • Fixed bug #77967 (Bypassing open_basedir restrictions via file uris).

Standard

  • Fixed bug #77931 (Warning for array_map mentions wrong type).
  • Fixed bug #78003 (strip_tags output change since PHP 7.3).

Commit List

Christoph M. Becker

Craig Duncan

Dmitry Stogov

  • Fixed dl() function. It failed in DEBUG build without opcache because of assert during string interning in ac12cc85aa
  • It's safe to keep old string if it's stored not in SHM in bfadd9fdaf
  • Check assert only when RC_DEBUG is enabled in 3a04adce82

George Wang

  • Fixed bug in litespeed_finish_request(), disable fastcgi_finish_request() alias for now in ccf051c317
  • Improved LSAPI_End_Response_r() in ce73841cdc
  • Updated LiteSpeed SAPI to 7.3.2 to allow request header value length up to 64K in af4143753f

Ignace Nyamagana Butera

  • Fixed bug #77909: DatePeriod::__construct() with invalid recurrence count value in 7b1a4e2400

Jakub Zelenka

Javier Spagnoletti

  • Add more missing CURLVERSION* constants in 6b73e692c9
  • Update NEWS with changes made at #4093 in 78d24429f2

Nikita Popov

Peter Kokot

Remi Collet

Stanislav Malyshev

  • Fix bug #77950 - Heap-buffer-overflow in _estrndup via exif_process_IFD_TAG in f80ad18afa
  • Fix bug #77988 - heap-buffer-overflow on php_jpg_get16 in b7dc3d9039
  • Fix bug #78069 - Out-of-bounds read in iconv.c:_php_iconv_mime_decode() due to integer overflow in 70523ce41f
  • Fix bug #77967 - Bypassing open_basedir restrictions via file uris in d27b4824e6

Theodore Brown

  • Fix #77993: Wrong parse error for invalid hex literal on Windows in b6b15fc65c
Subscribe to PHP.Watch newsletter for monthly updates

You will receive an email on last Wednesday of every month and on major PHP releases with new articles related to PHP, upcoming changes, new features and what's changing in the language. No marketing emails, no selling of your contacts, no click-tracking, and one-click instant unsubscribe from any email you receive.

Support PHP.Watch — If you find the articles, version information, Codex, and other PHP.Watch contributions useful, consider supporting through GitHub Sponsors. Your sponsorship helps dedicate more time to creating valuable content and improving the PHP community. Together, we can keep the momentum going — thank you for your support!

Thanks to the highest tier sponsor: @TomasVotruba for your generous support to keep PHP.Watch moving 💜