PHP 7.4 reached EOL on , and all releases of this version no longer receive security or bug fixes. Using PHP 7.4.21 is not recommended. PHP 7.4.33 is the latest version in the series.
Downloads
Source Code
Git Clone
Use Git to clone the 7.4.21 tag from the PHP Git repository.
git clone https://github.com/php/php-src.git --depth 1 --branch php-7.4.21How to compile PHP
PHP can be compiled by setting up the dependencies, building the configure script (
Detailed articles on how to compile PHP are available for Ubuntu/Debian based systems and Fedora/RHEL based systems.
./buildconf), configuring the build ./configure, and running make.Detailed articles on how to compile PHP are available for Ubuntu/Debian based systems and Fedora/RHEL based systems.
Windows binaries
Non-Thread Safe Builds
Non-Thread Safe (NTS) builds are single-threaded PHP builds. They can be used on web servers that integrate PHP over FastCGI protocol, such as Nginx, Caddy, and IIS.
php-7.4.21-x64NTS.zip (24.85 MiB)
php-7.4.21-x86NTS.zip (23.14 MiB)
Thread-Safe Builds
Thread-Safe (TS) builds are multi-thread PHP builds, often used to integrate PHP as a Server API for multithreaded servers. The most common use case is using PHP as an Apache module.
php-7.4.21-x64TS.zip (24.96 MiB)
php-7.4.21-x86TS.zip (23.12 MiB)
Docker/Podman Containers
PHP CLI
PHP CLI Containers images only include the PHP CLI, and no FPM or Apache modules. The Alpine builds are lightweight, but may introduce incompatibilities due to their musl builds. Albeit their larger size, the Debian-based (without the "-alpine" suffix) images are more complete, and widely used.
Alpine-based: Lightweight, but may introduce incompatibilities due to their musl builds.
docker pull php:7.4.21-cli-alpineDebian-based: More compatible with other components, complete, and are widely used.
docker pull php:7.4.21-cliPHP CLI + Web Server Integration
These container images include PHP CLI, and a web server integration. FPM container images can be integrated with web servers such as Nginx, Caddy, and Apache with Event MPM. The Apache container images include Apache web server, integrating PHP as an Apache module.
Alpine-based: Lightweight, but may introduce incompatibilities due to their musl builds.
docker pull php:7.4.21-fpm-alpineDebian-based ZTS Apache: Includes Apache web server integrating PHP as an Apache module.
docker pull php:7.4.21-apacheDebian-based NTS FPM: PHP-FPM, can be integrated with Nginx, Caddy, and other web servers over Fast CGI.
docker pull php:7.4.21-fpmChangeLog
Core
- Fixed bug #76359 (
open_basedirbypass through adding ".."). - Fixed bug #81068 (Double free in
realpath_cache_clean()). - Fixed bug #81070 (Integer underflow in memory limit comparison).
- Fixed bug #81090 (Typed property performance degradation with .= operator).
- Fixed bug #81122: SSRF bypass in FILTER_VALIDATE_URL. (CVE-2021-21705)
Bzip2
- Fixed bug #81092 (fflush before
stream_filter_removecorrupts stream).
OpenSSL
- Fixed bug #76694 (native Windows cert verification uses CN as sever name).
PDO_Firebird
- Fixed bug #76448: Stack buffer overflow in firebird_info_cb. (CVE-2021-21704)
- Fixed bug #76449: SIGSEGV in firebird_handle_doer. (CVE-2021-21704)
- Fixed bug #76450: SIGSEGV in firebird_stmt_execute. (CVE-2021-21704)
- Fixed bug #76452: Crash while parsing blob data in firebird_fetch_blob. (CVE-2021-21704)
Standard
- Fixed bug #81048 (phpinfo(INFO_VARIABLES) "Array to string conversion").
Commit List
Christoph M. Becker
- Fix #81048: phpinfo(INFO_VARIABLES) "Array to string conversion" in 36b9bdeeec
- Update version in
php_version.has well in 59522ba968 - Fix #76359:
open_basedirbypass through adding ".." in ee9e07541f - Speed up
ext/dba/tests/bug78808.phptin c11b52de95 - Fix typo in test case (doe → die) in 4ab434fa0e
- Fix #76694: native Windows cert verification uses CN as sever name in 7fd48264de
- Fix #81092: fflush before
stream_filter_removecorrupts stream in a1738d8bd1 - Fix test wrt. OPENSSL_CONF in d15e10d7ab
- Fix #81122: SSRF bypass in FILTER_VALIDATE_URL in 5cea97e083
- Fix #76452: Crash while parsing blob data in firebird_fetch_blob in 1d4c3114af
- Fix #76450: SIGSEGV in firebird_stmt_execute in 922ea34199
- Fix #76449: SIGSEGV in firebird_handle_doer in 08fc2960bc
- Fix #76448: Stack buffer overflow in firebird_info_cb in e92d5edeee
Derick Rethans
- The PHP 7.4 branch is now for 7.4.21 in 3938bfb564
- Prepare NEWS for 7.4.21 in 3fb79c2b6e
- Update versions for PHP 7.4.21 in bc008409df
Dimitry Andric
- Fix bug #81068: Fix possible use-after-free in
realpath_cache_clean()in 99a208566a
Nikita Popov
- Fix handling of
open_basedirthat contains cwd in ee7a8acde9 - Fixed bug #81090 in 82f6f6da67
- Skip test without ZMM in d4f493b0b0
- Try to fix libxml 2.9.12 tests in d818edeae2
- Fixed bug #81104 in d8165c2502
- Mitigation for bug #81096 in 3f4bc94b00
Peter van Dommelen
- Fixed bug #81070 in 1b3b5c94e5
Stanislav Malyshev
- Fix warning in cece92ba66
Stéphan Kochen
- Make tests compatible with libxml2 2.9.12 in f3d1e9ed06