PHP 8.1.11: Downloads, Changelog, News

Release Information

PHP Version
PHP 8.1
Release Date
Release Type
Security Update
Release Status
Use PHP 8.1.28 instead
Branch Status
Security-Fixes Only

PHP 8.1 is currently only receiving security fixes. PHP 8.1.11 is not the latest version in the series, and using this release is not recommended. PHP 8.1.28 is the latest in the series.


Source Code

Git Clone
Use Git to clone the 8.1.11 tag from the PHP Git repository.
git clone --depth 1 --branch php-8.1.11
How to compile PHP
PHP can be compiled by setting up the dependencies, building the configure script (./buildconf), configuring the build ./configure, and running make.
Detailed articles on how to compile PHP are available for Ubuntu/Debian based systems and Fedora/RHEL based systems.

Windows binaries

Non-Thread Safe Builds
Non-Thread Safe (NTS) builds are single-threaded PHP builds. They can be used on web servers that integrate PHP over FastCGI protocol, such as Nginx, Caddy, and IIS.
Thread-Safe Builds
Thread-Safe (TS) builds are multi-thread PHP builds, often used to integrate PHP as a Server API for multithreaded servers. The most common use case is using PHP as an Apache module.

Docker/Podman Containers

PHP CLI Containers images only include the PHP CLI, and no FPM or Apache modules. The Alpine builds are lightweight, but may introduce incompatibilities due to their musl builds. Albeit their larger size, the Debian-based (without the "-alpine" suffix) images are more complete, and widely used.

Alpine-based: Lightweight, but may introduce incompatibilities due to their musl builds.
docker pull php:8.1.11-cli-alpine

Debian-based: More compatible with other components, complete, and are widely used.
docker pull php:8.1.11-cli
PHP CLI + Web Server Integration
These container images include PHP CLI, and a web server integration. FPM container images can be integrated with web servers such as Nginx, Caddy, and Apache with Event MPM. The Apache container images include Apache web server, integrating PHP as an Apache module.

Alpine-based: Lightweight, but may introduce incompatibilities due to their musl builds.
docker pull php:8.1.11-fpm-alpine

Debian-based ZTS Apache: Includes Apache web server integrating PHP as an Apache module.
docker pull php:8.1.11-apache

Debian-based NTS FPM: PHP-FPM, can be integrated with Nginx, Caddy, and other web servers over Fast CGI.
docker pull php:8.1.11-fpm



  • Fixed bug GH-9323 (Crash in ZEND_RETURN/GC/zend_call_function)
  • Fixed bug GH-9361 (Segmentation fault on script exit #9379).
  • Fixed bug GH-9447 (Invalid class FQN emitted by AST dump for new and class constants in constant expressions).
  • Fixed bug #81727: Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning. (CVE-2022-31629).


  • Fixed bug #79451 (DOMDocument->replaceChild on doctype causes double free).


  • Fixed bug GH-8885 (FPM access.log with stderr begins to write logs to error_log after daemon reload).
  • Fixed bug #77780 ("Headers already sent..." when previous connection was aborted).


  • Fixed bug GH-9308 (GMP throws the wrong error when a GMP object is passed to gmp_init()).


  • Fixed bug GH-9421 (Incorrect argument number for ValueError in NumberFormatter).


  • Fixed pcre.jit on Apple Silicon.


  • Fixed bug GH-9411 (PgSQL large object resource is incorrectly closed).



  • Fixed bug GH-8932 (ReflectionFunction provides no way to get the called class of a Closure).


  • Fixed bug GH-9316 ($http_response_header is wrong for long status line).

Commit List

Alex Dowad

  • Reintroduce legacy 'SJIS-win' text encoding in mbstring in 371367ce3e

Arnaud Le Blanc

  • Add tests in db1ef97209
  • Check return value of zend_jit_trace_get_exit_addr() in GH-9097

Ben Ramsey

  • Revert "Fix GH-9296: ksort behaves incorrectly on arrays with mixed keys" in 1862152145

Christoph M. Becker

David Carlier

  • opcache jit fix message format for OpenBSD in 52e312afb8
  • FPM fix strict prototype warnings in e2a5428ca0

Derick Rethans

  • Fix #81727: Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning in 6d9a4f3125

Dmitry Menshikov

  • Fix GH-8885: access.log with stderr writes logs to error_log after reload in f92505cf24

Dmitry Stogov

Gabriel Caruso

George Peter Banyard

Ilija Tovilo

  • Fix class name FQN when AST dumping new and class const in 2cfb028e22
  • Private method incorrectly marked as "overwrites" in reflection in 1435fc6262
  • Fix lsp error in eval'd code referring to incorrect class for static type in d5373eac46
  • Fix undefined left shift in oci in aa7f4497bf
  • Skip oci tests that leak under asan in 4a8cca241f
  • Fix ZEND_RC_MOD_CHECK() for thread local ini parser strings in 9af98cd465

Jakub Zelenka

Michael Voříšek

  • Fix pdo_oci tests for PHP 8.0 in 305892580e
  • Fix pdo_oci tests for PHP 8.1 in 2db2cab6ad
  • Test oci8 & pdo_oci in CI in c19116ff09
  • Fix oci8/pdo_oci random test failures when run in parallel in be4dd60c55
  • Fix GH-8348 for nightly in 34d9e089c2
  • Fix pdo_dblib ext test conflicts when run in parallel in f86629569c
  • Always skip randomly failing OCI8 extauth tests in 9a73ec0367
  • Fix oci_success_with_info.phpt test random failures in 7fd14eb08b

Máté Kocsis


  • Fix bug #79451: Using DOMDocument->replaceChild on doctype causes double free in 1d4300d870
  • Fix #79451: DOMDocument->replaceChild on doctype causes double free in 6027d441c1

Nicolas Grekas

  • Fix GH-8932: Provide a way to get the called-scope of closures in GH-9299

Niklas Keller

Patrick Allaert

  • Update versions and NEWS for PHP 8.1.11 in b357a4fe71

Sara Golemon

Tim Starling

  • Fix GCC 9.4 uninitialized variable warning in 410e5d48a3
  • Fix GH-9323: crash when the VM enters userspace code via the GC in ba029fce68


Subscribe to PHP.Watch newsletter for monthly updates

You will receive an email on last Wednesday of every month and on major PHP releases with new articles related to PHP, upcoming changes, new features and what's changing in the language. No marketing emails, no selling of your contacts, no click-tracking, and one-click instant unsubscribe from any email you receive.