Release Information
- Release Type
- Security Update
- Release Status
- Latest
- Branch Status
- Security-Fixes Only
PHP 8.1 is currently only receiving security fixes, and scheduled to reach EOL on 2025-12-31
Downloads
Source Code
git clone https://github.com/php/php-src.git --depth 1 --branch php-8.1.32
./buildconf
), configuring the build ./configure
, and running make
.Detailed articles on how to compile PHP are available for Ubuntu/Debian based systems and Fedora/RHEL based systems.
Windows binaries
Docker/Podman Containers
docker pull php:8.1.32-cli-alpine
docker pull php:8.1.32-cli
docker pull php:8.1.32-fpm-alpine
docker pull php:8.1.32-apache
docker pull php:8.1.32-fpm
ChangeLog
LibXML
- Fixed GHSA-wg4p-4hqh-c3g9 (Reocurrence of #72714).
- Fixed GHSA-p3x9-6h7p-cgfc (libxml streams use wrong
content-type
header when requesting a redirected resource). (CVE-2025-1219)
Streams
- Fixed GHSA-hgf5-96fm-v528 (Stream HTTP wrapper header check might omit basic auth header). (CVE-2025-1736)
- Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location to 1024 bytes). (CVE-2025-1861)
- Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers without colon). (CVE-2025-1734)
- Fixed GHSA-v8xr-gpvj-cx9g (Header parser of
http
stream wrapper does not handle folded headers). (CVE-2025-1217)
Windows
- Fixed phpize for Windows 11 (24H2).
Commit List
Ayesh Karunaratne
- CI: FreeBSD on VM - set
copyback: false
in b263f351c4
Ben Ramsey
- Update versions for PHP 8.1.32 in fe862bbf63
- Revert "Update versions for PHP 8.1.32" in e3a6c82e94
- Update versions for PHP 8.1.32 in 8aab89bc8d
- Prepare for PHP 8.1.32 in aa4bed90d8
Calvin Buckley
- Attempt at ppc64 CI in GH-17945
- Skip mysqli/tests/bug73462 on PPC CI in GH-17971
- Remove "Notify Slack" on ppc nightly workflow in GH-17993
Christoph M. Becker
- Enable GHSA-9pqp-7h25-4f32.phpt on Windows in 7685fb0e1c
- Revert "Enable GHSA-9pqp-7h25-4f32.phpt on Windows" in 2285d7083e
- Use preinstalled MySQL for Windows CI in a403b76e88
- Relax timezone_IDforWindowsID_basic2.phpt expectations in afe8e2cdff
- Fix
curl_basic_022.phpt
for libcurl 8.12.0 in 36d46a4732
Dmitry Stogov
- Backport JIT fix: set valid EX(opline) before calling
gc_possible_root()
in GH-16858
Ilija Tovilo
- Move FreeBSD build to GitHub actions with QEMU in aca88baf5f
- Drop intl on macOS + PHP 8.1 build in e675c1a467
- Backport flaky flag for phar tests in 8a9d45b86f
- Backport nightly.yml in f26250c7c7
- Skip Symfony/Wordpress in 8.1 build in 5b8c960c9f
- Fix GHA config yml error in 3e6f4702ba
- Fix mysql mysql_native_password error on CircleCI in c99fb05929
- Fix cve-2014-3538 test in d17d58a982
- Add CONFLICT all to random port test in 726cf51236
- Fix flaky DatePeriod test in 8a699372f2
- Upgrade security branches to Ubuntu 22.04 in 5fcc8d4cd1
- Suppress snmp lib memory leak, skip ASAN tests in b0858427aa
- Increase CircleCI no_output_timeout in ee7fcf2a07
Jakub Zelenka
- Make MySQLnd protocol stmt test work on 32bit in c70b97d8eb
- Change port for mysqli fake server auth message test in 51f5539914
- Increase MySQLi fake server read timeout for ASAN job in eb951b3d11
- Use empheral port for mysqli fake server tests in 39c292b1eb
- Fix GH-16955: Use empheral ports for OpenSSL server client tests in b8731767d8
- Test
stream_context_tcp_nodelay_server
on Windows in 9e1b58274e - Fix GH-17499: mysqli flaky test: ghsa-h35g-vwh6-m678-stmt-row-string in 235d1b14a3
- Fix GHSA-ghsa-v8xr-gpvj-cx9g: http header folding in d20b4c97a9
- Fix GHSA-pcmh-g36c-qc44: http headers without colon in 0548c4c175
- Fix GHSA-52jp-hrpf-2jff: http redirect location truncation in ac1a054bb3
- Fix GHSA-hgf5-96fm-v528: http user header check of crlf in 41d49abbd9
- Update NEWS with entries for security fixes in 74d548bf58
Niels Dossche
- Backport GH-16348 in 806d2e073c
- Fix tests for libxml2 2.14 in f209eb448e
- Fix GHSA-wg4p-4hqh-c3g9 in 0e715e71d9
Shivam Mathur
- ci: add workflow to trigger windows builds in f4aadb5537
Tim Düsterhus
- Fix GHSA-p3x9-6h7p-cgfc: libxml streams wrong
content-type
on redirect in b6004a043c