Release Information
- Release Type
- Security Update
- Release Status
- Latest
- Branch Status
- Security-Fixes Only
PHP 8.2 is currently only receiving security fixes, and scheduled to reach EOL on 2026-12-31
Downloads
Source Code
Git Clone
Use Git to clone the 8.2.34 tag from the PHP Git repository.
git clone https://github.com/php/php-src.git --depth 1 --branch php-8.2.34How to compile PHP
PHP can be compiled by setting up the dependencies, building the configure script (
Detailed articles on how to compile PHP are available for Ubuntu/Debian based systems and Fedora/RHEL based systems.
./buildconf), configuring the build ./configure, and running make.Detailed articles on how to compile PHP are available for Ubuntu/Debian based systems and Fedora/RHEL based systems.
Windows binaries
Non-Thread Safe Builds
Non-Thread Safe (NTS) builds are single-threaded PHP builds. They can be used on web servers that integrate PHP over FastCGI protocol, such as Nginx, Caddy, and IIS.
php-8.2.34-x64NTS.zip
Size: 31.92 MiB SHA256:
03249b5c9414c6dbe30276f4a7598bd9d2a7417ee81f709b06b99e9c4a2aff4f php-8.2.34-x86NTS.zip
Size: 28.8 MiB SHA256:
b957d4105c6baec1cb75653465f84b894dedc001531695dde8aacfed5d4fefc1 Thread-Safe Builds
Thread-Safe (TS) builds are multi-thread PHP builds, often used to integrate PHP as a Server API for multithreaded servers. The most common use case is using PHP as an Apache module.
php-8.2.34-x64TS.zip
Size: 32.03 MiB SHA256:
6df2a5f59f10f08022bede47a26d61c3c16756c54d86aad58503dc8a9d3c25ad php-8.2.34-x86TS.zip
Size: 28.78 MiB SHA256:
e37e7daf7ffe68df06bfccecf2950a6afc1a827e2b74cfaaa36ebe1574344cbd Docker/Podman Containers
PHP CLI
PHP CLI Containers images only include the PHP CLI, and no FPM or Apache modules. The Alpine builds are lightweight, but may introduce incompatibilities due to their musl builds. Albeit their larger size, the Debian-based (without the "-alpine" suffix) images are more complete, and widely used.
Alpine-based: Lightweight, but may introduce incompatibilities due to their musl builds.
docker pull php:8.2.34-cli-alpineDebian-based: More compatible with other components, complete, and are widely used.
docker pull php:8.2.34-cliPHP CLI + Web Server Integration
These container images include PHP CLI, and a web server integration. FPM container images can be integrated with web servers such as Nginx, Caddy, and Apache with Event MPM. The Apache container images include Apache web server, integrating PHP as an Apache module.
Alpine-based: Lightweight, but may introduce incompatibilities due to their musl builds.
docker pull php:8.2.34-fpm-alpineDebian-based ZTS Apache: Includes Apache web server integrating PHP as an Apache module.
docker pull php:8.2.34-apacheDebian-based NTS FPM: PHP-FPM, can be integrated with Nginx, Caddy, and other web servers over Fast CGI.
docker pull php:8.2.34-fpmChangeLog
Filter
- Fixed GHSA-ch8v-r6jh-4vvr (
FILTER_SANITIZE_ENCODEDdoes not encode 0xFF).
FPM
- Fixed GHSA-62xp-839h-2637 (IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison). (CVE-2026-91768)
MySQLnd
- Fixed GHSA-r6x9-5r99-36j7 (Various packet overreads in mysqlnd wire protocol). (CVE-2025-1218)
OpenSSL
- Fixed GHSA-vvx9-73fr-5jjx (TLS hostname verification falls back to CN after SAN mismatch). (CVE-2026-91769)
- Fixed GHSA-xr7j-rvgx-xq5p (Heap buffer overflow in
php_openssl_matches_wildcard_name()on crafted server certificate wildcard CN). (CVE-2026-91767)
Phar
- Fixed GHSA-j3wh-g957-2m85 (Integer overflow in
phar_tar_number()allowing TAR archive entry injection). (CVE-2026-6103)
SOAP
- Fixed GHSA-rgrp-mwpx-f6rm (Unbounded recursion in server-side
cleanup_xml_node()). (CVE-2026-91765) - Fixed GHSA-cj93-vc83-wgqv (Integer overflow to buffer overflow in SOAP HTTP parsing). (CVE-2025-14181)
Standard
- Fixed GHSA-88hq-2827-7pg6 (Out-of-bounds read in convert.* stream filters when line-break-chars contains NUL). (CVE-2026-92842)
- Fixed GHSA-fpwc-w8rq-cr92 (Cross-origin credential leak in HTTP stream wrapper redirects). (CVE-2026-91766)
- Fixed GHSA-7875-c8px-7q5f (Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header). (CVE-2026-93682)
Windows
- Fixed GHSA-9f67-6fw4-hpfp (Reserved device names are not rejected before file and stream I/O). (CVE-2026-17545)
Commit List
Alexandre Daubois
- Fix GHSA-62xp-839h-2637: FastCGI allowed_clients compared only 96 bits of IPv6 addresses in dcdfcf86fc
- Fix GHSA-fpwc-w8rq-cr92: strip credentials from user headers on cross-origin redirects in 5af9465ca8
- Fix GHSA-rgrp-mwpx-f6rm: unbounded recursion in
ext/soapXML parsing and decoding in 3655b79c7b
geeknik
- Fix heap-buffer-overflow in convert stream filters with NUL in line-break-chars in b4e3397ec8
Ilia Alshanetsky
- Fix GHSA-ch8v-r6jh-4vvr: encode 0xFF in
FILTER_SANITIZE_ENCODEDin 7ac9700d0d - [http] Fix out-of-bounds read on empty Location header in 547566f17a
Ilija Tovilo
- Fix enabling of opcache in community job for PHP <8.5 in 4fa25b04e7
Jakub Zelenka
- Fix GHSA-vvx9-73fr-5jjx: do not fall back to CN if the cert has a service ID in 0bb308eb4c
- Fix GHSA-xr7j-rvgx-xq5p: OOB read in
php_openssl_matches_wildcard_name()in 78cc82b37a - Fix GHSA-r6x9-5r99-36j7: Various packet overreads in mysqlnd wireprotocol in 114dbb7436
- Fix GHSA-j3wh-g957-2m85: phar tar entry injection in 0994e2e887
- Add NEWS entries in a14181c944
ext/soap: make GHSA-cj93-vc83-wgqv test lean and reliable in 3aedde06bc
Jordi Kroon
ext/standard: Fix 1-char relative Location redirects after GH-23467 in 64664758cd
NickSdot
- CI: Select Windows test workers automatically in GH-22946
- perf: speed up benchmark checkout in GH-23211
Nora Dossche
- Fix GHSA-cj93-vc83-wgqv in b11bd1d939
Pierrick Charron
- Update versions for PHP 8.2.34 in 0be211a0cf
Shivam Mathur
- Fix hMailServer URL in Windows CI in GH-23055
- Upgrade php-sdk to 2.8.2 in GH-23193
- Fix GHSA-9f67-6fw4-hpfp in f785c3f6ce