PHP 8.3.18: Downloads, Changelog, News

Release Information

Release: 8.3.18
PHP Version: PHP 8.3
Release Date: 2025 Mar 11
Release Type: Security Update
Release Status: Use PHP 8.3.19 instead
Branch Status: Supported

PHP 8.3.18 is an old release of PHP 8.3 series. Using the latest version PHP 8.3.19 is highly recommended.
PHP 8.3 continues to receive bug fixes and security fixes until 2025-12-31.

PHP can be compiled by setting up the dependencies, building the configure script (./buildconf), configuring the build ./configure, and running make.
Detailed articles on how to compile PHP are available for Ubuntu/Debian based systems and Fedora/RHEL based systems.

Windows binaries

Non-Thread Safe Builds

Non-Thread Safe (NTS) builds are single-threaded PHP builds. They can be used on web servers that integrate PHP over FastCGI protocol, such as Nginx, Caddy, and IIS.

php-8.3.18-x64NTS.zip (30.7 MiB)

php-8.3.18-x86NTS.zip (27.57 MiB)

Thread-Safe Builds

Thread-Safe (TS) builds are multi-thread PHP builds, often used to integrate PHP as a Server API for multithreaded servers. The most common use case is using PHP as an Apache module.

php-8.3.18-x64TS.zip (30.84 MiB)

php-8.3.18-x86TS.zip (27.55 MiB)

Docker/Podman Containers

PHP CLI

PHP CLI Containers images only include the PHP CLI, and no FPM or Apache modules. The Alpine builds are lightweight, but may introduce incompatibilities due to their musl builds. Albeit their larger size, the Debian-based (without the "-alpine" suffix) images are more complete, and widely used.

Alpine-based: Lightweight, but may introduce incompatibilities due to their musl builds.

docker pull php:8.3.18-cli-alpine

Debian-based: More compatible with other components, complete, and are widely used.

docker pull php:8.3.18-cli

PHP CLI + Web Server Integration

These container images include PHP CLI, and a web server integration. FPM container images can be integrated with web servers such as Nginx, Caddy, and Apache with Event MPM. The Apache container images include Apache web server, integrating PHP as an Apache module.

Alpine-based: Lightweight, but may introduce incompatibilities due to their musl builds.

docker pull php:8.3.18-fpm-alpine

Debian-based ZTS Apache: Includes Apache web server integrating PHP as an Apache module.

docker pull php:8.3.18-apache

Debian-based NTS FPM: PHP-FPM, can be integrated with Nginx, Caddy, and other web servers over Fast CGI.

docker pull php:8.3.18-fpm

Commit List

Christoph M. Becker

Relax timezone_IDforWindowsID_basic2.phpt expectations in afe8e2cdff
Fix GH-17503: Undefined float conversion in mb_convert_variables in 55e676e181
Fix curl_basic_022.phpt for libcurl 8.12.0 in 36d46a4732
Prevent using system DLLs when running the tests in c7bc14dd6b
Adapt tests to Windows 11 in 765cebf73a
Fix GH-17837: ::getColumnMeta() on unexecuted statement segfaults in 260e0e9bd3
Fix GH-17855: CURL_STATICLIB flag set even if linked with shared lib in 200f16fcf7
Fix GH-17879: readfile_variation8-win32.phpt test conflict in 769f292a7a

Daniel Scherzer

Reflection: show the type of object constants used as default properties in ca0414e64d

David Carlier

Fix GH-17772: imagepalettetotruecolor segfault on invalid truecolor pixel in 4d7d01d18e
Fix GH-17797: zend_test_compile_string crash on invalid script path in 0f63bee3e9
Fix GH-17899: zend_test_compile_string crash on invalid script path in cefdf00e7e

David Zhong

Fix FFI Parsing of Pointer Declaration Lists in GH-17794

Eric Mann

Fix NEWS versions for posterity in c5e50bd327
Update versions for PHP 8.3.18 in 58c65197a2

Ilija Tovilo

Fix stack overflow detection for variable compilation in 333f5dd848
Add CONFLICT all to random port test in 726cf51236
Use-after-free for ??= due to incorrect live-range calculation in 17cf7cae64

Jakub Zelenka

Fix GH-17643: FPM with httpd ProxyPass encoded PATH_INFO env in e48ceb0026
Fix bug #72666: stat cache not cleared for plain paths in 930624899b
Fix GHSA-ghsa-v8xr-gpvj-cx9g: http header folding in bf30a4454d
Fix GHSA-pcmh-g36c-qc44: http headers without colon in 455161cdae
Fix GHSA-52jp-hrpf-2jff: http redirect location truncation in ae14a0b9fe
Fix GHSA-hgf5-96fm-v528: http user header check of crlf in fac131fa95
Update NEWS with entries for security fixes in d45d9a827f

Michael Orlitzky

ext/gd/tests: backport optional PNG support in 065b4ec125
Fix GH-17891 gh17373.phpt test issue without freetype support in 174a7fe6f9

ndossche

Partially fix GH-17387 in 5447473785
Fix memory leak in phpdbg calling registered function in 62bbfdebaa
Fix memory leak when encoding check fails in a54af45a41

Niels Dossche

Fix GH-17654: Multiple classes using same trait causes function JIT crash in f88445bdf8
Fix GH-17577: JIT packed type guard crash in 0c3cf1f311
Fix fallback paths in fastlong{add,sub}_function in 7e06a81bbd
Fix GH-17704: ldap_search fails when $attributes contains a non-packed array with numerical keys in 2fb88b2d80
Fix GH-17650: realloc with size 0 in user_filters.c in fd5d6ad5bd
Add .gitignore section for additional test build files in 6ea1c7cb5b
Fix GH-17745: zlib extension incorrectly handles object arguments in 4b5c29ef50
Fix memory leak on overflow in _php_stream_scandir() in 678ecff980
Fix zlib support for large files in 5aaf7b4937
Fix GH-17808: PharFileInfo refcount bug in e735d2bc3b
NEWS for GH-17794 in 86f5a31e5b
Fix GH-17847: xinclude destroys live node in 9becccef17
Fix cycle leak in sqlite3 setAuthorizer() in 353f21487f
Backport GH-17869 to PHP 8.3 JIT in 3b4a58da44
Fix GHSA-wg4p-4hqh-c3g9 in ebf5902292

Remi Collet

relax test for zlib-ng in ed1d51fa4f

Saki Takamachi

Fixed GH-17398: bcmul memory leak in GH-17615

Shivam Mathur

ci: add workflow to trigger windows builds in f4aadb5537

Tim Düsterhus

zend_execute: Suppress values in UnhandledMatchError for zend.exception_ignore_args=1 in GH-17619
Disallow calls to abstract __call() / __callStatic() in GH-17719
Free the trampoline when deprecation on materializing __callStatic() of trait throws in GH-17729
Fix GHSA-p3x9-6h7p-cgfc: libxml streams wrong content-type on redirect in 054ea51d1d