PHP 8.3.19: Downloads, Changelog, News

Release Information

Release: 8.3.19
PHP Version: PHP 8.3
Release Date: 2025 Mar 13
Release Type: Security Update
Release Status: Use PHP 8.3.23 instead
Branch Status: Supported

PHP 8.3.19 is an old release of PHP 8.3 series. Using the latest version PHP 8.3.23 is highly recommended.
PHP 8.3 continues to receive bug fixes and security fixes until 2025-12-31.

PHP can be compiled by setting up the dependencies, building the configure script (./buildconf), configuring the build ./configure, and running make.
Detailed articles on how to compile PHP are available for Ubuntu/Debian based systems and Fedora/RHEL based systems.

Windows binaries

Non-Thread Safe Builds

Non-Thread Safe (NTS) builds are single-threaded PHP builds. They can be used on web servers that integrate PHP over FastCGI protocol, such as Nginx, Caddy, and IIS.

php-8.3.19-x64NTS.zip (30.7 MiB)

php-8.3.19-x86NTS.zip (27.57 MiB)

Thread-Safe Builds

Thread-Safe (TS) builds are multi-thread PHP builds, often used to integrate PHP as a Server API for multithreaded servers. The most common use case is using PHP as an Apache module.

php-8.3.19-x64TS.zip (30.84 MiB)

php-8.3.19-x86TS.zip (27.55 MiB)

Docker/Podman Containers

PHP CLI

PHP CLI Containers images only include the PHP CLI, and no FPM or Apache modules. The Alpine builds are lightweight, but may introduce incompatibilities due to their musl builds. Albeit their larger size, the Debian-based (without the "-alpine" suffix) images are more complete, and widely used.

Alpine-based: Lightweight, but may introduce incompatibilities due to their musl builds.

docker pull php:8.3.19-cli-alpine

Debian-based: More compatible with other components, complete, and are widely used.

docker pull php:8.3.19-cli

PHP CLI + Web Server Integration

These container images include PHP CLI, and a web server integration. FPM container images can be integrated with web servers such as Nginx, Caddy, and Apache with Event MPM. The Apache container images include Apache web server, integrating PHP as an Apache module.

Alpine-based: Lightweight, but may introduce incompatibilities due to their musl builds.

docker pull php:8.3.19-fpm-alpine

Debian-based ZTS Apache: Includes Apache web server integrating PHP as an Apache module.

docker pull php:8.3.19-apache

Debian-based NTS FPM: PHP-FPM, can be integrated with Nginx, Caddy, and other web servers over Fast CGI.

docker pull php:8.3.19-fpm

ChangeLog

BCMath

Fixed bug GH-17398 (bcmul memory leak).

Core

Fixed bug GH-17623 (Broken stack overflow detection for variable compilation).
Fixed bug GH-17618 (UnhandledMatchError does not take zend.exception_ignore_args=1 into account).
Fix fallback paths in fastlong{add,sub}_function.
Fixed bug GH-17718 (Calling static methods on an interface that has __callStatic is allowed).
Fixed bug GH-17797 (zend_test_compile_string crash on invalid script path).
Fixed GHSA-rwp7-7vc6-8477 (Reference counting in php_request_shutdown causes Use-After-Free). (CVE-2024-11235)

DOM

Fixed bug GH-17847 (xinclude destroys live node).

FFI

Fix FFI Parsing of Pointer Declaration Lists.

FPM

Fixed bug GH-17643 (FPM with httpd ProxyPass encoded PATH_INFO env).

GD

Fixed bug GH-17772 (imagepalettetotruecolor crash with memory_limit=2M).

LDAP

Fixed bug GH-17704 (ldap_search fails when $attributes contains a non-packed array with numerical keys).

LibXML

Fixed GHSA-wg4p-4hqh-c3g9 (Reocurrence of #72714).
Fixed GHSA-p3x9-6h7p-cgfc (libxml streams use wrong content-type header when requesting a redirected resource). (CVE-2025-1219)

MBString

Fixed bug GH-17503 (Undefined float conversion in mb_convert_variables).

Opcache

Fixed bug GH-17654 (Multiple classes using same trait causes function JIT crash).
Fixed bug GH-17577 (JIT packed type guard crash).
Fixed bug GH-17899 (zend_test_compile_string with invalid path when opcache is enabled).
Fixed bug GH-17868 (Cannot allocate memory with tracing JIT).

PDO_SQLite

Fixed GH-17837 ()::getColumnMeta() on unexecuted statement segfaults).
Fix cycle leak in sqlite3 setAuthorizer().

Phar

Fixed bug GH-17808: PharFileInfo refcount bug.

PHPDBG

Partially fixed bug GH-17387 (Trivial crash in phpdbg lexer).
Fix memory leak in phpdbg calling registered function.

Reflection

Fixed bug GH-15902 (Core dumped in ext/reflection/php_reflection.c).

Sockets

Fixed bug GH-17921 (socket_read/socket_recv overflow on buffer size).

Standard

Fixed bug #72666 (stat cache clearing inconsistent between file:// paths and plain paths).

Streams

Fixed bug GH-17650 (realloc with size 0 in user_filters.c).
Fix memory leak on overflow in _php_stream_scandir().
Fixed GHSA-hgf5-96fm-v528 (Stream HTTP wrapper header check might omit basic auth header). (CVE-2025-1736)
Fixed GHSA-52jp-hrpf-2jff (Stream HTTP wrapper truncate redirect location to 1024 bytes). (CVE-2025-1861)
Fixed GHSA-pcmh-g36c-qc44 (Streams HTTP wrapper does not fail for headers without colon). (CVE-2025-1734)
Fixed GHSA-v8xr-gpvj-cx9g (Header parser of http stream wrapper does not handle folded headers). (CVE-2025-1217)

Windows

Fixed phpize for Windows 11 (24H2).
Fixed GH-17855 (CURL_STATICLIB flag set even if linked with shared lib).

Zlib

Fixed bug GH-17745 (zlib extension incorrectly handles object arguments).
Fix memory leak when encoding check fails.
Fix zlib support for large files.

Commit List

Eric Mann

Update versions for php 8.3.19 in f44f0d6447

Niels Dossche

Fix branch target in zend_jit_push_call_frame() in fdeadcd9ba