Release Information
- Release Type
- Security Update
- Release Status
- Latest
- Branch Status
- Security-Fixes Only
PHP 8.3 is currently only receiving security fixes, and scheduled to reach EOL on 2027-12-31
Downloads
Source Code
Git Clone
Use Git to clone the 8.3.32 tag from the PHP Git repository.
git clone https://github.com/php/php-src.git --depth 1 --branch php-8.3.32How to compile PHP
PHP can be compiled by setting up the dependencies, building the configure script (
Detailed articles on how to compile PHP are available for Ubuntu/Debian based systems and Fedora/RHEL based systems.
./buildconf), configuring the build ./configure, and running make.Detailed articles on how to compile PHP are available for Ubuntu/Debian based systems and Fedora/RHEL based systems.
Windows binaries
Non-Thread Safe Builds
Non-Thread Safe (NTS) builds are single-threaded PHP builds. They can be used on web servers that integrate PHP over FastCGI protocol, such as Nginx, Caddy, and IIS.
php-8.3.32-x64NTS.zip
Size: 32.08 MiB SHA256:
67c724e7b675b50d8f0476d816c3e2a3064ce3a53d572575d63c321cc0a3a6cf php-8.3.32-x86NTS.zip
Size: 28.93 MiB SHA256:
f4053d542dda43b4e684be03d87f1b61bf8ccfe5a5ae9ad72ea59b4015234ea8 Thread-Safe Builds
Thread-Safe (TS) builds are multi-thread PHP builds, often used to integrate PHP as a Server API for multithreaded servers. The most common use case is using PHP as an Apache module.
php-8.3.32-x64TS.zip
Size: 32.22 MiB SHA256:
76fe1eafda6dcc8927122adb79088b22e19cfbf81c3dbed44ccb335d1bf8de29 php-8.3.32-x86TS.zip
Size: 28.91 MiB SHA256:
fc3033f013636fa6b8d274d6e68e5a1704a155d64faa91c55b484883fdc6b071 Docker/Podman Containers
PHP CLI
PHP CLI Containers images only include the PHP CLI, and no FPM or Apache modules. The Alpine builds are lightweight, but may introduce incompatibilities due to their musl builds. Albeit their larger size, the Debian-based (without the "-alpine" suffix) images are more complete, and widely used.
Alpine-based: Lightweight, but may introduce incompatibilities due to their musl builds.
docker pull php:8.3.32-cli-alpineDebian-based: More compatible with other components, complete, and are widely used.
docker pull php:8.3.32-cliPHP CLI + Web Server Integration
These container images include PHP CLI, and a web server integration. FPM container images can be integrated with web servers such as Nginx, Caddy, and Apache with Event MPM. The Apache container images include Apache web server, integrating PHP as an Apache module.
Alpine-based: Lightweight, but may introduce incompatibilities due to their musl builds.
docker pull php:8.3.32-fpm-alpineDebian-based ZTS Apache: Includes Apache web server integrating PHP as an Apache module.
docker pull php:8.3.32-apacheDebian-based NTS FPM: PHP-FPM, can be integrated with Nginx, Caddy, and other web servers over Fast CGI.
docker pull php:8.3.32-fpmChangeLog
Streams
- Fixed bug GH-21468 (Segfault in file_get_contents w/ a https URL and a proxy set). (CVE-2026-12184)
OpenSSL
- Fixed bug GH-22187 (Memory corruption (
zend_mm_heapcorrupted) in openssl_encrypt with AES-WRAP-PAD).
Commit List
David Carlier
ext/openssl:openssl_encrypt()zend mm heap overflow on AES-WRAP-PAD mode in cbc0489126
Ilija Tovilo
- GHSA-85c2-q967-79q5: [soap] Fix stale SOAP_GLOBAL(ref_map) pointer with Apache Map in aee3b3ac9b
- GHSA-m33r-qmcv-p97q: [soap] Fix use-after-free after header parsing failure with
SOAP_PERSISTENCE_SESSIONin db2a7f9348 - GHSA-hmxp-6pc4-f3vv: [soap] Fix broken Apache map value NULL check in 79551ab8b1
- GHSA-m8rr-4c36-8gq4: Consistently pass unsigned char to
ctype.hfunctions in a38418777f - GHSA-m8rr-4c36-8gq4: Consistently pass unsigned char to
ctype.hfunctions in 398b7dabfb
Jakub Zelenka
- GHSA-7qg2-v9fj-4mwv: [fpm] XSS within status endpoint in 99a5ad7441
- Update versions for PHP 8.3.32 in 3e35b37057
Jorg Sowa
- ci: add 180-minute timeout to test-suite jobs in 98b86328b6
Nora Dossche
- Fix NULL deref when enabling TLS fails and the peer name needs to be reset in 84f63e07aa
Saki Takamachi
- GHSA-w476-322c-wpvm: [pdo_firebird] Fix SQL injection via NUL bytes in quoted strings in 3f40b65323
Shivam Mathur
- Make curl brotli and zstd optional on Windows in GH-21925
- Switch to VS18 for the master branch in GH-22094
Tim Düsterhus
- GHSA-96wq-48vp-hh57: [metaphone] Fix signed integer overflow of char array offset in 47def8ce1d
vi3tL0u1s
- GHSA-wm6j-2649-pv75: [mbstring] Fix null pointer dereference in
php_mb_check_encoding()viamb_ereg_search_init()in 79a054eae0