PHP 8.3 is currently only receiving security fixes. PHP 8.3.34 is not the latest version in the series, and using this release is not recommended. PHP 8.3.35 is the latest in the series.
Downloads
Source Code
Git Clone
Use Git to clone the 8.3.34 tag from the PHP Git repository.
git clone https://github.com/php/php-src.git --depth 1 --branch php-8.3.34How to compile PHP
PHP can be compiled by setting up the dependencies, building the configure script (
Detailed articles on how to compile PHP are available for Ubuntu/Debian based systems and Fedora/RHEL based systems.
./buildconf), configuring the build ./configure, and running make.Detailed articles on how to compile PHP are available for Ubuntu/Debian based systems and Fedora/RHEL based systems.
Docker/Podman Containers
PHP CLI
PHP CLI Containers images only include the PHP CLI, and no FPM or Apache modules. The Alpine builds are lightweight, but may introduce incompatibilities due to their musl builds. Albeit their larger size, the Debian-based (without the "-alpine" suffix) images are more complete, and widely used.
Alpine-based: Lightweight, but may introduce incompatibilities due to their musl builds.
docker pull php:8.3.34-cli-alpineDebian-based: More compatible with other components, complete, and are widely used.
docker pull php:8.3.34-cliPHP CLI + Web Server Integration
These container images include PHP CLI, and a web server integration. FPM container images can be integrated with web servers such as Nginx, Caddy, and Apache with Event MPM. The Apache container images include Apache web server, integrating PHP as an Apache module.
Alpine-based: Lightweight, but may introduce incompatibilities due to their musl builds.
docker pull php:8.3.34-fpm-alpineDebian-based ZTS Apache: Includes Apache web server integrating PHP as an Apache module.
docker pull php:8.3.34-apacheDebian-based NTS FPM: PHP-FPM, can be integrated with Nginx, Caddy, and other web servers over Fast CGI.
docker pull php:8.3.34-fpmCommit List
Alexandre Daubois
- Fix GHSA-62xp-839h-2637: FastCGI allowed_clients compared only 96 bits of IPv6 addresses in dcdfcf86fc
- Fix GHSA-fpwc-w8rq-cr92: strip credentials from user headers on cross-origin redirects in 5af9465ca8
- Fix GHSA-rgrp-mwpx-f6rm: unbounded recursion in
ext/soapXML parsing and decoding in 3655b79c7b
geeknik
- Fix heap-buffer-overflow in convert stream filters with NUL in line-break-chars in b4e3397ec8
Ilia Alshanetsky
- Fix GHSA-ch8v-r6jh-4vvr: encode 0xFF in
FILTER_SANITIZE_ENCODEDin 7ac9700d0d - [http] Fix out-of-bounds read on empty Location header in 547566f17a
Ilija Tovilo
- libgd patch for CVE-2026-9672 in fcd691b377
- Fix SQL injection in ext-pgsql via E'...' backslash breakout in ab048bd83b
- Add NEWS entries in f93c48725d
- Fix enabling of opcache in community job for PHP <8.5 in 4fa25b04e7
Jakub Zelenka
- Fix GHSA-vc5h-9ppw-p5f3: phar circular symlink crash in 2e0fa0a444
- Fix GHSA-vvx9-73fr-5jjx: do not fall back to CN if the cert has a service ID in 0bb308eb4c
- Fix GHSA-xr7j-rvgx-xq5p: OOB read in
php_openssl_matches_wildcard_name()in 78cc82b37a - Fix GHSA-r6x9-5r99-36j7: Various packet overreads in mysqlnd wireprotocol in 114dbb7436
- Fix GHSA-j3wh-g957-2m85: phar tar entry injection in 0994e2e887
- Add NEWS entries in a14181c944
ext/soap: make GHSA-cj93-vc83-wgqv test lean and reliable in 3aedde06bc
Jordi Kroon
ext/standard: Fix 1-char relative Location redirects after GH-23467 in 64664758cd
NickSdot
- CI: Select Windows test workers automatically in GH-22946
- perf: speed up benchmark checkout in GH-23211
Nora Dossche
- Fix GHSA-cj93-vc83-wgqv in b11bd1d939
Shivam Mathur
- Fix hMailServer URL in Windows CI in GH-23055
- Upgrade php-sdk to 2.8.2 in GH-23193
- Fix GHSA-9f67-6fw4-hpfp in f785c3f6ce