Release Information
- Release Type
- Security Update
- Release Status
- Latest
- Branch Status
- Security-Fixes Only
PHP 8.3 is currently only receiving security fixes, and scheduled to reach EOL on 2027-12-31
Downloads
Source Code
Git Clone
Use Git to clone the 8.3.35 tag from the PHP Git repository.
git clone https://github.com/php/php-src.git --depth 1 --branch php-8.3.35How to compile PHP
PHP can be compiled by setting up the dependencies, building the configure script (
Detailed articles on how to compile PHP are available for Ubuntu/Debian based systems and Fedora/RHEL based systems.
./buildconf), configuring the build ./configure, and running make.Detailed articles on how to compile PHP are available for Ubuntu/Debian based systems and Fedora/RHEL based systems.
Windows binaries
Non-Thread Safe Builds
Non-Thread Safe (NTS) builds are single-threaded PHP builds. They can be used on web servers that integrate PHP over FastCGI protocol, such as Nginx, Caddy, and IIS.
php-8.3.35-x64NTS.zip
Size: 32.3 MiB SHA256:
25a8e2ac9ff30f1d768d1447c09a600617fa6e6082729f6e95f008b59c91fe45 php-8.3.35-x86NTS.zip
Size: 29.17 MiB SHA256:
3021dcdd0432df641537ca193b0766dac18debc27d81f4dd9dc49240d04e6f75 Thread-Safe Builds
Thread-Safe (TS) builds are multi-thread PHP builds, often used to integrate PHP as a Server API for multithreaded servers. The most common use case is using PHP as an Apache module.
php-8.3.35-x64TS.zip
Size: 32.45 MiB SHA256:
b454bed828a74536125d8a96119eae8ffbb186b305759dd6cf8d9bb4b55968b1 php-8.3.35-x86TS.zip
Size: 29.14 MiB SHA256:
b8f849ca02d271c6cc76bb814e6d3b1b4f3ee8ecce7b083bd6c963d500d7af13 ChangeLog
Filter
- Fixed GHSA-ch8v-r6jh-4vvr (
FILTER_SANITIZE_ENCODEDdoes not encode 0xFF).
FPM
- Fixed GHSA-62xp-839h-2637 (IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison). (CVE-2026-91768)
MySQLnd
- Fixed GHSA-r6x9-5r99-36j7 (Various packet overreads in mysqlnd wire protocol). (CVE-2025-1218)
OpenSSL
- Fixed GHSA-vvx9-73fr-5jjx (TLS hostname verification falls back to CN after SAN mismatch). (CVE-2026-91769)
- Fixed GHSA-xr7j-rvgx-xq5p (Heap buffer overflow in
php_openssl_matches_wildcard_name()on crafted server certificate wildcard CN). (CVE-2026-91767)
Phar
- Fixed GHSA-j3wh-g957-2m85 (Integer overflow in
phar_tar_number()allowing TAR archive entry injection). (CVE-2026-6103)
SOAP
- Fixed GHSA-rgrp-mwpx-f6rm (Unbounded recursion in server-side
cleanup_xml_node()). (CVE-2026-91765) - Fixed GHSA-cj93-vc83-wgqv (Integer overflow to buffer overflow in SOAP HTTP parsing). (CVE-2025-14181)
Standard
- Fixed GHSA-88hq-2827-7pg6 (Out-of-bounds read in convert.* stream filters when line-break-chars contains NUL). (CVE-2026-92842)
- Fixed GHSA-fpwc-w8rq-cr92 (Cross-origin credential leak in HTTP stream wrapper redirects). (CVE-2026-91766)
- Fixed GHSA-7875-c8px-7q5f (Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header). (CVE-2026-93682)
Windows
- Fixed GHSA-9f67-6fw4-hpfp (Reserved device names are not rejected before file and stream I/O). (CVE-2026-17545)
Commit List
Jakub Zelenka
- Update versions for PHP 8.3.35 in 2d3433d24d