Release Information
- Release Type
- Security Update
- Release Status
- Latest
- Branch Status
- Security-Fixes Only
PHP 8.3 is currently only receiving security fixes, and scheduled to reach EOL on 2027-12-31
Downloads
Source Code
Git Clone
Use Git to clone the 8.3.35 tag from the PHP Git repository.
git clone https://github.com/php/php-src.git --depth 1 --branch php-8.3.35How to compile PHP
PHP can be compiled by setting up the dependencies, building the configure script (
Detailed articles on how to compile PHP are available for Ubuntu/Debian based systems and Fedora/RHEL based systems.
./buildconf), configuring the build ./configure, and running make.Detailed articles on how to compile PHP are available for Ubuntu/Debian based systems and Fedora/RHEL based systems.
Windows binaries
Non-Thread Safe Builds
Non-Thread Safe (NTS) builds are single-threaded PHP builds. They can be used on web servers that integrate PHP over FastCGI protocol, such as Nginx, Caddy, and IIS.
php-8.3.35-x64NTS.zip
Size: 32.3 MiB SHA256:
25a8e2ac9ff30f1d768d1447c09a600617fa6e6082729f6e95f008b59c91fe45 php-8.3.35-x86NTS.zip
Size: 29.17 MiB SHA256:
3021dcdd0432df641537ca193b0766dac18debc27d81f4dd9dc49240d04e6f75 Thread-Safe Builds
Thread-Safe (TS) builds are multi-thread PHP builds, often used to integrate PHP as a Server API for multithreaded servers. The most common use case is using PHP as an Apache module.
php-8.3.35-x64TS.zip
Size: 32.45 MiB SHA256:
b454bed828a74536125d8a96119eae8ffbb186b305759dd6cf8d9bb4b55968b1 php-8.3.35-x86TS.zip
Size: 29.14 MiB SHA256:
b8f849ca02d271c6cc76bb814e6d3b1b4f3ee8ecce7b083bd6c963d500d7af13 Docker/Podman Containers
PHP CLI
PHP CLI Containers images only include the PHP CLI, and no FPM or Apache modules. The Alpine builds are lightweight, but may introduce incompatibilities due to their musl builds. Albeit their larger size, the Debian-based (without the "-alpine" suffix) images are more complete, and widely used.
Alpine-based: Lightweight, but may introduce incompatibilities due to their musl builds.
docker pull php:8.3.35-cli-alpineDebian-based: More compatible with other components, complete, and are widely used.
docker pull php:8.3.35-cliPHP CLI + Web Server Integration
These container images include PHP CLI, and a web server integration. FPM container images can be integrated with web servers such as Nginx, Caddy, and Apache with Event MPM. The Apache container images include Apache web server, integrating PHP as an Apache module.
Alpine-based: Lightweight, but may introduce incompatibilities due to their musl builds.
docker pull php:8.3.35-fpm-alpineDebian-based ZTS Apache: Includes Apache web server integrating PHP as an Apache module.
docker pull php:8.3.35-apacheDebian-based NTS FPM: PHP-FPM, can be integrated with Nginx, Caddy, and other web servers over Fast CGI.
docker pull php:8.3.35-fpmChangeLog
Filter
- Fixed GHSA-ch8v-r6jh-4vvr (
FILTER_SANITIZE_ENCODEDdoes not encode 0xFF).
FPM
- Fixed GHSA-62xp-839h-2637 (IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison). (CVE-2026-91768)
MySQLnd
- Fixed GHSA-r6x9-5r99-36j7 (Various packet overreads in mysqlnd wire protocol). (CVE-2025-1218)
OpenSSL
- Fixed GHSA-vvx9-73fr-5jjx (TLS hostname verification falls back to CN after SAN mismatch). (CVE-2026-91769)
- Fixed GHSA-xr7j-rvgx-xq5p (Heap buffer overflow in
php_openssl_matches_wildcard_name()on crafted server certificate wildcard CN). (CVE-2026-91767)
Phar
- Fixed GHSA-j3wh-g957-2m85 (Integer overflow in
phar_tar_number()allowing TAR archive entry injection). (CVE-2026-6103)
SOAP
- Fixed GHSA-rgrp-mwpx-f6rm (Unbounded recursion in server-side
cleanup_xml_node()). (CVE-2026-91765) - Fixed GHSA-cj93-vc83-wgqv (Integer overflow to buffer overflow in SOAP HTTP parsing). (CVE-2025-14181)
Standard
- Fixed GHSA-88hq-2827-7pg6 (Out-of-bounds read in convert.* stream filters when line-break-chars contains NUL). (CVE-2026-92842)
- Fixed GHSA-fpwc-w8rq-cr92 (Cross-origin credential leak in HTTP stream wrapper redirects). (CVE-2026-91766)
- Fixed GHSA-7875-c8px-7q5f (Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header). (CVE-2026-93682)
Windows
- Fixed GHSA-9f67-6fw4-hpfp (Reserved device names are not rejected before file and stream I/O). (CVE-2026-17545)
Commit List
Jakub Zelenka
- Update versions for PHP 8.3.35 in 2d3433d24d