PHP 8.4.13: Downloads, Changelog, News

Release Information

Release
8.4.13
PHP Version
PHP 8.4
Release Date
Release Type
Bug Fix Release
Release Status
Latest
Branch Status
Supported (Latest)

Latest PHP release in the latest version.
PHP 8.4 continues to receive bug fixes and security fixes until 2026-12-31.

Downloads

Source Code

Git Clone
Use Git to clone the 8.4.13 tag from the PHP Git repository.
git clone https://github.com/php/php-src.git --depth 1 --branch php-8.4.13
How to compile PHP
PHP can be compiled by setting up the dependencies, building the configure script (./buildconf), configuring the build ./configure, and running make.
Detailed articles on how to compile PHP are available for Ubuntu/Debian based systems and Fedora/RHEL based systems.

Windows binaries
Non-Thread Safe Builds
Non-Thread Safe (NTS) builds are single-threaded PHP builds. They can be used on web servers that integrate PHP over FastCGI protocol, such as Nginx, Caddy, and IIS.
Thread-Safe Builds
Thread-Safe (TS) builds are multi-thread PHP builds, often used to integrate PHP as a Server API for multithreaded servers. The most common use case is using PHP as an Apache module.

Docker/Podman Containers

PHP CLI
PHP CLI Containers images only include the PHP CLI, and no FPM or Apache modules. The Alpine builds are lightweight, but may introduce incompatibilities due to their musl builds. Albeit their larger size, the Debian-based (without the "-alpine" suffix) images are more complete, and widely used.

Alpine-based: Lightweight, but may introduce incompatibilities due to their musl builds.
docker pull php:8.4.13-cli-alpine

Debian-based: More compatible with other components, complete, and are widely used.
docker pull php:8.4.13-cli
PHP CLI + Web Server Integration
These container images include PHP CLI, and a web server integration. FPM container images can be integrated with web servers such as Nginx, Caddy, and Apache with Event MPM. The Apache container images include Apache web server, integrating PHP as an Apache module.

Alpine-based: Lightweight, but may introduce incompatibilities due to their musl builds.
docker pull php:8.4.13-fpm-alpine

Debian-based ZTS Apache: Includes Apache web server integrating PHP as an Apache module.
docker pull php:8.4.13-apache

Debian-based NTS FPM: PHP-FPM, can be integrated with Nginx, Caddy, and other web servers over Fast CGI.
docker pull php:8.4.13-fpm

ChangeLog

Core

  • Fixed bug GH-18850 (Repeated inclusion of file with __halt_compiler() triggers "Constant already defined" warning).
  • Partially fixed bug GH-19542 (Scanning of string literals >=2GB will fail due to signed int overflow).
  • Fixed bug GH-19544 (GC treats ZEND_WEAKREF_TAG_MAP references as WeakMap references).
  • Fixed bug GH-19613 (Stale array iterator pointer).
  • Fixed bug GH-19679 (zend_ssa_range_widening may fail to converge).
  • Fixed bug GH-19681 (PHP_EXPAND_PATH broken with bash 5.3.0).
  • Fixed bug GH-19720 (Assertion failure when error handler throws when accessing a deprecated constant).

CLI

  • Fixed bug GH-19461 (Improve error message on listening error with IPv6 address).

Date

  • Fixed date_sunrise() and date_sunset() with partial-hour UTC offset.

DBA

  • Fixed bug GH-19706 (dba stream resource mismanagement).

DOM

  • Fixed bug GH-19612 (Mitigate libxml2 tree dictionary bug).

FPM

  • Fixed failed debug assertion when php_admin_value setting fails.

Intl

  • Fixed bug GH-11952 (Fix locale strings canonicalization for IntlDateFormatter and NumberFormatter).

Opcache

  • Fixed bug GH-19493 (JIT variable not stored before YIELD).

OpenSSL

  • Fixed bug GH-19245 (Success error message on TLS stream accept failure).

PGSQL

  • Fixed bug GH-19485 (potential use after free when using persistent pgsql connections).

Phar

  • Fixed memory leaks when verifying OpenSSL signature.
  • Fix memory leak in phar tar temporary file error handling code.
  • Fix metadata leak when phar convert logic fails.
  • Fix memory leak on failure in phar_convert_to_other().
  • Fixed bug GH-19752 (Phar decompression with invalid extension can cause UAF).

Standard

  • Fixed bug GH-16649 (UAF during array_splice).
  • Fixed bug GH-19577 (Avoid integer overflow when using a small offset and PHP_INT_MAX with LimitIterator).

Streams

  • Remove incorrect call to zval_ptr_dtor() in user_wrapper_metadata().
  • Fix OSS-Fuzz #385993744.

Zip

  • Fix memory leak in zip when encountering empty glob result.

Commit List

Alexandre Daubois

  • Fix GH-16649: Avoid UAF when using array_splice in c8774f9e61
  • Fix GH-19577: avoid integer overflow when using a small offset and PHP_INT_MAX with LimitIterator in GH-19585
  • Add NEWS missing entry in f0c531597c
  • Fix GH-19461: Improve error message on listening error with IPv6 in GH-19462
  • Fix NEWS entry order in 0e668e517a
  • Fix GH-11952: better locale strings canonicalization for IntlDateFormatter and NumberFormatter in GH-19593
  • Fix intl tests naming in GH-19763
  • Fix memory leak when providing an invalid locale to IntlDateFormatter in GH-19764

Arjen de Korte

Arnaud Le Blanc

  • Fit JIT variable not stored before YIELD in bc05bfe7c5
  • Differenciate WeakMaps from bare HashTables used as weak maps for GC purposes in d74901ae1a
  • Ensure that type widening converges in bd88a54934

Calvin Buckley

David Carlier

Dmitry Stogov

George Wang

Gina Peter Banyard

  • ext/phar: Fix memory leaks when verifying OpenSSL signature in GH-19563

Ilija Tovilo

  • Fix "Constant already defined" warning with repeated inclusion of file with __halt_compiler() in a3de2ce9ba
  • Fix signed int overflow in scanner in 0a12aaa5b8
  • Fix date_sunrise() and date_sunset() with partial-hour UTC offset in 0ae9a58ade
  • Fix RC assertion in fpm when php_admin_value setting fails in 15beb140e5
  • Stale array iterator pointer in f9ce6d8f3a

Jakub Zelenka

  • Fix GH-19245: Success error message on TLS stream accept failure in 2b415e416e
  • Use the default OpenSSL version for MacOS to match libs in 6194084837

Mark Karpeles

  • Fix GH-19484 i: potential use after free when using persistent pgsql connections in 987a3a5c8e

Niels Dossche

  • Sync lexbor with master on PHP 8.4 in c66af62511
  • Fix Windows build in 3690df022b
  • Fix GH-19612: Mitigate libxml2 tree dictionary bug in 080fd14458
  • Remove incorrect call to zval_ptr_dtor() in user_wrapper_metadata() in d10ff9bbd8
  • Fix memory leak in zip when encountering empty glob result in 216e87ad7e
  • Fix GH-19720: Assertion failure when error handler throws when accessing a deprecated constant in 9d69ab91ab
  • Fix GH-19706: dba stream resource mismanagement in f744c827a8
  • Fix memory leak in phar tar temporary file error handling code in 2f162214e8
  • Fix metadata leak when phar convert logic fails in c50b37d231
  • Fix memory leak on failure in phar_convert_to_other() in 98bb934685
  • Fix OSS-Fuzz #385993744 in ff84cb08ef
  • Fix GH-19752: Phar decompression with invalid extension can cause UAF in f6878b6ccf

Remi Collet

Tim Düsterhus

Subscribe to PHP.Watch newsletter for monthly updates

You will receive an email on last Wednesday of every month and on major PHP releases with new articles related to PHP, upcoming changes, new features and what's changing in the language. No marketing emails, no selling of your contacts, no click-tracking, and one-click instant unsubscribe from any email you receive.