PHP 8.4.18: Downloads, Changelog, News

Release Information

Release: 8.4.18
PHP Version: PHP 8.4
Release Date: 2026 Feb 12
Release Type: Bug Fix Release
Release Status: Latest Release in 8.4
Branch Status: Supported

Latest release for PHP 8.4.
PHP 8.4 continues to receive bug fixes and security fixes until 2026-12-31.

PHP can be compiled by setting up the dependencies, building the configure script (./buildconf), configuring the build ./configure, and running make.
Detailed articles on how to compile PHP are available for Ubuntu/Debian based systems and Fedora/RHEL based systems.

Windows binaries

Non-Thread Safe Builds

Non-Thread Safe (NTS) builds are single-threaded PHP builds. They can be used on web servers that integrate PHP over FastCGI protocol, such as Nginx, Caddy, and IIS.

php-8.4.18-x64NTS.zip

Size: 32.31 MiB SHA256: 69fb3e5e393edd6833a802f48732869e3959ca93495cefe4c886fe52d2a776a8

php-8.4.18-x86NTS.zip

Size: 28.97 MiB SHA256: c716ec54d6695b17e4708dce8405d65eef75fded0b927766168d72f8dc3ca840

Thread-Safe Builds

Thread-Safe (TS) builds are multi-thread PHP builds, often used to integrate PHP as a Server API for multithreaded servers. The most common use case is using PHP as an Apache module.

php-8.4.18-x64TS.zip

Size: 32.46 MiB SHA256: b4e3fb1be6328cc96f98c8ce45bf74191dd9d073871aac775fee389ec17117c9

php-8.4.18-x86TS.zip

Size: 29.04 MiB SHA256: 634f7b903297efb7de852745abc903b9396a4b8a80d76a72d01eb5f815be8ef2

ChangeLog

Core

Fixed bug GH-20837 (NULL dereference when calling ob_start() in shutdown function triggered by bailout in php_output_lock_error()).
Fix OSS-Fuzz #471533782 (Infinite loop in GC destructor fiber).
Fix OSS-Fuzz #472563272 (Borked block_pass JMP[N]Z optimization).
Fixed bug GH-GH-20914 (Internal enums can be cloned and compared).
Fix OSS-Fuzz #474613951 (Leaked parent property default value).
Fixed bug GH-20766 (Use-after-free in FE_FREE with GC interaction).
Fix OSS-Fuzz #471486164 (Broken by-ref assignment to uninitialized hooked backing value).
Fix OSS-Fuzz #438780145 (Nested finally with repeated return type check may uaf).
Fixed bug GH-20905 (Lazy proxy bailing __clone assertion).
Fixed bug GH-20479 (Hooked object properties overflow).

Date

Update timelib to 2022.16.

DOM

Fixed GH-21041 (Dom\HTMLDocument corrupts closing tags within scripts).

MbString

Fixed bug GH-20833 (mb_str_pad() divide by zero if padding string is invalid in the encoding).
Fixed bug GH-20836 (Stack overflow in mb_convert_variables with recursive array references).

Opcache

Fixed bug GH-20818 (Segfault in Tracing JIT with object reference).

OpenSSL

Fix memory leaks when sk_X509_new_null() fails.
Fix crash when in openssl_x509_parse() when i2s_ASN1_INTEGER() fails.
Fix crash in openssl_x509_parse() when X509_NAME_oneline() fails.

Phar

Fixed bug GH-20882 (buildFromIterator breaks with missing base directory).

PGSQL

Fixed INSERT/UPDATE queries building with PQescapeIdentifier() and possible UB.

Readline

Fixed bug GH-18139 (Memory leak when overriding some settings via readline_info()).

SPL

Fixed bug GH-20856 (heap-use-after-free in SplDoublyLinkedList iterator when modifying during iteration).

Standard

Fixed bug #74357 (lchown fails to change ownership of symlink with ZTS)
Fixed bug GH-20843 (var_dump() crash with nested objects)

Commit List

Alexander Borisov

Fix GH-21041: Dom\HTMLDocument corrupts closing tags within scripts in 56e5a80c44

Alexandre Daubois

Fix GH-20836: Stack overflow in mb_convert_variables with recursive array references in GH-20839

Arnaud Le Blanc

Set default_object_handlers when registering internal enums in 075b6b85f6
NEWS in b273fc7aca

Ben Ramsey

PHP 8.1 is now end-of-life in 6f82565f12

Bob Weinand

Split the live-ranges of loop variables again in GH-20865

Calvin Buckley

Fix skipif for mkfifo usage in gh20582.phpt in GH-20804

Chris Hasiński

Fix segfault in Tracing JIT with object reference (GH-20818) in 1db1c7f5c1

Daniel Scherzer

GitHub actions: drop more 8.1 CI configuration in GH-20763

David Carlier

Fix GH-20802: undefined behavior with invalid SNI_server_certs options in cdcc0c2cd8
Fix GH-20840: crash on nested object with var_dump() in 5d2456f974
exp/pgsql: insert/update query string build possible UB fix in 5785ff7728

Derick Rethans

Updated to version 2025.3 (2025c) in 2670c8646d
Empty merge in c42eedc088
Updated to version 2025.3 (2025c) in 65e316e89c
Upgrade timelib to 2022.16 in e208cd86b4
Revert "Upgrade timelib to 2022.16" in cfbfc1b6f6
Revert "Updated to version 2025.3 (2025c)" in ba1f3d9a87
Update generated parser file in c929f2aa87

Dmitry Stogov

Update IR in GH-20916

Frank Denis

ext/sodium: use correct constants and error messages in GH-20852

Ilija Tovilo

Fix infinite loop in GC destructor fiber in 6f6c9e35e8
Fix block_pass JMP[N]Z optimization in f61b1fc036
Fix leaked parent property default value in 4bfaf549f6
Avoid huge output in gh20840.phpt in 462fcad419
Fix by-ref assignment to uninitialized hooked backing value in 0efecbc432
Fix uaf for nested finally with repeated return type check in 19b30032c9
Fix run-tests.php -s flag in ee5fc4a030
Fix lazy proxy bailing __clone assertion in f38f74521b

Jakub Zelenka

Fix bug #74357: lchown fails to change ownership of symlink with ZTS in 91ac825278
Update NEWS with fix for bug #74357 in 1c9f117d74

Michael Orlitzky

ext/dba/tests/dba_db4_018.phpt: fix typo in GH-20938

Niels Dossche

Fix GH-18139: Memory leak when overriding some settings via readline_info() in 30ed81314b
streams/memory: Ensure internal string is NUL terminated in GH-20812
Fix GH-20833: mb_str_pad() divide by zero if padding string is invalid in the encoding in 03113b09ce
fastcgi: Fix compile warning wrt safe_read() in GH-20887
Fix GH-20882: phar buildFromIterator breaks with missing base directory in a6e0d8e359
Fix GH-20856: heap-use-after-free in SplDoublyLinkedList iterator when modifying during iteration in 2a2e0e8128
Fix bug52820 test for new libcurl release in 636f84adcf
Add test for GH-20880 in GH-20919
Fix GH-20890: Segfault in zval_undefined_cv with non-simple property hook with minimal tracing JIT in 57c62eb2b3
Revert "Fix GH-20890: Segfault in zval_undefined_cv with non-simple property hook with minimal tracing JIT" in 32c0245531
Fix hooked object properties overflow in d9cbc3117c
Fix memory leaks when sk_X509_new_null() fails in 7754eafb1f
Fix crash when in openssl_x509_parse() when i2s_ASN1_INTEGER() fails in c2eadb4922
Fix crash in openssl_x509_parse() when X509_NAME_oneline() fails in 62afc7a2fa

Peter Kokot

Use PHP 8+ square brackets for array elements in c4084bb8f3

Saki Takamachi

Update versions for PHP 8.4.18 in c8f4422ecb

Tim Düsterhus

output: Fail starting to output buffer when the output layer is deactivated in GH-20846