Release Information
- Release Type
- Security Update
- Release Status
- Latest
- Branch Status
- Supported (Latest)
Latest PHP release in the latest version. This release contains security fixes, and it is recommended to update as soon as possible.
PHP 8.4 continues to receive bug fixes and security fixes until 2026-12-31.
Downloads
Source Code
git clone https://github.com/php/php-src.git --depth 1 --branch php-8.4.2
./buildconf
), configuring the build ./configure
, and running make
.Detailed articles on how to compile PHP are available for Ubuntu/Debian based systems and Fedora/RHEL based systems.
Windows binaries
Docker/Podman Containers
docker pull php:8.4.2-cli-alpine
docker pull php:8.4.2-cli
docker pull php:8.4.2-fpm-alpine
docker pull php:8.4.2-apache
docker pull php:8.4.2-fpm
ChangeLog
BcMath
- Fixed bug GH-16978 (Avoid unnecessary padding with leading zeros).
COM
- Fixed bug GH-16991 (Getting typeinfo of non DISPATCH variant segfaults).
Core
- Fixed bug GH-16344 (setRawValueWithoutLazyInitialization() and skipLazyInitialization() may change initialized proxy).
- Fix
is_zend_ptr()
huge block comparison. - Fixed potential OOB read in
zend_dirname()
on Windows. - Fixed bug GH-15964 (
printf()
can strip sign of -INF).
Curl
- Fix various memory leaks in curl mime handling.
DBA
- Fixed bug GH-16990 (
dba_list()
is now zero-indexed instead of using resource ids)
DOM
- Fixed bug GH-16906 (Reloading document can cause UAF in iterator).
FPM
- Fixed bug GH-16932 (wrong FPM status output).
GMP
- Fixed bug GH-16890 (
array_sum()
with GMP can loose precision (LLP64)).
Opcache
- Fixed bug GH-16851 (JIT_G(enabled) not set correctly on other threads).
- Fixed bug GH-16902 (Set of opcache tests fail zts+aarch64).
- Fixed bug GH-16879 (JIT dead code skipping does not update call_level).
SAPI
- Fixed bug GH-16998 (UBSAN warning in rfc1867).
PHPDBG
- Fixed bug GH-15208 (Segfault with breakpoint map and
phpdbg_clear()
).
Standard
- Fixed bug GH-16905 (Internal iterator functions can't handle UNDEF properties).
- Fixed bug GH-16957 (Assertion failure in
array_shift
with self-referencing array).
Streams
- Fixed network connect poll interuption handling.
Windows
- Fixed bug GH-16849 (Error dialog causes process to hang).
- Windows Server 2025 is now properly reported.
Commit List
Arnaud Le Blanc
- Fix setRawValueWithoutLazyInitialization() and skipLazyInitialization() on initialized proxy in c310be09ed
Ayesh Karunaratne
- CI: FreeBSD on VM - set
copyback: false
in b263f351c4
Calvin Buckley
- Update versions for PHP 8.4.2 in 5d2520648a
Christoph M. Becker
- Skip
file_put_contents_variation7.phpt
on Windows in 3656a84c39 - Revert "Merge branch 'PHP-8.3' into PHP-8.4" in 83ca37483c
- Reapply "Merge branch 'PHP-8.3' into PHP-8.4" in da81b5c8d2
- Fix GH-16890:
array_sum()
with GMP can loose precision (LLP64) in cfcf5cfde8 - Fix potential conflict of
copy_variation5-win32.phpt
in 12ef3da381 - Use another for
bug51056.phpt
in 0b5de3014a - Fix GH-16849: Error dialog causes process to hang in e75061b512
- Fix GH-16991: Getting typeinfo of non DISPATCH variant segfaults in 9bae8933a3
- Fix potential OOB read in
zend_dirname()
on Windows in 94fa2a4ce1
David Carlier
- Revert "
ext/gmp
: gmp_pow fix FPE with large values." in 45140e527f - Revert "
ext/gmp
: gmp_pow fix FPE with large values." in 7e8d6f941c - Fix GH-16959: snmpget modifies the
object_id
(as array) in 73ebc92617
David Warner
- Add Windows Server 2025 build number in f086eaa7b8
Derick Rethans
- Fixed CS in d1b9d7ee83
divinity76
- Fix GH-15964:
printf()
can strip sign of -INF in c2d3734e89
Dmitry Stogov
- Update IR in ba8e3e1d79
- Fix GH-16913: 8.4 function JIT memory corruption in GH-16943
- Avoid possible spill conflict (one of the problem that caused GH-16821) in GH-16947
- Fix GH-16821: runtime error: member access within misaligned address when running phpseclib tests in GH-16951
- Update IR in 6fca900cc7
- Update IR in 5ed438fe07
- Fix GH-16984: function JIT overflow bug in GH-17015
- Update IR in f04a9f466f
Dylan K. Taylor
- Fix GH-16851: JIT_G(enabled) not set correctly on other threads in ff3b4eca0e
Ilija Tovilo
- Move FreeBSD build to GitHub actions with QEMU in aca88baf5f
- Enable -Werror for FreeBSD build in b3ab930a2f
Jakub Zelenka
- Fix GHSA-c5f2-jwm7-mmq2: stream HTTP fulluri CRLF injection in d7fe40868e
- Fix GHSA-h35g-vwh6-m678: Mysqlnd - various heap buffer over-reads in c595455300
- Make MySQLnd protocol stmt test work on 32bit in a21e48a93a
- Fix MySQLnd possible buffer over read in auth_protocol in d37a20c4a2
- Update NEWS with security fixes info in 78c201a310
- Make MySQLnd protocol stmt test work on 32bit in c70b97d8eb
- Change port for mysqli fake server auth message test in 51f5539914
- Increase MySQLi fake server read timeout for ASAN job in eb951b3d11
- Fix GH-16932: wrong FPM status output in d165670d04
- Fix network connect poll interuption handling in 69765d9220
Michael Orlitzky
- Backport GH-14962 to stable versions in ae84b81bfa
Máté Kocsis
- Fix the 1st parameter type casing of
pg_set_chunked_rows_size()
in 56fb910d9c - Fix some odbc_*() parameter types in 3c70f5e976
- Fix GH-16990 "
dba_list()
is now zero-indexed instead of using resource ids" in 50264b03a0
Niels Dossche
- Fix GHSA-5hqh-c84r-qjcv: Integer overflow in the dblib quoter causing OOB writes in 4a79a5a59a
- Fix GHSA-5hqh-c84r-qjcv: Integer overflow in the firebird quoter causing OOB writes in 7a25e7728d
- Fix GHSA-g665-fm4p-vhff: OOB access in
ldap_escape
in fba659abb9 - Fix GHSA-r977-prxv-hc43 in f3ade203d7
- Fix GHSA-4w77-75f9-2c8w in f18d429b20
- Fix GH-16906: Reloading document can cause UAF in iterator in 9d39ff764e
- Fix GH-16908: _ZendTestMagicCallForward does not handle references well in 99f5653ebb
- Fix GH-16902: Set of opcache tests fail zts+aarch64 (8.2-8.3) in de96b43d2a
- Fix GH-16902: Set of opcache tests fail zts+aarch64 (8.4+) in f4ca6d2794
- Fix test expectation for PHP 8.3+ in ff95138e38
- Fix
is_zend_ptr()
huge block comparison in 18674e39ad - Fix GH-16879: JIT dead code skipping does not update call_level in de30ba5042
- Fix various memory leaks in curl mime handling in a80f0b515a
- Extract call_level conditions out to separate functions in GH-16949
- Fix GH-15208: Segfault with breakpoint map and
phpdbg_clear()
in 97b03186c4 - Fix GH-16905: Internal iterator functions can't handle UNDEF properties in e1b4534790
- Fix GH-16957: Assertion failure in
array_shift
with self-referencing array in f1fc4e8ff7 - Fix GH-16998: UBSAN warning in rfc1867 in aab784263d
- Add missing backslash for TokenList interfaces in stub in GH-17009
- Fix some MariaDB test failures in 1a6f8a0b79