PHP 8.4.21: Downloads, Changelog, News

Release Information

Release
8.4.21
PHP Version
PHP 8.4
Release Date
Release Type
Security Update
Release Status
Latest Release in 8.4
Branch Status
Supported

Latest release for PHP 8.4. This release contains security fixes, and it is recommended to update as soon as possible.
PHP 8.4 continues to receive bug fixes and security fixes until 2026-12-31.

Downloads

Source Code

Git Clone
Use Git to clone the 8.4.21 tag from the PHP Git repository.
git clone https://github.com/php/php-src.git --depth 1 --branch php-8.4.21
How to compile PHP
PHP can be compiled by setting up the dependencies, building the configure script (./buildconf), configuring the build ./configure, and running make.
Detailed articles on how to compile PHP are available for Ubuntu/Debian based systems and Fedora/RHEL based systems.

Windows binaries
Non-Thread Safe Builds
Non-Thread Safe (NTS) builds are single-threaded PHP builds. They can be used on web servers that integrate PHP over FastCGI protocol, such as Nginx, Caddy, and IIS.
php-8.4.21-x64NTS.zip
SHA256: 2cb57d0d3a17b1248c6a53b600719d4b051e1c374373404d5031409c0725031d
php-8.4.21-x86NTS.zip
SHA256: 99c9827d01480147e735e443e2ffe6f1974af053e521f63a46d1a498d2a45d13
Thread-Safe Builds
Thread-Safe (TS) builds are multi-thread PHP builds, often used to integrate PHP as a Server API for multithreaded servers. The most common use case is using PHP as an Apache module.
php-8.4.21-x64TS.zip
Size: 0 MiB SHA256: 9e2f6e455d3f42993f09deed23ad0178b3787090c924793e50414b6a92de186a
php-8.4.21-x86TS.zip
Size: 0 MiB SHA256: 83a472c6ecc3c6a5c607e1b96a307f19daa6c1745eb6cc6ebb601db4cd49f514

ChangeLog

Core

  • Fixed bug GH-19983 (GC assertion failure with fibers, generators and destructors).
  • Fixed bug GH-21478 (Forward property operations to real instance for initialized lazy proxies).
  • Fixed bug GH-21605 (Missing addref for Countable::count()).
  • Fixed bug GH-21699 (Assertion failure in shutdown_executor when resolving self::/parent::/static:: callables if the error handler throws).
  • Fixed bug GH-21603 (Missing addref for __unset).
  • Fixed bug GH-21760 (Trait with class constant name conflict against enum case causes SEGV).

CLI

  • Fixed bug GH-21754 (--rf command line option with a method triggers ext/reflection deprecation warnings).

Curl

  • Add support for brotli and zstd on Windows.

DOM

  • Fixed bug GH-21566 (Dom\XMLDocument::C14N() emits duplicate xmlns declarations after setAttributeNS()).
  • Fixed bug GH-21688 (segmentation fault on empty HTMLDocument).
  • Upgrade to lexbor v2.7.0.
  • Fixed bug GH-21544 (Dom`XMLDocument::C14N`*( drops namespace declarations on DOM-built documents).

Iconv

  • Fixed bug GH-17399 (iconv memory leak on bailout).

Opcache

  • Fixed bug GH-21158 (JIT: Assertion jit->ra[var].flags & (1<<0) failed in zend_jit_use_reg).
  • Fixed bug GH-21593 (Borked function JIT JMPNZ smart branch).
  • Fixed bug GH-21460 (COND optimization regression).
  • Fixed faulty returns out of zend_try block in zend_jit_trace().

OpenSSL

  • Fix a bunch of memory leaks and crashes on edge cases.

Phar

  • Restore is_link handler in phar_intercept_functions_shutdown.
  • Fixed bug GH-21797 (phar: NULL dereference in Phar::webPhar() when SCRIPT_NAME is absent from SAPI environment).
  • Fix memory leak in Phar::offsetGet().
  • Fix memory leak in phar_add_file().
  • Fixed bug GH-21799 (phar: propagate phar_stream_flush return value from phar_stream_close).
  • Fix memory leak in phar_verify_signature() when md_ctx is invalid.

Random

  • Fixed bug GH-21731 (Random\Engine\Xoshiro256StarStar::__unserialize() accepts all-zero state).

Session

  • Fixed memory leak when session GC callback return a refcounted value.

SPL

  • Fixed bug GH-21499 (RecursiveArrayIterator getChildren UAF after parent free).
  • Fix concurrent iteration and deletion issues in SplObjectStorage.

Streams

  • Fixed bug GH-21468 (Segfault in file_get_contents w/ a https URL and a proxy set).

XSL

  • Fixed bug GH-21600 (Segfault on module shutdown).

Zip

  • Fixed bug GH-21698 (memory leak with ZipArchive::addGlob() early return statements).

Commit List

Arnaud Le Blanc

Calvin Buckley

  • ext/pdo_odbc: Require non-empty string when building string buffer in GH-21652
  • Update versions for PHP 8.4.21 in d3ca4dfad3

Daniel Scherzer

  • GH-21754: sapi/cli: avoid deprecation messages with --rf and methods in GH-21758

David Carlier

Dmitry Stogov

Gina Peter Banyard

Hans Krentel (hakre)

  • Add date.timezone=UTC to the INI overwrites in run-tests.php in d1670fb7e1

Ilia Alshanetsky

  • Fix GH-19983: GC assertion failure with fibers, generators and destructors in b15c5972fb
  • Fix GH-17399: iconv memory leak on bailout in 38628e89a5
  • Fix GH-21478: Forward property operations to real instance for initialized lazy proxies in 9c082438f4
  • Fix GH-21730: Mt19937::__debugInfo() leaks state HashTable when the serialize callback fails in GH-21733
  • Fix GH-21731: Random\Engine\Xoshiro256StarStar::__unserialize() accepts all-zero state in GH-21732
  • phar: restore is_link handler in phar_intercept_functions_shutdown in b77b50508b
  • phar: fix NULL dereference in Phar::webPhar() when SCRIPT_NAME is absent in 36c4195a2e
  • phar: free is_temp_dir entry before rejecting .phar/* paths in offsetGet in b9aaa05098
  • phar: call phar_entry_delref before goto finish in phar_add_file error paths in 0c99bd76b1
  • phar: propagate phar_stream_flush return value from phar_stream_close in 30f368567b

Ilija Tovilo

Jakub Zelenka

Jarne Clauw

  • ext/phar: Fix memory leak in phar_verify_signature() when md_ctx is invalid in 2fe85279a0

Jorg Sowa

  • ext/session: fix missing zval_ptr_dtor for retval in PS_GC_FUNC(user) in d96579371f

Marcos 'Marcão' Aurelio

  • Fix GH-21699: callable resolution must fail if error handler threw during self/parent/static deprecations in GH-21712

ndossche

  • Fix missing error propagation in openssl_x509_export_to_file() in 2004b709c4
  • Fix error check on X509V3_EXT_print() in 5684949337
  • openssl: Propagate PHP_OPENSSL_ASN1_INTEGER_set() failure in cea48b4781
  • Fix UB and error propagation when X509_gmtime_adj() fails in 2467dfb18f
  • Add missing error check on SSL_set_ex_data() in f81a9a2f7d
  • Fix const-generic warning in xp_ssl.c in 883014debb
  • openssl: Fix merge in c5fb035c67
  • Fix concurrent iteration and deletion issues in SplObjectStorage in 43a4f91c52
  • Upgrade Lexbor to v2.7.0 in 16baee5aaf

Niels Dossche

  • Fix NPD when i2d_PKCS12_bio is called on NULL bio in 23b151a2ca
  • Fix memory leak in check_cert() when X509_STORE_CTX_init() fails in eb6c48df6a
  • Fix crash in php_openssl_pkey_init_ec() when EVP_PKEY_CTX_new() fails in 6b16390a5a
  • Fix crash in openssl_digest() when EVP_MD_CTX_create() fails in b2f34721ab
  • Fix crash in openssl_pkey_export() when BIO_new() fails in d0d9183d9d
  • Fix crash in openssl_pkcs12_read() when BIO_new() fails in 5f9b6ed834
  • Fix crash in php_openssl_create_sni_server_ctx() when SSL_CTX_new() fails in 1ef9aa7e32
  • Fix memory leak on error path in openssl_open() in 20903a8485
  • Fix memory leaks when adding certificate to store fails in 4bb68c567f
  • Fix crash in openssl_pkey_get_details() when BIO_new() fails in e474d3c99f

Nora Dossche

  • Fix NULL deref when enabling TLS fails and the peer name needs to be reset in 7782b8876b
  • Fix build warning on LibreSSL in GH-21050
  • Fix SKIPIF of openssl_password.phpt in GH-20941
  • openssl: Fix missing error propagation in openssl_x509_export() in GH-21375
  • openssl: Fix error propagation in csr exports in GH-21403
  • Fix crash when ASN1_STRING_to_UTF8() fails in 8c11370974
  • Fix error check on X509_set_subject_name() in 8b031ea6ed
  • Fix memory leaks when php_openssl_dh_pub_from_priv() fails in 35e8cb87cb
  • Add missing error check on BN_CTX_new() in 4cffcbaf4a
  • Fix memory leaks when BN_bin2bn() fails in 7eb38cd3f5
  • Fix memory leaks and missing error propagation when php_openssl_csr_make() fails to set a version in 79b1ca2064

Peter Kokot

  • Remove redundant PHP manifest file in GH-21634

Pratik Bhujel

  • zend_inheritance: Fix enum case conflict in trait binding in GH-21771

Saki Takamachi

Shivam Mathur

  • Fix curl_setopt_ssl test for curl 8.19.0 in GH-21518
  • curl: add support for brotli and zstd on Windows in 0c6fc66848
  • Decrease zend.max_allowed_stack_size in stack_limit_015.phpt in cef6fbe64c
  • Accept HY000 in pdo_firebird autocommit test in GH-21789

Tim Düsterhus

vi3tL0u1s

Subscribe to PHP.Watch newsletter for monthly updates

You will receive an email on last Wednesday of every month and on major PHP releases with new articles related to PHP, upcoming changes, new features and what's changing in the language. No marketing emails, no selling of your contacts, no click-tracking, and one-click instant unsubscribe from any email you receive.