PHP 8.4.24: Downloads, Changelog, News

Release Information

Release
8.4.24
PHP Version
PHP 8.4
Release Date
Release Type
Security Update
Release Status
Latest Release in 8.4
Branch Status
Supported

Latest release for PHP 8.4. This release contains security fixes, and it is recommended to update as soon as possible.
PHP 8.4 continues to receive bug fixes and security fixes until 2026-12-31.

Downloads

Source Code

Git Clone
Use Git to clone the 8.4.24 tag from the PHP Git repository.
git clone https://github.com/php/php-src.git --depth 1 --branch php-8.4.24
How to compile PHP
PHP can be compiled by setting up the dependencies, building the configure script (./buildconf), configuring the build ./configure, and running make.
Detailed articles on how to compile PHP are available for Ubuntu/Debian based systems and Fedora/RHEL based systems.

Windows binaries
Non-Thread Safe Builds
Non-Thread Safe (NTS) builds are single-threaded PHP builds. They can be used on web servers that integrate PHP over FastCGI protocol, such as Nginx, Caddy, and IIS.
php-8.4.24-x64NTS.zip
Size: 33.45 MiB SHA256: 86470a30cbbaeafb259e727dfa5cd336f2f3f0a462cd6f8e3eac00fdbded13cb
php-8.4.24-x86NTS.zip
Size: 30.02 MiB SHA256: 42f00095f1ee7bd85a12f0be48fc30be3d1ea4a93423de560b83da5521242305
Thread-Safe Builds
Thread-Safe (TS) builds are multi-thread PHP builds, often used to integrate PHP as a Server API for multithreaded servers. The most common use case is using PHP as an Apache module.
php-8.4.24-x64TS.zip
Size: 33.48 MiB SHA256: 7b57fc9840273ab153834d0e2bd06e0bcf4fead36e381182b4b8fe9cedff3174
php-8.4.24-x86TS.zip
Size: 30.08 MiB SHA256: f4d04d99aed1e7d93f7c452eb99b31741ade48a80308e8210414aafbd23d10b3

Docker/Podman Containers

PHP CLI
PHP CLI Containers images only include the PHP CLI, and no FPM or Apache modules. The Alpine builds are lightweight, but may introduce incompatibilities due to their musl builds. Albeit their larger size, the Debian-based (without the "-alpine" suffix) images are more complete, and widely used.

Alpine-based: Lightweight, but may introduce incompatibilities due to their musl builds.
docker pull php:8.4.24-cli-alpine

Debian-based: More compatible with other components, complete, and are widely used.
docker pull php:8.4.24-cli
PHP CLI + Web Server Integration
These container images include PHP CLI, and a web server integration. FPM container images can be integrated with web servers such as Nginx, Caddy, and Apache with Event MPM. The Apache container images include Apache web server, integrating PHP as an Apache module.

Alpine-based: Lightweight, but may introduce incompatibilities due to their musl builds.
docker pull php:8.4.24-fpm-alpine

Debian-based ZTS Apache: Includes Apache web server integrating PHP as an Apache module.
docker pull php:8.4.24-apache

Debian-based NTS FPM: PHP-FPM, can be integrated with Nginx, Caddy, and other web servers over Fast CGI.
docker pull php:8.4.24-fpm

ChangeLog

BCMath

Calendar

  • Fixed bug GH-22602 (gregoriantojd() and juliantojd() integer overflow with INT_MAX year).

Date

  • Update timelib to 2022.17.
  • Fixed bug GH-19803 (Parsing a string with a single white space does create an error).
  • Fixed Unix timestamps in February of the year 0 are misparsed with @-notation.
  • Fixed bug GH-11310 (__debugInfo does nothing on userland classes extending Date classes).

DBA

  • Fixed OOB read on malformed length field in dba flatfile handler.

DOM

  • Fixed bug GH-22570 (Stack overflow when serializing a deeply nested Dom\XMLDocument).

Exif

  • Fixed bug GH-11020 (exif_read_data() emits a spurious "Illegal IFD size" warning when an IFD is not followed by a next-IFD offset).

GD

Hash

  • Fixed bug GH-18173 (ext/hash relies on implementation-defined malloc alignment).

Intl

  • Fixed Locale::lookup() and locale_lookup() to return NULL instead of the fallback locale when a language tag cannot be canonicalized.
  • Fixed memory leaks when calling Collator::__construct() or Spoofchecker::__construct() twice.
  • Fixed IntlChar methods leaving stale global error state after successful calls.

ODBC

  • Fixed bug GH-22668 (Heap buffer over-read when a column value exceeds the driver-reported display size).

OpenSSL

  • Fixed timeout for supplemental read at end of a blocking stream in SSL stream wrapper.

PDO_ODBC

  • Fixed bug GH-20726 (Crash with ODBC connection pooling when the DSN carries no credentials).
  • Fixed bug GH-22667 (Heap buffer over-read when a column value exceeds the driver-reported display size).
  • Fixed bug GH-22666 (Heap buffer overflow when an output parameter value is longer than the declared maxlen).
  • Fixed bug GH-22665 (Out-of-bounds write when the ODBC driver reports a diagnostic message length beyond the error buffer).

PGSQL

Phar

  • Fixed inconsistent handling of the magic ".phar" directory. Paths such as "/.phar" remain protected, while non-magic paths that merely start with ".phar" are handled consistently across file and directory creation, copying, ArrayAccess, stream lookup, directory iteration and extraction.
  • Fixed GHSA-vc5h-9ppw-p5f3 (Crash via recursive symlinks). (CVE-2026-7260)

PHPDBG

  • Fixed bug GH-17387 (Trivial crash in phpdbg lexer).
  • Fixed fleaked lowercased lookup keys in phpdbg_resolve_opline_break.
  • Fixed off-by-one in phpdbg_safe_class_lookup() causing class lookups to always fail during phpdbg's signal-safe interruption path.

Reflection

  • Fixed bug GH-22324 (Ignore leading namespace separator in ReflectionParameter::__construct()).
  • Fixed bug GH-22441 (ReflectionClass::hasProperty() and getProperty() ignore dynamic properties shadowing a private parent property).
  • Fixed bug GH-22658 (ReflectionConstant::__toString() with a string value with null bytes truncates output).
  • Fixed bug GH-22681 (Reflection*::__toString() truncates on null bytes).

Session

  • Fixed bug GH-21314 (Different session garbage collector behavior between PHP 8.3 and PHP 8.5).

SPL

  • Fix class_parents for classes with leading slash in non-autoload mode.
  • Ignore leading back-slash in class_parents(), class_implements(), and class_uses().
  • Fixed bug GH-16217 (SplFileObject::fputcsv() on an uninitialized object segfaults).

Standard

  • Fixed bug GH-22360 (convert.base64-encode corruption on incremental flush).
  • Fixed bug GH-22395 (base_convert() outputs at most 64 characters).
  • Fixed integer overflow in getimagesize() and getimagesizefromstring() when parsing an IFF chunk with a size of INT_MAX.
  • Fixed bug GH-22678 (Use-after-free in array_multisort() when the comparator mutates the array being sorted).

Streams

  • Fixed bug GH-22617 (persistent stream keys truncated at null bytes, causing distinct abstract unix domain sockets to share a resource).

Zip

  • Fixed bug GH-22649 (ZipArchive::setCommentName() and setCommentIndex() could crash after overwriting an entry and resetting its inherited unchanged comment).
  • Fixed bug GH-21705 (ZipArchive::getFromIndex() ignores ZipArchive::FL_UNCHANGED for deleted entries).

Commit List

alhudz

  • ext/dba: fix oob read on malformed length field in dba flatfile handler in a9c7dfefbd

arshidkv12

  • ext/calendar: Fix integer overflow in GregorianToSdn() and JulianToJd() in GH-22604

Calvin Buckley

Daniel Scherzer

  • Add regression tests for ReflectionConstant::__toString() with null bytes in 5b00437a09
  • GH-22658: avoid truncation on null bytes in ReflectionConstant::__toString() in ed3e06a673
  • NEWS in 834bdcedd1
  • Add regression tests for Reflection*::__toString() with null bytes in 1db6c84050
  • GH-22681: avoid truncation on null bytes in Reflection*::__toString() in 8706cd43f6
  • NEWS in 4804d17a13

David Carlier

Derick Rethans

  • Updated to version 2026.3 (2026c) in 29f8f56b1e
  • Update timelib to 2022.17, which has fixes for PHP bugs in d83851dae8
  • Fix GH-11310: __debugInfo does nothing on userland classes extending Date classes in GH-22655

Eyüp Can Akman

  • ext/exif: Fix GH-11020: spurious "Illegal IFD size" warning in exif_read_data() in 6317a472f4

Gina Peter Banyard

  • NEWS entries for recent SPL bug fixes in 6a323eb7a4

Ilia Alshanetsky

  • Remove stray printf() on invalid DSN version in pdo_dblib in 8e3ab80667
  • Fix buffer overflow converting @@IDENTITY in pdo_dblib lastInsertId in 1a5a81ca9f
  • zend_ast: Escape control bytes in exported string literals in f3cf2f4527
  • Fix MIME charset sniffing advancing by name length not value length in 98563c2d8e
  • Fix file descriptor leak when proc_open() descriptor setup fails in 100938b40b
  • ext/ftp: fix out-of-bounds read in ftp_get() ASCII CRLF translation in 35fde02e42
  • Fix leak of resolved address list in netsnmp_session_init() in 3704b9d3c9
  • Fix socket_sendmsg() sending wrong fd for Socket objects in SCM_RIGHTS in e463914fb2
  • Fix GH-22158: JIT observer dispatch through wrong run_time_cache slot in 19f595fd9e
  • ext/gd: fix out-of-bounds write reading font header on short reads in df1250dc64
  • ext/com_dotnet: release the held IUnknown in com_get_active_object() in ca4561cda6
  • Throw on below-minimum opslimit/memlimit in sodium pwhash in df7fd97212
  • ext/ftp: fix off-by-one terminator write in ftp_readline() in 34a9a43904
  • Fix session save-handler argv leak on recursive rejection in 087a08d970
  • Fix freeing uninitialized memory in LDAP sort control parsing in a15654ece0
  • Fix posix_getpwnam()/posix_getpwuid() crash on NULL passwd fields in 84d8342580
  • Fix int32_t overflow in intl_charFromString() capacity calculation in 4d70d745ab
  • ext/gd: pack imageloadfont short-read test in native byte order in 5af56148a2
  • Fix invalid Firebird isolation level proceeding with the connection in 06037f8b7b
  • Fix signed dbconvert() return stored into size_t in dblib lastInsertId in c94681937f
  • Fix posix_getgrnam()/posix_getgrgid() crash on NULL group name in be55be0a4d
  • soap: do not overwrite the parsed host on a protocol-relative redirect in 27c10ddce6
  • Guard uninitialized SplFileObject in fputcsv() and next() in 60d8e92ed4
  • Report dynamic property shadowing a private parent in Reflection in 86d78cc24f
  • Fix int truncation of read length in shmop_read() in 64cf7b2dba
  • Fix use-after-free in Collator::sort() with a mutating comparator in 5fa74db18d
  • Fix use-after-free in RecursiveIteratorIterator on reentry in 1cbd3b9ba9
  • Fix use-after-free in XPath php:function argument nodes in f9821dd1dd
  • Fix use-after-free in RecursiveIteratorIterator on reentrant teardown in efbf47300b
  • Fix GH-17387: crash on unterminated quote in phpdbg lexer in 2e564a747c
  • Fix GH-18173: ext/hash relies on implementation-defined malloc alignment in 8da53b5d31
  • Fix GH-20726: crash in pdo_odbc with pooling and no credentials in GH-22512
  • Fix infinite recursion in property hook getter in opcache preloaded trait in d27da095b1
  • Fix GH-22570: stack overflow serializing a deeply nested Dom\XMLDocument in dd57694402
  • Fix GH-22678: array_multisort() use-after-free on mutating comparator in 1e9f56cdb4
  • Fix use-after-free on re-entrant ftp_close() during a transfer in 1feb20156b
  • Install the SQLite ODBC driver in CI in c3236b922d
  • Fix GH-22667: pdo_odbc heap over-read on oversized column value in 103c84ff4c
  • Fix GH-22668: odbc heap over-read on oversized column value in 8e4daeff7a
  • Fix GH-22666: pdo_odbc heap overflow on oversized output param in a7539ff834
  • Fix GH-22665: pdo_odbc OOB write on oversized diagnostic length in 345b88deeb

Ilija Tovilo

Jakub Zelenka

Jarne Clauw

  • Fixing memory leak in openssl_x509_parse when str_serial creation fails in GH-21751
  • Fixing memory leak in openssl_pkcs12_read when zout initialisation fails in GH-21752

Jorg Adam Sowa

  • ext/spl: fix class_parents for classes with leading slash in non-autoload mode in GH-22283
  • ext/spl: ignore leading namespace separator in spl_autoload() in GH-22323
  • phpdbg: Fix off-by-one in phpdbg_safe_class_lookup() signal-safe class lookup in GH-22593
  • CI: Revert timeout fix for Symfony community build in GH-22682

Jorg Sowa

  • Ignore leading namespace separator in ReflectionParameter::__construct() in 47f060ca33
  • ci: add 180-minute timeout to test-suite jobs in 98b86328b6
  • ext/session: fix GH-21314 (session GC behaviour is different since 8.4) in fe53521e92
  • phpdbg: fix leaked lowercased lookup keys in phpdbg_resolve_opline_break in b6938a25ee

Michael Orlitzky

  • ext/sockets/tests/gh21161.phpt: skip if no ipv6 in GH-22403
  • ext/iconv/tests/bug76249.phpt: fallback for non-GNU iconv() in GH-22552
  • ext/iconv/tests/bug52211.phpt: use per-iconv charset names in GH-22543
  • ext/iconv/tests/eucjp2iso2022jp.phpt: skip for "unknown" iconv in ebbfb3c02b
  • ext/iconv/tests/iconv_mime_encode.phpt: skip for "unknown" iconv in 863263a775
  • ext/gd/tests/gh19{666,739}.phpt: skip for external libgd in b51f575ba1
  • Alpine CI: don't install gnu-libiconv-dev in a095c57f03

Máté Kocsis

  • Fix macOS compatibility of update-lexbor.sh in f40c8f2b98

Nora Dossche

  • openssl: Use proper error propagation when X509_dup() fails in openssl_x509_read() in GH-21953
  • Fix NULL deref when enabling TLS fails and the peer name needs to be reset in fc0f25f286

P3p111n0

Recep A.

  • Fix out-of-bounds write in ext-bcmath bccomp() via bc_str2num() in fa18dab73f

Tim Düsterhus

  • lexbor: Refresh patch files in GH-22517

Weilin Du

  • ext/phar: Fix ZIP extra field length underflow in GH-22330
  • ext/intl: Fix Locale::lookup() fallback on invalid language tags in GH-22306
  • ext/intl: Fix double construction leaks in GH-22386
  • Fix GH-22395: Avoid truncating base_convert() output at 64 characters in GH-22406
  • ext/phar: Fix .phar-prefixed non-magic directory handling in GH-22372
  • Fix GH-21705: ZipArchive::getFromIndex() ignores FL_UNCHANGED in GH-21706
  • Fix GH-22649: avoid ZipArchive comment reset crash in GH-22652

Xuyang Zhang

  • ext/intl: Reset IntlChar error state on method entry in GH-22500
Subscribe to PHP.Watch newsletter for monthly updates

You will receive an email on last Wednesday of every month and on major PHP releases with new articles related to PHP, upcoming changes, new features and what's changing in the language. No marketing emails, no selling of your contacts, no click-tracking, and one-click instant unsubscribe from any email you receive.