PHP 8.4.25: Downloads, Changelog, News

Release Information

Release
8.4.25
PHP Version
PHP 8.4
Release Date
Release Type
Security Update
Release Status
Latest Release in 8.4
Branch Status
Supported

Latest release for PHP 8.4. This release contains security fixes, and it is recommended to update as soon as possible.
PHP 8.4 continues to receive bug fixes and security fixes until 2026-12-31.

Downloads

Source Code

Git Clone
Use Git to clone the 8.4.25 tag from the PHP Git repository.
git clone https://github.com/php/php-src.git --depth 1 --branch php-8.4.25
How to compile PHP
PHP can be compiled by setting up the dependencies, building the configure script (./buildconf), configuring the build ./configure, and running make.
Detailed articles on how to compile PHP are available for Ubuntu/Debian based systems and Fedora/RHEL based systems.

Windows binaries
Non-Thread Safe Builds
Non-Thread Safe (NTS) builds are single-threaded PHP builds. They can be used on web servers that integrate PHP over FastCGI protocol, such as Nginx, Caddy, and IIS.
php-8.4.25-x64NTS.zip
Size: 33.46 MiB SHA256: 43a8f67ed2e5223fafb21293c85976361808855405278cef2cf3037c3ae2529c
php-8.4.25-x86NTS.zip
Size: 30.02 MiB SHA256: 07ad87d7bf37798468c85a54b4c48189bd4f7561390432aad1502f6afb9cdbfe
Thread-Safe Builds
Thread-Safe (TS) builds are multi-thread PHP builds, often used to integrate PHP as a Server API for multithreaded servers. The most common use case is using PHP as an Apache module.
php-8.4.25-x64TS.zip
Size: 33.49 MiB SHA256: 2cf521fb6bcb45b634c7e9a7ab2afb6d41698b987bbc73c4975d90a065e0f16c
php-8.4.25-x86TS.zip
Size: 30.09 MiB SHA256: 92cb92b350cd513ee7aa5c32ce2aaa2e082fb04beaf7baa9b3703b7c0de32f0b

ChangeLog

Core

  • Fixed bug GH-23088 (Stack overflow when comparing deeply nested arrays).

Date

  • Fixed leak on double DatePeriod::__construct() call.

DOM

  • Fixed bug GH-23116 (Stack overflow when normalizing a deeply nested DOMDocument).
  • Fixed bug GH-23117 (Stack overflow when normalizing a deeply nested Dom\XMLDocument).
  • Fixed bug GH-22825 (DOMElement::setAttribute() fails silently when the DTD declares a default value for the attribute).
  • Fixed bug GH-22447 (UAF at dom_objects_free_storage when setting an attribute node that collides by local name with a namespaced attribute).
  • Fixed bug GH-23120 (Stack overflow when comparing deeply nested DOM nodes with DOMNode::isEqualNode()).

LibXML

  • Fixed bug GH-22752 (Build failure with libxml 2.15).

MBString

  • Fixed bug GH-22779 (mb_strrpos() returns the wrong position for a negative offset in a non-UTF-8 encoding).
  • Fixed bug GH-21036 (mb_ereg_search_getregs() crashes after mb_eregi() invalidates the regex cache).

Opcache

  • Fixed bug GH-22857 (Function JIT emits wrong code for FETCH_OBJ_FUNC_ARG on a property hook getter, losing register-held variables).
  • Fixed bug GH-22916 (Preserve parent regs in zend_jit_deoptimizer_start()).

OpenSSL

  • Fix missing error check on invalid alpn protocols.

PCRE

  • Fixed bug GH-21134 (Crash with \C + UTF-8). Using \C in UTF-8 patterns is now forbidden.

Reflection

  • Fixed bug GH-22905 (Reflection exception messages truncate on null bytes).
  • Fixed ReflectionProperty::isLazy() and skipLazyInitialization() using the parent slot when a child class hooks an inherited property.
  • Fixed segfault in ReflectionMethod::createFromMethodName() on an uninstantiable subclass.

Readline

  • Fixed class constant completion in the interactive shell.

Zip

  • Fixed bug GH-17787 (ZipArchive stream stops reading early when the archive is freed while the stream is still open).
  • Fixed ZipArchive::addGlob() and ZipArchive::addPattern() ignoring their default options when no options array is given.

Session

  • Fix corruption in mod_mm.
  • Fixed bug GH-23043 (broken session id code can cause zend_mm_heap corrupted).

SimpleXML

  • Fixed integer element offsets that cannot resolve aliasing an existing element.
  • Fixed segfault when comparing uninitialized SimpleXMLElement instances.

Sockets

  • Fixed various memory related issues in ext/sockets.

SQLite

  • Fix leak when trying to close db if blob stream is still open.

Standard

  • Fixed bug GH-23111 (Stack overflow in array_walk_recursive() with deeply nested arrays).
  • Fixed bug GH-23113 (Stack overflow in array_replace_recursive() with deeply nested arrays).
  • Fixed bug GH-23115 (Stack overflow in compact() with deeply nested arrays).
  • Fixed stack overflow in count() with COUNT_RECURSIVE and deeply nested arrays.

Streams

  • Fixed bug GH-15836 (Use-after-free when a user stream filter accesses $this->stream during the close flush).

Sysvshm

  • Fixed out-of-bounds write when shm_attach() opens an existing segment with a size larger than the segment actually is.

XSL

  • Fixed use-after-free when a DOMDocument subclass __clone() retains the stylesheet copy made by XSLTProcessor::importStylesheet().

Commit List

Arnaud Le Blanc

  • CI: Enable JIT testing on Apple Silicon ZTS 8.6+ in fa47ae16a1
  • Forbid \C in UTF-8 patterns in GH-21139
  • CS in 40c3e247f9
  • JIT: Preserve parent regs in zend_jit_deoptimizer_start() in GH-22916

Calvin Buckley

  • odbc: Quote spaces in UID/PWD appended to connection string in GH-22791
  • TSRM: don't use initial-exec on AIX in GH-23145
  • Update versions for PHP 8.4.25 in a66f30d78e

coderZhao

  • Fix GH-22857: Function JIT emits wrong code for FETCH_OBJ_FUNC_ARG on a property hook in GH-22897

Daniel Scherzer

  • Reflection: Add regression tests for error messages with null bytes in 14b6cd3636
  • GH-22905: avoid truncation on null bytes in reflection exceptions in 866696459a
  • NEWS for PHP 8.4 in 1c491e67c0

David Carlier

  • ext/sockets: memory related issues fix in 754ea6e14e
  • ext/dom: fix UAF when setting an attribute colliding by local name in 3221a076f2
  • ext/sysvshm: do not trust $size when opening an existing segment in f0d244ab3e
  • ext/libxml: Fix build failure with libxml2 2.15 in bc7537dbf0
  • ext/zip: addGlob() and addPattern() ignore their default options in 8d5b0d6fb4

Eyüp Can Akman

Ilia Alshanetsky

  • Fix pdo_odbc output-buffer leak and stale-binding out-of-bounds read in bdcf9ceee3
  • ext/filter: fix use-after-free in parse_str() with filter.default in 0549c8e054
  • ext/soap: fix NULL deref on malformed HTTP status line in 1c4bf04783
  • ext/standard: fix out-of-bounds access in the ftp:// directory stream in b750803b76
  • ext/odbc: do not mutate the caller's DSN string in f9b6254375
  • ext/ftp: apply the connect timeout ceiling to the remaining entry points in c1773a1da2
  • ext/standard: reject a dechunk chunk size that overflows size_t in 04f3d282f8
  • Fix GH-22825: DOM attribute methods on a DTD default attribute in 145e8c26d4
  • ext/filter: encode 0xFF in FILTER_SANITIZE_ENCODED in 56149186d8
  • Regenerate the expired ext/ftp/tests/cert.pem in GH-22873
  • Guard var_dump()/debug_zval_dump() against native stack overflow in 889ae478bd
  • Don't expose a freed stream resource to user filters in 3db0487860
  • Fix OOB read in opcache POSIX largepage page-size selection in 68d605fa92
  • Free the hooked property value when json_encode() sees an exception in c35253d364
  • Free previous state when re-calling Reflection*::__construct() in 87f8d17426
  • Parse qualified reflection names with a length-aware search in 3a9d86a81b
  • Avoid truncation on null bytes in class and function names in 841fe26c11
  • Check object_init_ex() in ReflectionMethod::createFromMethodName() in b80ef095ea
  • Resolve the effective property in ReflectionProperty lazy APIs in ae42ecf1f3
  • ext/sysvshm: don't orphan the segment shm_attach() just created in a72e0636fe
  • Fix SimpleXML integer offsets that cannot resolve aliasing a node in 9e696413e8
  • Fix segfault comparing uninitialized SimpleXMLElement instances in 7b1f5637b6
  • Fix use-after-free when __clone() retains the stylesheet copy in 11047a7a66

Ilija Tovilo

Jakub Zelenka

lazerg

Lazizbek Ergashev

  • Add a stack limit check in zend_hash_compare() in GH-23090
  • Add a stack limit check in php_array_walk() in GH-23125
  • Add a stack limit check in php_array_replace_recursive in GH-23124
  • Add a stack limit check in php_compact_var() in GH-23126
  • Add a stack limit check in php_count_recursive() in GH-23197
  • Fix GH-23204: use-after-free when __toString() destroys an array argument in 8ce7f7f5e9

Matthias Goergens

  • Fix mbregex search state after cache invalidation in da4b676047

ndossche

  • sqlite3: Fix leak when trying to close db if blob stream is still open in eaac0378e3
  • session: fix corruption in mod_mm in a033601273
  • Fix GH-23043: broken session id code can cause zend_mm_heap corrupted in 9366c61247

NickSdot

  • CI: Select Windows test workers automatically in GH-22946
  • perf: speed up benchmark checkout in GH-23211

Nora Dossche

  • openssl: Check return value of SSL_CTX_set_alpn_protos() in GH-22996

Recep A.

  • Fix out-of-bounds write in ext-bcmath bccomp() via bc_str2num() in 4f83876af7

Shivam Mathur

Sjoerd Langkemper

  • Fix leak when cURL PREREQFUNCTION returns a type other than int in GH-22726
  • ext/curl: fix mem leak when duphandle fails in curl_clone_obj in GH-22899

tekimen

  • Update ext/mbstring/tests/gh21036.phpt in f699538427

Weilin Du

Subscribe to PHP.Watch newsletter for monthly updates

You will receive an email on last Wednesday of every month and on major PHP releases with new articles related to PHP, upcoming changes, new features and what's changing in the language. No marketing emails, no selling of your contacts, no click-tracking, and one-click instant unsubscribe from any email you receive.