PHP 8.4.8: Downloads, Changelog, News

Release Information

Release
8.4.8
PHP Version
PHP 8.4
Release Date
Release Type
Bug Fix Release
Release Status
Latest
Branch Status
Supported (Latest)

Latest PHP release in the latest version.
PHP 8.4 continues to receive bug fixes and security fixes until 2026-12-31.

Downloads

Source Code

Git Clone
Use Git to clone the 8.4.8 tag from the PHP Git repository.
git clone https://github.com/php/php-src.git --depth 1 --branch php-8.4.8
How to compile PHP
PHP can be compiled by setting up the dependencies, building the configure script (./buildconf), configuring the build ./configure, and running make.
Detailed articles on how to compile PHP are available for Ubuntu/Debian based systems and Fedora/RHEL based systems.

Windows binaries
Non-Thread Safe Builds
Non-Thread Safe (NTS) builds are single-threaded PHP builds. They can be used on web servers that integrate PHP over FastCGI protocol, such as Nginx, Caddy, and IIS.
Thread-Safe Builds
Thread-Safe (TS) builds are multi-thread PHP builds, often used to integrate PHP as a Server API for multithreaded servers. The most common use case is using PHP as an Apache module.

Docker/Podman Containers

PHP CLI
PHP CLI Containers images only include the PHP CLI, and no FPM or Apache modules. The Alpine builds are lightweight, but may introduce incompatibilities due to their musl builds. Albeit their larger size, the Debian-based (without the "-alpine" suffix) images are more complete, and widely used.

Alpine-based: Lightweight, but may introduce incompatibilities due to their musl builds.
docker pull php:8.4.8-cli-alpine

Debian-based: More compatible with other components, complete, and are widely used.
docker pull php:8.4.8-cli
PHP CLI + Web Server Integration
These container images include PHP CLI, and a web server integration. FPM container images can be integrated with web servers such as Nginx, Caddy, and Apache with Event MPM. The Apache container images include Apache web server, integrating PHP as an Apache module.

Alpine-based: Lightweight, but may introduce incompatibilities due to their musl builds.
docker pull php:8.4.8-fpm-alpine

Debian-based ZTS Apache: Includes Apache web server integrating PHP as an Apache module.
docker pull php:8.4.8-apache

Debian-based NTS FPM: PHP-FPM, can be integrated with Nginx, Caddy, and other web servers over Fast CGI.
docker pull php:8.4.8-fpm

ChangeLog

Core

  • Fixed GH-18480 (array_splice with large values for offset/length arguments). (nielsdos/David Carlier)
  • Partially fixed GH-18572 (nested object comparisons leading to stack overflow).
  • Fixed OSS-Fuzz #417078295.
  • Fixed OSS-Fuzz #418106144.

Curl

  • Fixed GH-18460 (curl_easy_setopt with CURLOPT_USERPWD/CURLOPT_USERNAME/ CURLOPT_PASSWORD set the Authorization header when set to NULL).

Date

  • Fixed bug GH-18076 (Since PHP 8, the date_sun_info() function returns inaccurate sunrise and sunset times, but other calculated times are correct)
  • Fixed bug GH-18481 (date_sunrise with unexpected nan value for the offset). (nielsdos/David Carlier)

DOM

  • Backport lexbor/lexbor#274.

Intl

  • Fix various reference issues.

LDAP

  • Fixed bug GH-18529 (ldap no longer respects TLS_CACERT from ldaprc in ldap_start_tls()).

Opcache

  • Fixed bug GH-18417 (Windows SHM reattachment fails when increasing memory_consumption or jit_buffer_size).
  • Fixed bug GH-18297 (Exception not handled when jit guard is triggered).
  • Fixed bug GH-18408 (Snapshotted poly_func / poly_this may be spilled).
  • Fixed bug GH-18567 (Preloading with internal class alias triggers assertion failure).
  • Fixed bug GH-18534 (FPM exit code 70 with enabled opcache and hooked properties in traits).
  • Fix leak of accel_globals->key.

OpenSSL

  • Fix missing checks against php_set_blocking() in xp_ssl.c.

SPL

  • Fixed bug GH-18421 (Integer overflow with large numbers in LimitIterator).

Standard

  • Fixed bug GH-17403 (Potential deadlock when putenv fails).
  • Fixed bug GH-18400 (http_build_query type error is inaccurate).
  • Fixed bug GH-18509 (Dynamic calls to assert() ignore zend.assertions).

Windows

  • Fix leak+crash with sapi_windows_set_ctrl_handler().

Zip

  • Fixed bug GH-18431 (Registering ZIP progress callback twice doesn't work).
  • Fixed bug GH-18438 (Handling of empty data and errors in ZipArchive::addPattern).

Commit List

Arnaud Le Blanc

  • JIT: Check exception on exit in 978c01ce15
  • Snapshotted poly_func / poly_this may be spilled in 18276a8b42

Calvin Buckley

Carlos Buenosvinos

  • Fix GH-18076: date_sun_info() function returns inaccurate sunrise and sunset times in c9f3127ca8

David Carlier

George Wang

  • Update SAPI_LITESPEED_PATH to sapi/litespeed/lsphp in e4f2e4a99a
  • Update SAPI_LITESPEED_PATH to sapi/litespeed/lsphp in e961488d98
  • Update max size of request headers from 65535 to 256K in 58e5d0c240
  • Update LSAPI version to V8.2 in 03844d1f51
  • Address compiler warnings in 8e5b3129de

Ilija Tovilo

  • Drop tidyp from FreeBSD build in 35936bfa79
  • Use --ignore-platform-req=php+ in community build in 0a42e6fbc5
  • Revert "Fix infinite recursion on deprecated attribute evaluation" in 386ab1dad2
  • Fix missing include in win32/globals.c in 69f0882d3b

Levi Morrison

  • fix: dangling opline in ZEND_INIT_ARRAY in GH-18578

Niels Dossche

  • Fix DOM tests for upcoming libxml2 serializer changes in d6e70e7053
  • Revert "Port XML_GetCurrentByteIndex to public APIs" in 54e662c6f5
  • Fix GH-17403: Potential deadlock when putenv fails in 32e091260a
  • Fix GH-18421: Integer overflow with large numbers in LimitIterator in a91d913901
  • Fix GH-18400: http_build_query type error is inaccurate in 7a2bef02c0
  • Fix GH-18431: Registering ZIP progress callback twice doesn't work in b066ac0b23
  • Fix GH-18438: Handling of empty data and errors in ZipArchive::addPattern in 2eb3100dca
  • datefmt_parse/datefmt_localtime references type system fixes in 2beec54e47
  • Fix IntlDateFormatter::parseToCalendar() reference type system breaks in 173dccb646
  • Fix GH-18417: Windows SHM reattachment fails when increasing memory_consumption or jit_buffer_size in 7869af6fa8
  • Fix numfmt_parse_currency() reference handling in e3cac07a9b
  • Fix reference handling of grapheme_extract() in e3105f5f1e
  • Fix reference handling of IntlTimeZone::getCanonicalID/intltz_get_canonical_id in a090e59b37
  • Backport lexbor/lexbor#274 in 42ad1c64bf
  • Fix leak+crash with sapi_windows_set_ctrl_handler() in fb3536fd60
  • Fix GH-18494: PDO OCI segfault in statement GC in dcf9d8f812
  • Sync EXTENSIONS and extend maintenance time in e7a44a68e9
  • Backport lexbor/lexbor@814e0bce in GH-18574
  • Fix OSS-Fuzz #417078295 in 46ac878f6a
  • Fix OSS-Fuzz #418106144 in 98cb17f4fd
  • Fix deprecation warning for libxml SAX header in GH-18594
  • Fix GH-18567: Preloading with internal class alias triggers assertion failure in 41e11a627d
  • Fix GH-18534: FPM exit code 70 with enabled opcache and hooked properties in traits in 6b795f64a5
  • Fix leak of accel_globals->key in db3bf715e0
  • Backport accel_globals->key leak fix (8.3) in b2d78ae00c
  • Fix missing checks against php_set_blocking() in xp_ssl.c in 31ebb42268
  • Split off php_set_sock_blocking() and s.is_blocked to a separate function in 1863014fbd

Remi Collet

Tim Düsterhus

  • fileinfo: Fix cleanup in ext/fileinfo/tests/cve-2014-1943-mb.phpt in GH-18397
  • gen_stub: Fix ce_flags generation for compatibility mode in GH-18507
  • standard: Take zend.assertions into account for dynamic calls to assert() in GH-18521
Subscribe to PHP.Watch newsletter for monthly updates

You will receive an email on last Wednesday of every month and on major PHP releases with new articles related to PHP, upcoming changes, new features and what's changing in the language. No marketing emails, no selling of your contacts, no click-tracking, and one-click instant unsubscribe from any email you receive.