PHP 8.5.10: Downloads, Changelog, News

Release Information

Release
8.5.10
PHP Version
PHP 8.5
Release Date
Release Type
Security Update
Release Status
Latest
Branch Status
Supported (Latest)

Latest PHP release in the latest version. This release contains security fixes, and it is recommended to update as soon as possible.
PHP 8.5 continues to receive bug fixes and security fixes until 2027-12-31.

Downloads

Source Code

Git Clone
Use Git to clone the 8.5.10 tag from the PHP Git repository.
git clone https://github.com/php/php-src.git --depth 1 --branch php-8.5.10
How to compile PHP
PHP can be compiled by setting up the dependencies, building the configure script (./buildconf), configuring the build ./configure, and running make.
Detailed articles on how to compile PHP are available for Ubuntu/Debian based systems and Fedora/RHEL based systems.

Windows binaries
Non-Thread Safe Builds
Non-Thread Safe (NTS) builds are single-threaded PHP builds. They can be used on web servers that integrate PHP over FastCGI protocol, such as Nginx, Caddy, and IIS.
php-8.5.10-x64NTS.zip
Size: 34.35 MiB SHA256: 22ec430195984d233eb9e62c637a945bbcda06efca2f392d9d96d62c6acd34f8
php-8.5.10-x86NTS.zip
Size: 30.84 MiB SHA256: de135a1dec0cca14d47865c957cf6dc40286a7859704488e153042b500387776
Thread-Safe Builds
Thread-Safe (TS) builds are multi-thread PHP builds, often used to integrate PHP as a Server API for multithreaded servers. The most common use case is using PHP as an Apache module.
php-8.5.10-x64TS.zip
Size: 34.49 MiB SHA256: a6bc8b2f3d7bfb397ccb973db2f959e61e530e0986c9cea262dd4a317ec599d8
php-8.5.10-x86TS.zip
Size: 30.89 MiB SHA256: e6a2ab0fd73f83996ba1bb0b7520aec2c0455786682a16300f6f1e6f87fe7a39

ChangeLog

Core

  • Fixed bug GH-22782 (Const expr FCC crashes under preloading).
  • Fixed bug GH-23088 (Stack overflow when comparing deeply nested arrays).

Date

  • Fixed leak on double DatePeriod::__construct() call.

DOM

  • Fixed bug GH-23116 (Stack overflow when normalizing a deeply nested DOMDocument).
  • Fixed bug GH-23117 (Stack overflow when normalizing a deeply nested Dom\XMLDocument).
  • Fixed bug GH-22825 (DOMElement::setAttribute() fails silently when the DTD declares a default value for the attribute).
  • Fixed bug GH-23120 (Stack overflow when comparing deeply nested DOM nodes with DOMNode::isEqualNode()).

Exif

  • Fixed exif_read_data() allocating a HEIF meta box larger than the file it came from.

Intl

  • Fixed IntlListFormatter::__construct() leaving stale global error state after successful calls.

Opcache

  • Fixed GH-22693 (DT_TEXTREL in JIT-generated TLS access on x86_64).
  • Fixed bug GH-22763 (JIT fails to clear ZREG_TYPE_ONLY after setting reg).
  • Fixed bug GH-22857 (Function JIT emits wrong code for FETCH_OBJ_FUNC_ARG on a property hook getter, losing register-held variables).
  • Fixed bug GH-22916 (Preserve parent regs in zend_jit_deoptimizer_start()).

OpenSSL

  • Fix missing error check on invalid alpn protocols.

MBString

  • Fixed bug GH-22779 (mb_strrpos() returns the wrong position for a negative offset in a non-UTF-8 encoding).
  • Fixed bug GH-21036 (mb_ereg_search_getregs() crashes after mb_eregi() invalidates the regex cache).

PCRE

  • Fixed bug GH-21134 (Crash with \C + UTF-8). Using \C in UTF-8 patterns is now forbidden.

PDO_ODBC

  • Fixed bug GH-23016 (NULL values in long columns come back as garbage binary strings).

PDO_PGSQL

  • Fixed several lazy fetch (PDO::ATTR_PREFETCH => 0) defects: an infinite loop when cleaning up a fetch left in a COPY, a use-after-free when a statement with emulated or disabled prepares is destroyed, a connection left busy for the next fetch, and rows delivered from a result another statement took over.

Reflection

  • Fixed bug GH-22905 (Reflection exception messages truncate on null bytes).
  • Fixed ReflectionProperty::isLazy() and skipLazyInitialization() using the parent slot when a child class hooks an inherited property.
  • Fixed segfault in ReflectionMethod::createFromMethodName() on an uninstantiable subclass.

Session

  • Fix corruption in mod_mm.
  • Fixed bug GH-23043 (broken session id code can cause zend_mm_heap corrupted).

SimpleXML

  • Fixed integer element offsets that cannot resolve aliasing an existing element.
  • Fixed segfault when comparing uninitialized SimpleXMLElement instances.

Sockets

  • Fixed socket_set_option() validation error messages for UDP_SEGMENT and SO_LINGER options.
  • Fixed various memory related issues in ext/sockets.

SQLite

  • Fix leak when trying to close db if blob stream is still open.

Standard

  • Fixed bug GH-23111 (Stack overflow in array_walk_recursive() with deeply nested arrays).
  • Fixed bug GH-23113 (Stack overflow in array_replace_recursive() with deeply nested arrays).
  • Fixed bug GH-23115 (Stack overflow in compact() with deeply nested arrays).

Streams

  • Fixed bug GH-15836 (Use-after-free when a user stream filter accesses $this->stream during the close flush).

XSL

  • Fixed use-after-free when a DOMDocument subclass __clone() retains the stylesheet copy made by XSLTProcessor::importStylesheet().

Commit List

Arnaud Le Blanc

  • CI: Enable JIT testing on Apple Silicon ZTS 8.6+ in fa47ae16a1
  • zend_jit_resolve_tsrm_ls_cache_offsets: clobber volatile registers in GH-22832
  • Clear ZREG_TYPE_ONLY flag for in-register vars in zend_jit_snapshot_handler() in GH-22764
  • Fix const expr support in preloading in GH-22783
  • Forbid \C in UTF-8 patterns in GH-21139
  • CS in 40c3e247f9
  • JIT: Preserve parent regs in zend_jit_deoptimizer_start() in GH-22916

Calvin Buckley

  • odbc: Quote spaces in UID/PWD appended to connection string in GH-22791
  • TSRM: don't use initial-exec on AIX in GH-23145

coderZhao

  • Fix GH-22857: Function JIT emits wrong code for FETCH_OBJ_FUNC_ARG on a property hook in GH-22897

Daniel Scherzer

David Carlier

  • ext/sockets: memory related issues fix in 754ea6e14e
  • ext/opcache: zend_jit_resolve_tsrm_ls_cache_offsets() TEXTREL from bare __tls_get_addr call in 19af2e43f3
  • ext/dom: fix UAF when setting an attribute colliding by local name in 3221a076f2
  • ext/sysvshm: do not trust $size when opening an existing segment in f0d244ab3e
  • ext/libxml: Fix build failure with libxml2 2.15 in bc7537dbf0
  • ext/zip: addGlob() and addPattern() ignore their default options in 8d5b0d6fb4

Eyüp Can Akman

Ilia Alshanetsky

  • Fix pdo_odbc output-buffer leak and stale-binding out-of-bounds read in bdcf9ceee3
  • ext/filter: fix use-after-free in parse_str() with filter.default in 0549c8e054
  • ext/soap: fix NULL deref on malformed HTTP status line in 1c4bf04783
  • ext/standard: fix out-of-bounds access in the ftp:// directory stream in b750803b76
  • ext/odbc: do not mutate the caller's DSN string in f9b6254375
  • ext/sockets: bound interface name copy in from_zval_write_ifindex() in 009a0c276d
  • ext/ftp: apply the connect timeout ceiling to the remaining entry points in c1773a1da2
  • ext/standard: reject a dechunk chunk size that overflows size_t in 04f3d282f8
  • Fix GH-22825: DOM attribute methods on a DTD default attribute in 145e8c26d4
  • ext/filter: encode 0xFF in FILTER_SANITIZE_ENCODED in 56149186d8
  • Regenerate the expired ext/ftp/tests/cert.pem in GH-22873
  • Guard var_dump()/debug_zval_dump() against native stack overflow in 889ae478bd
  • Don't expose a freed stream resource to user filters in 3db0487860
  • Fix OOB read in opcache POSIX largepage page-size selection in 68d605fa92
  • Free the hooked property value when json_encode() sees an exception in c35253d364
  • Free previous state when re-calling Reflection*::__construct() in 87f8d17426
  • Parse qualified reflection names with a length-aware search in 3a9d86a81b
  • Avoid truncation on null bytes in class and function names in 841fe26c11
  • Check object_init_ex() in ReflectionMethod::createFromMethodName() in b80ef095ea
  • Resolve the effective property in ReflectionProperty lazy APIs in ae42ecf1f3
  • ext/sysvshm: don't orphan the segment shm_attach() just created in a72e0636fe
  • Fix GH-23016: pdo_odbc returns garbage for NULL long columns in 05202568c4
  • Fix SimpleXML integer offsets that cannot resolve aliasing a node in 9e696413e8
  • Fix segfault comparing uninitialized SimpleXMLElement instances in 7b1f5637b6
  • Fix use-after-free when __clone() retains the stylesheet copy in 11047a7a66
  • Bound the HEIF meta box allocation by the file size in 82ac0da470

Ilija Tovilo

Jakub Zelenka

lazerg

Lazizbek Ergashev

  • Fix GH-22206: Enable the TAILCALL VM only on Clang in GH-23054
  • Add a stack limit check in zend_hash_compare() in GH-23090
  • Add a stack limit check in php_array_walk() in GH-23125
  • Add a stack limit check in php_array_replace_recursive in GH-23124
  • Add a stack limit check in php_compact_var() in GH-23126
  • Add a stack limit check in php_count_recursive() in GH-23197
  • Fix GH-23204: use-after-free when __toString() destroys an array argument in 8ce7f7f5e9

Matthias Goergens

  • Fix mbregex search state after cache invalidation in da4b676047
  • Fix mbregex search state after cache invalidation in efd178b1b6

ndossche

  • sqlite3: Fix leak when trying to close db if blob stream is still open in eaac0378e3
  • session: fix corruption in mod_mm in a033601273
  • Fix GH-23043: broken session id code can cause zend_mm_heap corrupted in 9366c61247

NickSdot

  • CI: Select Windows test workers automatically in GH-22946
  • perf: speed up benchmark checkout in GH-23211

Nora Dossche

  • openssl: Check return value of SSL_CTX_set_alpn_protos() in GH-22996

Recep A.

  • Fix out-of-bounds write in ext-bcmath bccomp() via bc_str2num() in 4f83876af7

Shivam Mathur

Sjoerd Langkemper

  • Fix leak when cURL PREREQFUNCTION returns a type other than int in GH-22726
  • ext/curl: fix mem leak when duphandle fails in curl_clone_obj in GH-22899

tekimen

  • Update ext/mbstring/tests/gh21036.phpt in f699538427
  • Update ext/mbstring/tests/gh21036.phpt in 0d9b381beb

Weilin Du

  • ext/sockets: Fix socket_set_option() validation error messages in GH-22772
  • Fix GH-22935: Make php_hash.h includable from C++ code in GH-22940
  • ext/intl: Reset IntlListFormatter error state in constructor in GH-22931
  • Fix GH-23120: DOMNode::isEqualNode stack overflow on deeply nested trees in GH-23140

武田 憲太郎

  • ext/pdo_pgsql: Fix several lazy fetch defects in 0b91828b01
Subscribe to PHP.Watch newsletter for monthly updates

You will receive an email on last Wednesday of every month and on major PHP releases with new articles related to PHP, upcoming changes, new features and what's changing in the language. No marketing emails, no selling of your contacts, no click-tracking, and one-click instant unsubscribe from any email you receive.