PHP 8.5.11: Downloads, Changelog, News

Release Information

Release
8.5.11
PHP Version
PHP 8.5
Release Date
Release Type
Security Update
Release Status
Latest
Branch Status
Supported (Latest)

Latest PHP release in the latest version. This release contains security fixes, and it is recommended to update as soon as possible.
PHP 8.5 continues to receive bug fixes and security fixes until 2027-12-31.

Downloads

Source Code

Git Clone
Use Git to clone the 8.5.11 tag from the PHP Git repository.
git clone https://github.com/php/php-src.git --depth 1 --branch php-8.5.11
How to compile PHP
PHP can be compiled by setting up the dependencies, building the configure script (./buildconf), configuring the build ./configure, and running make.
Detailed articles on how to compile PHP are available for Ubuntu/Debian based systems and Fedora/RHEL based systems.

Windows binaries
Non-Thread Safe Builds
Non-Thread Safe (NTS) builds are single-threaded PHP builds. They can be used on web servers that integrate PHP over FastCGI protocol, such as Nginx, Caddy, and IIS.
php-8.5.11-x64NTS.zip
Size: 34.38 MiB SHA256: 0ea96e0d2b9b737a6036f05cf4e95c49313faa6d0f27bd97edb2742503f0c043
php-8.5.11-x86NTS.zip
Size: 30.86 MiB SHA256: c51955ba7e3b4cf61db3d32091a721b1cdd0230ecebdad164098df215a4da6c5
Thread-Safe Builds
Thread-Safe (TS) builds are multi-thread PHP builds, often used to integrate PHP as a Server API for multithreaded servers. The most common use case is using PHP as an Apache module.
php-8.5.11-x64TS.zip
Size: 34.5 MiB SHA256: c83d5a1e0d760fb026ce695d8a70a73a4c81ac224b3e5c425406b23a7d53e1de
php-8.5.11-x86TS.zip
Size: 30.91 MiB SHA256: f137da9dc16de3b6c096ceb1071a54630655af4de2e64f1fbf578cc91ba5bf4d

ChangeLog

BCMath

  • Fixed out-of-bounds read in bc_is_zero_for_scale() when scale exceeds n_scale.

Core

  • Fixed out-of-bounds reads during automatic UTF-16/32 encoding detection.
  • Fixed bug GH-15375 (Nested "yield from" skips items after a valid() or next() call on the inner generator).
  • Fixed bug GH-23232 (lone namespace separator asks the autoloader for an empty class name).
  • Fixed bug GH-23301 (Nested "yield from" yields a value twice when the middle generator delegates again).

DOM

  • Fixed NamedNodeMap::getNamedItemNS() with an empty URI not matching the null namespace in spec-following mode.
  • Fixed stale getElementsByClassName() and other node list caches after className/classList writes and attribute removals.
  • Fixed a use-after-free when cloning a DOMNameSpaceNode after DOMDocument::xinclude().
  • Fixed a crash in DOMXPath when a php:function callback receives a nodeset and a later callback returns a node from another document.
  • Fixed bug GH-23331 (UAF when node_list_unlink() skips attribute children that still have a live wrapper).
  • Fixed a use-after-free when Dom\Element::setAttributeNS() replaces the value of an attribute whose child still has a live wrapper.

GD

  • Fixed imageaffinematrixget() and imageaffinematrixconcat() reporting the wrong argument in error messages.

FPM

Intl

  • Fixed grapheme_strpos() and grapheme_strrpos() with an empty needle returning UTF-16 offsets instead of grapheme offsets.
  • Fixed a memory leak when dumping IntlCalendar instances.
  • Fixed a memory leak when iterating IntlBreakIterator::getPartsIterator() results.
  • Fixed a double-free when IntlGregorianCalendar construction fails after the ICU constructor adopts the TimeZone.
  • Fixed bug GH-23094 (NumberFormatter parsing offsets use UTF-16 positions for UTF-8 strings).
  • Fixed Locale::parseLocale() reading past a trailing '-' or '_'.
  • Fixed grapheme_str_split() treating UBRK_DONE as a byte index.
  • Fixed a leak in Locale::getKeywords() when a keyword value cannot be read.
  • Fixed a use-after-free when IntlRuleBasedBreakIterator is constructed from compiled rules.

MBString

  • Fixed mb_ereg_replace() emitting a NUL or out-of-bounds bytes in the replacement when a \k<name> backref has no closing delimiter.

MySQLnd

ODBC

  • Fixed odbc_field_len(), odbc_field_scale() and odbc_field_type() returning uninitialized memory when SQLColAttribute fails.

Opcache

  • Fixed opcache.protect_memory race under ZTS.
  • Fixed a tracing JIT crash when compiling a side trace for a method of a class that could not be stored in the inheritance cache. (GH-21710)
  • Fixed a crash when the huge page SHM remap discarded mappings outside the reserved address range.

OpenSSL

PDO

  • Fixed a leak when a persistent connection failed a liveness check with no other live PDO handle.

PDO_PGSQL

  • Fixed PDO::CURSOR_SCROLL statements failing under lazy fetching (PDO::ATTR_PREFETCH => 0).

PDO Sqlite

  • Fixed bug GH-20214 (PDO::FETCH_DEFAULT unexpected behavior with PDOStatement::setFetchMode).

Phar

  • Fixed bug GH-23418 (Use-after-free when looking up mounted directories).
  • Fixed bug GH-23477 (Memory leak on duplicate native Phar manifest entries).
  • Fixed GHSA-j3wh-g957-2m85 (Integer overflow in phar_tar_number() allowing TAR archive entry injection). (CVE-2026-6103)

Readline

  • Fixed the interactive shell not waiting for the pager process to exit.

SOAP

  • Fixed WSDL cache corruption when a soap:header defines headerfaults.
  • Fixed stack overflow when parsing a WSDL with self-referential schema groups or attributeGroups.
  • Fixed GHSA-rgrp-mwpx-f6rm (Unbounded recursion in server-side cleanup_xml_node()). (CVE-2026-91765)
  • Fixed GHSA-cj93-vc83-wgqv (Integer overflow to buffer overflow in SOAP HTTP parsing). (CVE-2025-14181)

Standard

  • Fixed a segfault when a stream filter callback unsets StreamBucket::$data before re-attaching the bucket.
  • Fixed GHSA-7875-c8px-7q5f (Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header). (CVE-2026-93682)
  • Fixed read buffer compaction in php_stream_filter_flush().
  • Fixed bug GH-22410 (Incorrect float behavior with large numbers).
  • Fixed GH-23338 (fsockopen()/pfsockopen() ValueError reported wrong argument number for $timeout).
  • Fixed bug GH-23576 (Next index for array returned from array_keys() is wrong).
  • Fixed GHSA-88hq-2827-7pg6 (Out-of-bounds read in convert.* stream filters when line-break-chars contains NUL). (CVE-2026-92842)
  • Fixed GHSA-fpwc-w8rq-cr92 (Cross-origin credential leak in HTTP stream wrapper redirects). (CVE-2026-91766)

SimpleXML

  • Fixed writing to a dimension of the object returned by attributes() not creating the attribute.
  • Fixed child elements of the element returned by SimpleXMLElement::addChild() not being accessible by property name when namespaces are involved.

Windows

Zip

  • Fixed bug GH-17787 (ZipArchive stream stops reading early when the archive is freed while the stream is still open).
  • Fixed bug GH-23276 (ZipArchive subclass storing its own stream cannot be garbage collected).

SAPI

  • Fixed fuzzer targets failing to build in isolation.
  • Fixed returns uninitialized value on LiteSpeed lsapi SAPI

Commit List

Alexandre Daubois

arshidkv12

  • ext/standard Fix round() for large integral doubles in GH-22461

Benedikt Franke

  • Fix GH-23232: lone namespace separator asks the autoloader for an empty class name in GH-23233

ColumbusLabs

David Carlier

  • ext/zip: fix extractTo()/getFrom*() success on CRC-corrupted entries in 2a2b337392
  • ext/standard: array_merge_recursive() fix leak in 4c71b4e58e
  • ext/opcache: opcache.interned_strings_buffer per FPM pool crashed on restart in bfbae397a3
  • ext/zip: ZipArchive::getNameIndex() index truncated to int in 473a7e0451
  • ext/zip: php_zip_ops_stat() succeeds when the archive cannot be opened in 614afe7b09

Eyüp Can Akman

  • Fix GH-17787: ZipArchive stream truncates when the archive is freed in GH-22555

Florian Engelhardt

  • Fix OPcache memory protection race under ZTS in GH-23081

geeknik

  • Fix heap-buffer-overflow in convert stream filters with NUL in line-break-chars in 7c92673b81

Georgij Tsarin

  • Fix read buffer compaction in stream filter flush in GH-23439

Go Kudo

  • sapi/lsapi: fix returns uninitialized value in GH-23281

Ilia Alshanetsky

  • ext/session: check the created ID before validating it in 0df284a4fc
  • Fix GH-15375: nested "yield from" skips items after valid()/next() in 0ccff76763
  • Fix DOMNameSpaceNode clone UAF after xinclude in d09e5e2bc2
  • Fix DOMXPath crash wrapping a foreign node after a nodeset callback in fcdc4fbf85
  • Fix IntlGregorianCalendar double-free of an adopted TimeZone in GH-23321
  • Bound getSingletonPos before reading the next separator in GH-23350
  • Stop grapheme_str_split from using UBRK_DONE as a byte index in GH-23349
  • Fix GH-23331: UAF when an attribute child keeps a live wrapper in d19f248f8e
  • Fix UAF when setAttributeNS() frees a wrapped attribute child in 0dd7f31f15
  • Fix leak when persistent PDO liveness check fails in b782a27242
  • ext/session: report a rejected session cookie header in 0870487b62
  • JIT: persist the SHM op_array in trace exit_info in 7873640e08
  • Close the keyword UEnumeration on Locale::getKeywords failure in b2956e0bb3
  • [intl] fix leak when iterating IntlBreakIterator parts iterators in 7d6523170e
  • [http] Fix out-of-bounds read on empty Location header in 8196275133
  • [standard] Fix crash when filter callback unsets StreamBucket::$data in 47bebf87a0
  • Keep compiled RuleBasedBreakIterator rules alive for the iterator in 35b09eaead
  • [mysqlnd] Fix OK packet message length buffer over-read in 9e5cf96095
  • [SimpleXML] Fix creating new attributes via attributes() dimension write in fc7a6b9007
  • [mysqlnd] Fix result set field metadata length buffer over-read in 9c74d7d1bc
  • [intl] Fix leak of time zone wrapper in Calendar debug info in b7a85ee111
  • dom: invalidate node list caches on class attribute mutations in fbca6cb221
  • [SOAP] Fix WSDL cache corruption when header defines headerfaults in f09a81ddee
  • [DOM] Fix getNamedItemNS() with empty URI not matching null namespace in e832b5e3e7
  • Revert the mysqlnd wireprotocol length-encoded bounds checks in e318023a6b
  • [intl] Fix empty-needle grapheme_strpos offsets in 1adadf07e5
  • [mbstring] Fix mb_ereg_replace() emitting NUL/garbage for unterminated \k<name> in 509e27bae1
  • Clamp scale in bc_is_zero_for_scale to n_scale in 979c827cdc
  • soap: reject self-referential schema group and attributeGroup fix-up in 797e3ea975
  • odbc: check SQLColAttribute return codes in the field info functions in 0c2fc141fc
  • simplexml: fix addChild() namespace filter on the returned element in 8b13fcc13e

Ilija Tovilo

  • Fix enabling of opcache in community job for PHP <8.5 in 4fa25b04e7

Jakub Zelenka

Jordi Kroon

Jorg Sowa

  • Fix NULL pointer dereference in SessionHandler::create_sid() in d974c64303

Juliette

  • PHP 8.5 | UPGRADING: add missing finfo function in GH-23263

Lazizbek Ergashev

  • Fix GH-23301: nested "yield from" repeats a value after "yield from []" in GH-23302
  • sapi/cli: check php_cli_server_client_send_through() return value in 6748db3ff5
  • Fix GH-23457: imagebmp() is extremely slow when writing to a file in d7778413a2
  • Fix GH-23447: segfault when the SoapServer class fails to initialize in 8dafaf5da2
  • Fix GH-23444: ODBC_ATTR_ASSUME_UTF8 corrupts Unicode data outside Windows in GH-23445
  • ext/hash: Fix buffer overflow in hash_pbkdf2() with a large output length in 13f5c4bda2
  • Fix GH-23576: array_keys() on an empty array returns a non-zero next index in GH-23577
  • Fix GH-23453: bad free with a context engine ID longer than 32 bytes in 6f49c1f209

Levi Morrison

  • Fix memfd_create header inclusion in b02e38a4a8
  • Fix memfd_create config header inclusion in 1c298565a6
  • Fix JUnit timing aggregation for long-running tests in GH-23438

Louis-Arnaud

  • Fix wrong argument number and UB in fsockopen timeout error in GH-23431

Michael Orlitzky

  • ext/gettext/tests: updates for musl-1.2.6 in 0f5b60ac70
  • ext/session: allow session.save_path to be nonempty in this test in e8c1e3a8b3

Mrmaxmeier

  • sapi/fuzzer: depend on PHP_BINARY_OBJS instead of PHP_SAPI_OBJS in GH-23394

Nora Dossche

Piotr Hałas

  • ext/opcache: keep huge page remap inside the reserved range in GH-23554

Pratik Bhujel

Saki Takamachi

Shivam Mathur

Volker Dusch

  • Keep EG(errors) buffer consistent on erealloc failure in GH-23257
  • Update versions for PHP 8.5.11 in 678778973b

Weilin Du

  • ext/readline: Fixed the interactive shell not waiting for the pager process to exit in GH-23047
  • ext/readline: Fix class constant completion in readline interactive shell in GH-23218
  • ext/snmp: Add XFAIL on several tests (#22476) in GH-23231
  • ext/zip: Fix AES-192 and AES-256 support reporting in phpinfo() in GH-23319
  • CI: fix flacky ext/mysqli/tests/protocol_stmt_row_fetch_data.phpt in GH-23330
  • ext/snmp: Put XFAILs under SKIPIF section in tests in GH-23237
  • ext/gd: Fix incorrect argument numbers in GD affine function errors in GH-23356
  • Fix GH-23276: Collect ZipArchive subclasses holding their own streams in GH-23282
  • Fix GH-23418: UAF when accessing mounted Phar subdirectories in GH-23442
  • Fix GH-23477: Memory leak on duplicate native Phar manifest entries in GH-23479
  • CI: Fix tests gh23444 on Windows in GH-23529

Yudai Takada

  • Fix bounds check in multibyte UTF detection in GH-23527

武田 憲太郎

  • ext/pdo_pgsql: Fix PDO::CURSOR_SCROLL statements failing under lazy fetching in 197bdc0a40
  • ext/pdo_pgsql: Fix CURSOR_SCROLL statements closing a nonexistent cursor in c1a7ab07ec
Subscribe to PHP.Watch newsletter for monthly updates

You will receive an email on last Wednesday of every month and on major PHP releases with new articles related to PHP, upcoming changes, new features and what's changing in the language. No marketing emails, no selling of your contacts, no click-tracking, and one-click instant unsubscribe from any email you receive.