PHP 8.5.12: Downloads, Changelog, News

Release Information

Release
8.5.12
PHP Version
PHP 8.5
Release Date
Release Type
Security Update
Release Status
Latest
Branch Status
Supported (Latest)

Latest PHP release in the latest version. This release contains security fixes, and it is recommended to update as soon as possible.
PHP 8.5 continues to receive bug fixes and security fixes until 2027-12-31.

Downloads

Source Code

Git Clone
Use Git to clone the 8.5.12 tag from the PHP Git repository.
git clone https://github.com/php/php-src.git --depth 1 --branch php-8.5.12
How to compile PHP
PHP can be compiled by setting up the dependencies, building the configure script (./buildconf), configuring the build ./configure, and running make.
Detailed articles on how to compile PHP are available for Ubuntu/Debian based systems and Fedora/RHEL based systems.

Windows binaries
Non-Thread Safe Builds
Non-Thread Safe (NTS) builds are single-threaded PHP builds. They can be used on web servers that integrate PHP over FastCGI protocol, such as Nginx, Caddy, and IIS.
php-8.5.12-x64NTS.zip
Size: 34.62 MiB SHA256: 2ab242af38d76bdf417cde5ec048b1bcd76a5a40f39a3d15d5f046f38571c477
php-8.5.12-x86NTS.zip
Size: 31.12 MiB SHA256: d631c38d8540fa06800ffe358de8704ba2a9565f5179e28b9266de647dc79ed0
Thread-Safe Builds
Thread-Safe (TS) builds are multi-thread PHP builds, often used to integrate PHP as a Server API for multithreaded servers. The most common use case is using PHP as an Apache module.
php-8.5.12-x64TS.zip
Size: 34.76 MiB SHA256: 660f3ff6ccbdf60f9607ef54bdba85ee22a58d61fd3633b38a93d57fb7c3d184
php-8.5.12-x86TS.zip
Size: 31.17 MiB SHA256: bb7b52a3af46b9ad80251b922812dec02c2c6bfb1e979858a15010f006ae6180

ChangeLog

Core

  • Fixed GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp (Avoid state corruption via bailout). (CVE-2026-109618, CVE-2026-109619)
  • Fixed bug GH-23644 (Optimizer leaves a constant-vs-constant comparison unfolded, crashing the VM in zval_undefined_cv).
  • Fixed OSS-Fuzz 532353396 (assertion failure with static type).
  • Fix GH-23662 (Avoid NAN warning in print_r()).
  • Fix GH-21999: GC inconsistency with lazy object, var_dump(), and object comparison.
  • Fixed OSS-Fuzz #536440507 (Immutable class incorrect assertion).
  • Fixed AVX being reported as supported when the OS has not enabled AVX state.
  • Fixed GH-23980 (ZEND_ASSERT violation @ ZEND_INCLUDE_OR_EVAL).
  • Fixed use-after-free when a dl()-loaded extension declares a frameless function and a later request calls it.
  • Fixed System V shared memory emulation for Windows attaching segments past the end of their mapping.
  • Fixed exception thrown by destructor during GC in a Fiber not being rethrown into the frame that triggered the GC.

BCMath

  • Fixed BcMath\Number results that truncate to zero keeping a negative sign and comparing less than zero.

BZ2

  • Fixed double close of the descriptor and use-after-free of the inner stream when bzopen() is given a stream resource.

CLI

  • Fix GH-22567 (Windows ZTS CLI SAPI should refresh its TSRMLS cache during request activation).
  • Fixed bug GH-23764 (Built-in server leaks a file descriptor on every HEAD request for a static file).
  • Fixed crash in the built-in server when a client is reset before being accepted.
  • Fixed the built-in server truncating an error page and leaking its unsent part after a partial socket write.

DOM

  • Fixed use-after-free when re-constructing a DOMXPath whose php:function registrations are freed while still reachable from the cycle collector.
  • Fixed Dom\HTMLDocument::getElementById() not finding ids of SVG and MathML elements.
  • Fixed Dom\HTMLDocument giving attributes the namespace of their element when a fragment is parsed with an xlink, xml or xmlns context element.
  • Fixed bug GH-23887 (Dom\HTMLCollection::namedItem() assertion failure, hang, or missed first element).
  • Fixed DOMXPath and Dom\XPath losing the context node and in-scope namespaces of an evaluation after a php:function() callback evaluated another expression on the same object.

FFI

  • Fixed crashes with FFI callbacks created from __call() trampolines and array callables whose object is released.

FTP

  • Fixed bug GH-23619 (cryptic error on servers that don't support TLS session resumption on data connection).

GD

  • Fixed undefined behavior with GD2 images with INT_MAX-sized chunks.
  • Fixed undefined behavior with GIFs with problematic LZW compression data.

Intl

  • Fixed cloning IntlDateFormatter and MessageFormatter losing PHP-side state such as dateType, timeType, calendar and the message pattern.
  • Fixed a crash when converting with a cloned UConverter that uses toUCallback/fromUCallback.
  • Fixed Collator attribute and strength methods not rejecting an unconstructed Collator.
  • Fixed crash in intl_error_set_custom_msg() without an active call frame.
  • Fixed grapheme_strstr() and grapheme_stristr() returning incorrect substrings when supplementary characters precede the match.
  • Fixed grapheme_strstr() and grapheme_strpos() missing canonically equivalent matches, and grapheme searches reporting ICU errors for empty haystacks.
  • Fixed grapheme_strrpos() and grapheme_strripos() skipping overlapping matches when using a negative offset.
  • Fixed IntlDateFormatter::parse(), localtime() and parseToCalendar() treating the offset as UTF-16 code units instead of bytes.

Lexbor

  • Merge patches lexbor/lexbor@8a14bc0 and lexbor/lexbor@f67ce4b, fixing a heap buffer overflow in :lexbor-contains() parsing and buffer overflows in malformed decode replay.
  • Merge patches lexbor/lexbor@859f100, lexbor/lexbor@a36e09a, lexbor/lexbor@b0f7412, lexbor/lexbor@1b215a8, lexbor/lexbor@385afff, lexbor/lexbor@e6c068f, lexbor/lexbor@327a8b6, lexbor/lexbor@917742f and lexbor/lexbor@e89c258, fixing dropped usernames containing an at sign, uninitialized memory in IDNA buffer growth, the encoding of a space before a query or fragment in an opaque path, a query or fragment lost after a dot segment in a path, replacement file drive paths, the output encoding used for percent-encoding, the URLSearchParams tail pointer and fragment serialization without a query.

MBString

  • Fixed bug GH-23106 (mb_strpos() reads past the end of a haystack ending in a truncated UTF-8 sequence).
  • Fixed mbstring functions emitting surrogates in UTF-8 output and flagging it as valid UTF-8.

MySQLi

  • Fix GH-22854: Fixed failed assertion when accessing mysqli property after failed reconnection.

MySQLnd

  • Fixed field_count not resetting on OK packet.
  • Fixed memory leak when closing a prepared statement after its connection was killed.

Opcache

  • Fixed OSS-Fuzz #546798343 (Heap-buffer-overflow in optimizer with FCCs and inlining).
  • Fixed bug GH-23693 (Tracing JIT produces wrong results for a guard on a loop-invariant addition).
  • Fixed OSS-Fuzz #5674034779193344 (Read of uninitialized memory in is_cacheable_stream_path()).
  • Fix zend_analyze_calls() call_stack buffer overrun.
  • Fixed bug GH-23628 (Tracing JIT reads undefined property slots of lazy proxy objects instead of forwarding to the real instance).
  • Fixed bug GH-23679 (Tracing JIT writes a parent private property into a child's shadowing public property).
  • Fix multiple incorrect DCE due to unsound escape analysis.
  • Fixed bug GH-24063 (OPcache optimizer folds $cond ? -0.0 : 0.0 into a single -0.0 constant).
  • Fixed crash when a file cache is reused with a different set of extensions declaring frameless functions.
  • Fixed bug GH-23991 (JIT generates invalid IR for multiple recursive calls).
  • Fix SCCP evaluation of isset()/empty() on dimension of non-escaping object.
  • Fixed bug GH-20890 (Segfault in zval_undefined_cv with non-simple property hook with minimal tracing JIT).

OpenSSL

  • Fixed stream_socket_enable_crypto() leaving the socket non-blocking after a handshake timeout.
  • Fixed feof() on a TLS stream staying false after a close_notify on Windows.

PCNTL

  • Fixed pcntl_signal_dispatch() dropping the queued signals when it runs while an exception is pending.
  • Fixed pcntl_signal_dispatch() dropping the signals queued behind a handler that throws.
  • Fixed bug GH-23986 (/proc/self paths resolve to the parent process after pcntl_fork()).

PDO

  • Fixed PDOStatement::getColumnMeta() reading out of bounds for an invalid column index.
  • Fixed PDOStatement::bindColumn() registering a binding for a column name that is not in the result set.
  • Fixed PDOStatement::execute() leaving the previous result available after a failed execution.
  • Fixed a use-after-free when bindValue()/execute()/closeCursor() is called from a bound parameter's __toString() during execute().
  • Fixed bug GH-23962 (Destroying a persistent PDO instance rolls back a transaction still in use by another instance).
  • Fixed PDO::setAttribute() installing a PDO::ATTR_STATEMENT_CLASS class whose constructor arguments it rejects.
  • Fixed PDO::ATTR_STATEMENT_CLASS constructor_args type errors reporting "array given" regardless of the value passed.
  • Fixed PDOStatement::bindParam() and bindColumn() leaking the driver options value.
  • Fixed PDOStatement not reporting its bound parameters and columns to the cycle collector.
  • Fixed PDOStatement::setFetchMode() not applying changes atomically.

PDO_DBLIB

  • Fixed bug GH-23741 (segfault after a failed query inside a PDO transaction). Errors raised by beginTransaction(), commit(), rollBack() and lastInsertId() are now reported instead of being dropped.

PDO_Firebird

  • Fixed bug GH-23758 (PDO_Firebird returns null for non-null empty BLOBs).

PGSQL

  • Fixed pg_lo_write() rejecting data containing null bytes.
  • Removed pg_service(), unavailable with any released libpq.

Readline

  • Fixed a heap over-read in the interactive shell prompt when cli.prompt is set to an empty string.

Reflection

  • Fixed bug GH-23842 (ReflectionProperty::skipLazyInitialization() copies invalid constant defaults with OPcache).

Session

  • Fixed session_start() continuing after a failed create_sid() when session.use_strict_mode rejects the supplied ID.
  • Fixed exceptions from user-defined create_sid() handlers being replaced by return-value validation errors.

SimpleXML

  • Fixed reconstructing a SimpleXMLElement freeing a child element that another variable still references.

SOAP

  • Fixed bug GH-22895 (Heap use-after-free while encoding a Traversable with an illegal key).
  • Fixed memory leak when load_wsdl_ex() failed to load.

SQLite

  • Fixed a crash when SQLite3::close() is called from a userland callback.

Standard

  • Fixed sha1_file() returning a digest for incomplete data after a stream read failure.
  • Fixed iptcembed() corrupting JPEG headers when called recursively from an output handler.
  • Fixed proc_open() leaking descriptor zero when descriptor setup fails.
  • Fixed three Windows-only proc_open() defects: an uninitialized PROCESS_INFORMATION, an indeterminate comspec pointer after a failed lookup, and an unchecked CreateFileA() failure.
  • Fix persistent stream context lifetime during shutdown
  • Fix wordwrap() ignoring an existing break at the end of the string
  • Fixed convert.quoted-printable-decode decoding lowercase hex digits to the wrong byte.
  • Fixed chown() and lchown() failing to resolve user names in ZTS builds when getpwnam_r() needs a larger buffer.

Tidy

  • Fixed a use-after-free when a tidyNode is used after its document is reparsed.

Zlib

  • Fixed inflate_init() dropping the preset dictionary for raw streams with a non-default window.

Commit List

Alexander Lisachenko

  • Fix GH-23628: Tracing JIT reads undefined property slots of lazy proxies and unset properties in GH-23640

Alexandre Daubois

Arnaud Le Blanc

  • Fix GH-21999: GC inconsistency after lazy object properties ht is added to roots in GH-22013
  • Avoid state corruption via bailout in 31c0ea7d7f

Calvin Buckley

  • ext/odbc: fix cond for SQL_NO_TOTAL that led to single byte buffer in GH-23462

Daniel Scherzer

  • ext/gd: fix undefined behavior with GD2 images with INT_MAX-sized chunks in b8c63871c8
  • NEWS in 2e5bb79a92
  • ext/gd: fix undefined behavior with GIFs with problematic LZW compression data in 2cea4a358d
  • NEWS in c8d62b8a0b
  • ext/soap: fix leak when load_wsdl_ex() fails to load in GH-24066
  • Update versions for PHP 8.5.12 in 136e049ac1

David Carlier

  • ext/zip: ZipArchive::extractTo() ignores files given in a non-list array in 214ed7eb93
  • Fix GH-23365: DOMNode::insertBefore() drops the node used as its own reference in a7bdb8b53d
  • ext/sockets: socket_select() silent set truncation on Windows in 2bca736479
  • ext/xsl: XSLTProcessor::importStylesheet() use-after-free during a transformation in b55c619356
  • ext/zip: ZipArchive::close() use-after-free from a progress or cancel callback in 132403de39
  • Fix GH-23729: DOMXPath::__construct() use-after-free during an evaluation in a74f826ff2
  • sapi/cli: Fix crash in the CLI server when a client is reset before being accepted in 83c59b8053
  • Fix GH-23897: php:function() assertion after failed registerPHPFunctions() in 6eb8d06b57
  • ext/intl: intl_error_set_custom_msg() crash without an active call frame in f61ebc0348
  • Fix GH-23637: opcache inheritance cache entry published too early in 873a997d70
  • ext/soap: to_xml_array() heap use-after-free with illegal iterator keys in d044f28b80
  • Fix GH-24050: gc_collect_white() frees data reachable from a resurrected object in 7b75d71ca3
  • ext/soap: fix use of uninitialized func in do_request() on OOM bailout in a0434fdc24
  • Fix GH-23352: DOMDocument::adoptNode() stale document references in d4235d7cf9

Derick Rethans

geeknik

  • Fix heap-buffer-overflow in convert stream filters with NUL in line-break-chars in b4e3397ec8

Georgij Tsarin

  • Fix sparse set allocation size overflow in GH-23482

Gina Peter Banyard

  • Zend: reorganise some type declarations tests in 6d910200db
  • Zend: fix OSS-Fuzz 532353396, static is a built-in type in 8d38af63ce

Ilia Alshanetsky

  • dom: clear the xpath callback registrations before freeing them in 21e2c56aa4
  • ext/intl: Preserve PHP-side state when cloning formatters in 0f20be3867
  • ext/pgsql: Restore binary-safe pg_lo_write() in c135a869c1
  • ext/intl: Resolve UConverter callbacks when the object is allocated in 2311816c9e
  • ext/pdo: Bound-check column index in getColumnMeta() in 4e26dd0f79
  • ext/sqlite3: reject close() from inside a callback in 7300fa520d
  • dom: fix attribute namespaces from foreign content in the HTML parser in 92b08946a3
  • Fix GHSA-ch8v-r6jh-4vvr: encode 0xFF in FILTER_SANITIZE_ENCODED in 7ac9700d0d
  • [http] Fix out-of-bounds read on empty Location header in 547566f17a
  • Fix heap over-read in cli_get_prompt() for empty cli.prompt in c2c01aea6c
  • Fix three Win32-only defects in proc_open descriptor handling in 8d0d6307aa
  • ext/zlib: honor preset dictionary for raw inflate with non-default window in fb76b3d715
  • Fix GH-23693: JIT guard branches on stale flags across basic blocks in 9c2acc343e
  • Zend: release the trampoline when zend_call_function() bails early in d19c413d48
  • ext/pdo: Do not register a bindColumn() binding for an unknown column in 3580bbd28b
  • ext/intl: Reject unconstructed Collator in attribute and strength methods in 630128392b
  • ext/session: Abort strict-mode re-creation when create_sid() fails in 4868dd4e02
  • ext/session: Preserve exceptions thrown by create_sid() in eacd1576ad
  • ext/opcache: Fix GH-23679 tracing JIT shadowed private writes in c06e7370ae
  • ext/ffi: Hold a reference to the callable of an FFI callback in ed60b9edeb
  • Zend: clear the AVX bit in ECX when the OS has not enabled AVX state in eb32f52f77
  • ext/openssl: Restore blocking mode after a handshake timeout in ae429f100b
  • ext/pdo: Keep statement class when ATTR_STATEMENT_CLASS is rejected in beee995c90
  • ext/pdo: Release driver options after bindParam and bindColumn in 22237f2c07
  • Fix GH-23741: pdo_dblib use-after-free of statement error state in 2dc6626007
  • ext/libxml: Keep SimpleXML children alive across reconstruction in efb8ad276d
  • ext/bcmath: Clear the sign of BcMath\Number results that truncate to zero in 8184e9efec
  • ext/tidy: Reject tidyNode use after the document is reparsed in 30ba0217d1
  • sapi/cli: Fix built-in server truncating responses after a partial write in 021acbe980
  • ext/pdo: Drop the previous result when execute() fails in 11690db178
  • Fix HashTable UAF when rebound from a parameter __toString() in 08a49a9225
  • Zend: Skip frameless registration for temporary modules in 75d77cb4fe
  • ext/pdo: Report bound params and columns to GC in 71e56ed7a9
  • ext/pdo: Make PDOStatement::setFetchMode() updates atomic in 357fcf12f4
  • ext/mysqlnd: Fix VIO plugin area getter in a1e5424af2
  • TSRM: Fix Windows shared memory payload offset in e50b8b05be
  • Zend: Restart the va_list per callback in zend_llist_apply_with_arguments() in fc3a76a603
  • Zend: Include frameless functions in the system id in 1bffb94a2f
  • ext/standard: Reject incomplete sha1_file reads in 808685f576
  • ext/standard: Keep IPTC headers local to each call in 0c4e3b6295
  • ext/standard: Close owned proc_open descriptors on setup failure in 81e0367dbc
  • ext/dom: Restore the XPath context after a reentrant evaluation in 523127fd54
  • ext/intl: Use byte offsets in IntlDateFormatter parsing in 913e01c159
  • ext/pdo: Return false from rewrite_name_to_position() on IM001 error in 073095ed8d
  • ext/standard: Fix convert.quoted-printable-decode of lowercase hex in 09c3e734b1
  • Fix alternate form flag for %x testing stale signed value in ee0f3c5315
  • ext/standard: Retry getpwnam_r() on ERANGE in php_get_uid_by_name() in f211ed307d

Ilija Tovilo

  • if out zend_class_constants_are_updated() in release builds in fa7734f43f

  • Skip result type inference verification for simple get in 3401483083
  • Re-generate outdated parse_date.c file in aaa870786c
  • Add NEWS entry in 3d37ab3b8e

Jakub Skopal

Jakub Zelenka

Jordi Kroon

jvoisin

  • Backport: reject XML handler changes while parsing in GH-23818
  • Backport: reject cURL callback changes from callbacks in GH-23814
  • Backport: fix integer overflow in to_xml_hexbin in GH-23771
  • Backport: fix integer overflow in mhash_keygen_s2k in GH-23770

Kamil Tekiela

  • Fix GH-22854 (Assertion failure at link_errno_read in ext/mysqli/mysqli_prop.c) in GH-20117
  • Reset field_count for OK packet in GH-23890
  • Fix memory leak when closing a statement on a killed connection in 9a3f37872b

lacatoire

  • ext/pcntl: fix an off by one bound and a parameter the parser made required in e23dc68f11

lazerg

Lazizbek Ergashev

Levi Morrison

  • Fix persistent stream context lifetime during shutdown in GH-23853

Manish Kafle

Marc

  • fix windows ci: w11 no longer treats names like NUL.txt as reserved in GH-23844

Marc Bennewitz

Matteo Beccati

Michael Orlitzky

  • sapi/cli/tests/php_cli_server_ipv6_error_message.phpt: use TEST_PHP_ vars in 17506567b9
  • ext/soap/tests/bugs/bug62900.phpt: make use of TEST_PHP_ vars in e216cf64f0
  • ext/curl/config.m4: include string.h for test using strncmp() in 54f94852bb

Mrmaxmeier

  • Fix call_stack buffer overflow in zend_analyze_calls() in 342a7465b3

ndossche

  • Fix OSS-Fuzz #546798343: Heap-buffer-overflow in zend_delete_call_instructions with callable conversion in 3213c3faa6
  • Fix GH-23619: ext/ftp: cryptic error on servers that don't support TLS session resumption on data connection in d841b499b8
  • Fix OSS-Fuzz #5674034779193344: Read of uninitialized memory in is_cacheable_stream_path() in c7ffb825aa
  • Fix OSS-Fuzz #536440507: Immutable class incorrect assertion in c4efd20931
  • Fix incorrect DCE due to unsound escape analysis in cba864da35
  • Fix __isset escape analysis causing misoptimization in f9639b562a
  • Fix property hook escape analysis causing misoptimization in 4bf483fa88
  • NEWS in 3b3f5dd120
  • Fix GH-23980: ZEND_ASSERT violation @ ZEND_INCLUDE_OR_EVAL (include/eval run with a pending exception) in e7b225697e
  • Fix soap test on 8.5+ in c22ce97310
  • Fix GH-23991: JIT generates invalid IR for multiple recursive calls in 6abb600217
  • Fix SCCP evaluation of isset()/empty() on dimension of non-escaping object in 423529d2b7
  • Fix merge in 58805f762c
  • Fix merge in d5eaaa881c

Nicolas Grekas

  • ext/pcntl: do not drop queued signals when an exception is pending in GH-23624
  • ext/mbstring: Don't emit surrogates when encoding to UTF-8 in 0cf8668eb2
  • Rethrow exceptions from destructors called by the GC in a fiber in GH-24118
  • Fix wordwrap() ignoring an existing break at the end of the string in GH-24116

Nora Dossche

Pratik Bhujel

Shivam Mathur

tianfenghan

  • Fix GH-22567 (Windows ZTS CLI SAPI should refresh its TSRMLS cache during request activation) in 4e64a2655e

Weilin Du

  • Zend: Fix iterator relocation at the current element during rehash in GH-23607
  • Revert Zend: Fix iterator relocation at the current element during rehash in 8.4 and 8.5 in 293f22e5ec
  • ext/curl: Preserve callback lifetime without rejecting callback changes in GH-23863
  • CI: Fix flacky ext\curl\tests`curl_setopt_ssl.phpt` in GH-23944
  • ext/intl: Fix grapheme_strstr() and grapheme_stristr() match offsets after supplementary characters in GH-24012
  • ext/intl: Fix grapheme_strstr() and grapheme_strpos() missing canonically equivalent matches in GH-24029
  • ext/intl: Fix overlapping grapheme matches with negative search offsets in GH-24028

武田 憲太郎

  • ext/pgsql: Removed pg_service(), unavailable with any released libpq in 43c6014670
Subscribe to PHP.Watch newsletter for monthly updates

You will receive an email on last Wednesday of every month and on major PHP releases with new articles related to PHP, upcoming changes, new features and what's changing in the language. No marketing emails, no selling of your contacts, no click-tracking, and one-click instant unsubscribe from any email you receive.