PHP 8.5.4: Downloads, Changelog, News

Release Information

Release: 8.5.4
PHP Version: PHP 8.5
Release Date: 2026 Mar 12
Release Type: Bug Fix Release
Release Status: Latest
Branch Status: Supported (Latest)

Latest PHP release in the latest version.
PHP 8.5 continues to receive bug fixes and security fixes until 2027-12-31.

PHP can be compiled by setting up the dependencies, building the configure script (./buildconf), configuring the build ./configure, and running make.
Detailed articles on how to compile PHP are available for Ubuntu/Debian based systems and Fedora/RHEL based systems.

Windows binaries

Non-Thread Safe Builds

Non-Thread Safe (NTS) builds are single-threaded PHP builds. They can be used on web servers that integrate PHP over FastCGI protocol, such as Nginx, Caddy, and IIS.

php-8.5.4-x64NTS.zip

SHA256: 42ac025dbcbd0692d8cf873590653534c5e6b96fedc0a51adb9db6d8a95a977a

php-8.5.4-x86NTS.zip

SHA256: bf22aa14accdfd92ab701a9e22c0a0300e515d1a0f936c652cb2efcf29ff4d65

Thread-Safe Builds

Thread-Safe (TS) builds are multi-thread PHP builds, often used to integrate PHP as a Server API for multithreaded servers. The most common use case is using PHP as an Apache module.

php-8.5.4-x64TS.zip

Size: 0 MiB SHA256: 4fdf52526a892aaa9c99a4f32ad4b4e18c400134b4a414941f97121a0925d8a3

php-8.5.4-x86TS.zip

Size: 0 MiB SHA256: 760557d90e12bdb8fd67ddf43f318efb10082c4624ca0e6345fa86974bbdf444

Docker/Podman Containers

PHP CLI

PHP CLI Containers images only include the PHP CLI, and no FPM or Apache modules. The Alpine builds are lightweight, but may introduce incompatibilities due to their musl builds. Albeit their larger size, the Debian-based (without the "-alpine" suffix) images are more complete, and widely used.

Alpine-based: Lightweight, but may introduce incompatibilities due to their musl builds.

docker pull php:8.5.4-cli-alpine

Debian-based: More compatible with other components, complete, and are widely used.

docker pull php:8.5.4-cli

PHP CLI + Web Server Integration

These container images include PHP CLI, and a web server integration. FPM container images can be integrated with web servers such as Nginx, Caddy, and Apache with Event MPM. The Apache container images include Apache web server, integrating PHP as an Apache module.

Alpine-based: Lightweight, but may introduce incompatibilities due to their musl builds.

docker pull php:8.5.4-fpm-alpine

Debian-based ZTS Apache: Includes Apache web server integrating PHP as an Apache module.

docker pull php:8.5.4-apache

Debian-based NTS FPM: PHP-FPM, can be integrated with Nginx, Caddy, and other web servers over Fast CGI.

docker pull php:8.5.4-fpm

ChangeLog

Core

Fixed bug GH-21029 (zend_mm_heap corrupted on Aarch64, LTO builds).
Fixed bug GH-21059 (Segfault when preloading constant AST closure).
Fixed bug GH-21072 (Crash on (unset) cast in constant expression).
Fix deprecation now showing when accessing null key of an array with JIT.
Fixed bug GH-20657 (Assertion failure in zend_lazy_object_get_info triggered by setRawValueWithoutLazyInitialization() and newLazyGhost()).
Fixed bug GH-20504 (Assertion failure in zend_get_property_guard when accessing properties on Reflection LazyProxy via isset()).
Fixed OSS-Fuzz #478009707 (Borked assign-op/inc/dec on untyped hooked property backing value).
Fixed bug GH-21215 (Build fails with -std=).
Fixed bug GH-13674 (Build system installs libtool wrappers when using slibtool).

Curl

Don't truncate length.

Date

Fixed bug GH-20936 (DatePeriod::__set_state() cannot handle null start).
Fix timezone offset with seconds losing precision.

DOM

Fixed bug GH-21077 (Accessing Dom\Node::baseURI can throw TypeError).
Fixed bug GH-21097 (Accessing Dom\Node properties can can throw TypeError).

LDAP

Fixed bug GH-21262 (ldap_modify() too strict controls argument validation makes it impossible to unset attribute).

MBString

Fixed bug GH-21223; mb_guess_encoding no longer crashes when passed huge list of candidate encodings (with 200,000+ entries).

Opcache

Fixed bug GH-20718 ("Insufficient shared memory" when using JIT on Solaris).
Fixed bug GH-21227 (Borked SCCP of array containing partial object).

OpenSSL

Fix a bunch of leaks and error propagation.

Windows

Fixed compilation with clang (missing intrin.h include).

Commit List

Alexandre Daubois

Core: fix missing deprecation when accessing null array key with JIT in GH-20883

Arnaud Le Blanc

Add missing clobbered registers in 93d32eae27
Mark object non-lazy before deleting info in zend_lazy_object_realize() in 6d6d013d79
Real instance of lazy proxy may have less magic methods in de26827275
Fix build with -std= in ede7c67389

arshidkv12

Fix crash on (unset) cast in constant expression in e9ae040629

Ayesh Karunaratne

NEWS: fix minor formatting [skip-ci] in 9c615fb06b

Calvin Buckley

Fix regression with header removal removing whole prefixes in GH-21020

Daniel Scherzer

Update versions for PHP 8.5.4 in e5e09d06c1

David Carlier

Fix GH-21023: CURLOPT_XFERINFOFUNCTION with invalid callback crash in b156471a30
Fix GH-21161: socket_set_option() crash with array 'addr' entry as null in 19ee3e6697
Fix GH-21162: pg_connect() on error memory leak in 539c5d9f76
ext/sockets: socket_sendto() add max addr length control for AF_UNIX in b6495c189a
ext/pgsql: fix GH-21165 unit test in f7af877cfe
ext/pcntl: fix pcntl_setns() error handling in e2a5909ba3
ext/pcntl: Fix cpuset leak in pcntl_setcpuaffinity on out-of-range CPU ID in 37ce67f276
ext/pcntl: Fix signal table updated before php_signal4 succeeds in pcntl_signal in 6a1bde5d38
Fix GH-21262: ldap_modify() too strict controls argument validation in aa44392dfc
ext/pcntl: fix pcntl_signal_dispatch() stale tail pointer and exception handling in 296fad10fb

Dmitry Stogov

Update IR in GH-21183

Giovanni Giacobbi

gen_stub: Fix compatibility with php 7.4 (in PHP-8.4) in GH-21076
gen_stub: Fix compatibility with php 7.4 (in PHP-8.5+) in GH-21075

Ilija Tovilo

Fix segfault when preloading constant AST closure in 2f2b421a48
Tweak zend.max_allowed_stack_size for gh20836_stack_limit.phpt in 1f57d04648
Make brew verbose, limit to 10 minutes in 8b47ae8342
Fix assign-op/inc/dec on untyped hooked property backing value in 3cb85cc681
Fix OSS-Fuzz #478009707 for JIT in bbde9c8178
Disable pkg cache for FreeBSD jobs in 10aadd635b
Unify push & nightly workflows in f7b58d3938
Fix array_column() on null in nightly_matrix.php in 60718c7f43
Fix borked SCCP of array containing partial object in 1931472f22
Fix enabling of opcache in CI in 5150641f9a
Fix test action with no opcache in 2fd40628fc
Fix ccache in pecl job in a1de4ad543
Fix nightly job selection in cb4ea1d38a
Move benchmarking job to nightly in 436000755b
Rename nightly.yml to test-suite.yml in bcbc9c2f00
Rename push.yml to test.yml in dca6e5efd3
Combine push.yml and root.yml into test.yml in 12148a5b49
Improve displayed workflow_call name in cbb3ff0a5b
Adjust nightly-results.yml for test.yml in be96ae607d
Rename nightly_matrix.php to matrix.php in 37528afdad
Fix nightly ref name in 636fd3453b
[CI] Fix ineffective ccache in 7a4da1040b
Tweak stack limit values for gh20583.phpt in 3692a5fa57
Tweak stack limit values for gh20840.phpt in f07809f495
Fix ccache for coverage and pecl builds in c8cd3aeb1e
Fix coverage label job selection in ee40ca3fe2
Fix ccache for alpine and msan in 68d4ee357b
Fix benchmarking head sha in 46073db990

Jordi Kroon

replace alloca with do_alloca in mb_guess_encoding_for_strings in 37c5a13d67

Kévin Dunglas

Zend/zend_call_stack.h: fix missing include on Windows (clang compat) in GH-20847

Loïc Saos

Fix GH-21055: Pdo/Pgsql typo for GSS negotiation connection status attribute in 3037526810

Michael Orlitzky

sapi/*/Makefile.frag: install programs built with libtool, with libtool in db6cca26dd

ndossche

Fix merge for ext/sockets in b6ca14799d
Update EXTENSIONS to reflect reality in 84bfe2fadd
Fix memory leak in php_openssl_load_all_certs_from_file() when push fails in 4b9e80eae9
Fix memory leaks in php_array_to_X509_sk() when push fails in 01d598aea3
Fix missing error propagation when php_array_to_X509_sk() fails in ef54becb3e
Fix memory leaks in openssl_pkcs7_encrypt() when push fails in 556ec77951
Fix memory leaks in openssl_cms_encrypt() when push fails in f6887f04f6

Niels Dossche

Fix GH-21077: Accessing Dom\Node::baseURI can throw TypeError in d73b2f782e
Fix GH-21097: Accessing Dom\Node properties can can throw TypeError(s) in b8fc6bd1c8
Fix GH-20936: DatePeriod::__set_state() cannot handle null start in 7445b0f6d9
Fix timezone offset with seconds losing precision in ee26417b58
curl: Don't truncate length in e2059a4697

Petr Sumbera

Improve shared_alloc_shm.c strategy to support OPcache JIT on Solaris in 7c6f08945f

武田憲太郎

[CI] Use MySQL LTS version in 2a3e970d4c