PHP 8.5.9: Downloads, Changelog, News

Release Information

Release
8.5.9
PHP Version
PHP 8.5
Release Date
Release Type
Security Update
Release Status
Latest
Branch Status
Supported (Latest)

Latest PHP release in the latest version. This release contains security fixes, and it is recommended to update as soon as possible.
PHP 8.5 continues to receive bug fixes and security fixes until 2027-12-31.

Downloads

Source Code

Git Clone
Use Git to clone the 8.5.9 tag from the PHP Git repository.
git clone https://github.com/php/php-src.git --depth 1 --branch php-8.5.9
How to compile PHP
PHP can be compiled by setting up the dependencies, building the configure script (./buildconf), configuring the build ./configure, and running make.
Detailed articles on how to compile PHP are available for Ubuntu/Debian based systems and Fedora/RHEL based systems.

Windows binaries
Non-Thread Safe Builds
Non-Thread Safe (NTS) builds are single-threaded PHP builds. They can be used on web servers that integrate PHP over FastCGI protocol, such as Nginx, Caddy, and IIS.
php-8.5.9-x64NTS.zip
Size: 34.35 MiB SHA256: 516c2d72231bd035c8a910120834add0ad208098b790b4909b2cbeb93ce135fc
php-8.5.9-x86NTS.zip
Size: 30.83 MiB SHA256: 702494c2b573aff8ab364d667a9c8897dd96a498a78aacbd33442bcf19b1e7dc
Thread-Safe Builds
Thread-Safe (TS) builds are multi-thread PHP builds, often used to integrate PHP as a Server API for multithreaded servers. The most common use case is using PHP as an Apache module.
php-8.5.9-x64TS.zip
Size: 34.48 MiB SHA256: 6a8af9f5d2a35b81cd9f1db04bd4037c3609828db62f81589e29e13faffd45f9
php-8.5.9-x86TS.zip
Size: 30.88 MiB SHA256: a87b6475fbbdd6c12c74cfb3c8095032f324d6813604cbbbb236cac3f5bc4171

Docker/Podman Containers

PHP CLI
PHP CLI Containers images only include the PHP CLI, and no FPM or Apache modules. The Alpine builds are lightweight, but may introduce incompatibilities due to their musl builds. Albeit their larger size, the Debian-based (without the "-alpine" suffix) images are more complete, and widely used.

Alpine-based: Lightweight, but may introduce incompatibilities due to their musl builds.
docker pull php:8.5.9-cli-alpine

Debian-based: More compatible with other components, complete, and are widely used.
docker pull php:8.5.9-cli
PHP CLI + Web Server Integration
These container images include PHP CLI, and a web server integration. FPM container images can be integrated with web servers such as Nginx, Caddy, and Apache with Event MPM. The Apache container images include Apache web server, integrating PHP as an Apache module.

Alpine-based: Lightweight, but may introduce incompatibilities due to their musl builds.
docker pull php:8.5.9-fpm-alpine

Debian-based ZTS Apache: Includes Apache web server integrating PHP as an Apache module.
docker pull php:8.5.9-apache

Debian-based NTS FPM: PHP-FPM, can be integrated with Nginx, Caddy, and other web servers over Fast CGI.
docker pull php:8.5.9-fpm

ChangeLog

Core

  • Fixed bug GH-22290 (AST pretty printing does not correctly handle strings containing NUL).
  • Fixed bug GH-22206 (missing return in global register detection).
  • Lock unmodified readonly properties for modification after clone-with.

BCMath

Calendar

  • Fixed bug GH-22602 (gregoriantojd() and juliantojd() integer overflow with INT_MAX year).

Date

  • Update timelib to 2022.17.
  • Fixed bug GH-19803 (Parsing a string with a single white space does create an error).
  • Fixed Unix timestamps in February of the year 0 are misparsed with @-notation.
  • Fixed bug GH-11310 (__debugInfo does nothing on userland classes extending Date classes).

DBA

  • Fixed OOB read on malformed length field in dba flatfile handler.

DOM

  • Fixed bug GH-22570 (Stack overflow when serializing a deeply nested Dom\XMLDocument).
  • Fixed getElementsByClassName() item() returning the wrong element on random access.

Exif

  • Fixed bug GH-11020 (exif_read_data() emits a spurious "Illegal IFD size" warning when an IFD is not followed by a next-IFD offset).

GD

Hash

  • Fixed bug GH-18173 (ext/hash relies on implementation-defined malloc alignment).

ODBC

  • Fixed bug GH-22668 (Heap buffer over-read when a column value exceeds the driver-reported display size).

Opcache

  • Fixed bug GH-22158 (Tracing JIT dispatches the observer begin handler through the wrong run_time_cache slot on megamorphic calls).
  • Fixed bug GH-22443 (Tracing JIT SIGSEGV on megamorphic dynamic calls from an undereferenced run_time_cache map_ptr offset).
  • Fixed bug GH-21770 (Infinite recursion in property hook getter in opcache preloaded trait).

OpenSSL

  • Fixed timeout for supplemental read at end of a blocking stream in SSL stream wrapper.

Intl

  • Fixed Locale::lookup() and locale_lookup() to return NULL instead of the fallback locale when a language tag cannot be canonicalized.
  • Fixed memory leaks when calling Collator::__construct() or Spoofchecker::__construct() twice.
  • Fixed memory leak when calling IntlListFormatter::__construct() twice.
  • Fixed IntlChar methods leaving stale global error state after successful calls.

PDO_ODBC

  • Fixed bug GH-20726 (Crash with ODBC connection pooling when the DSN carries no credentials).
  • Fixed bug GH-22667 (Heap buffer over-read when a column value exceeds the driver-reported display size).
  • Fixed bug GH-22666 (Heap buffer overflow when an output parameter value is longer than the declared maxlen).
  • Fixed bug GH-22665 (Out-of-bounds write when the ODBC driver reports a diagnostic message length beyond the error buffer).

PGSQL

Phar

  • Fixed inconsistent handling of the magic ".phar" directory. Paths such as "/.phar" remain protected, while non-magic paths that merely start with ".phar" are handled consistently across file and directory creation, copying, ArrayAccess, stream lookup, directory iteration and extraction.
  • Fixed GHSA-vc5h-9ppw-p5f3 (Crash via recursive symlinks). (CVE-2026-7260)

PHPDBG

  • Fixed bug GH-17387 (Trivial crash in phpdbg lexer).
  • Fixed fleaked lowercased lookup keys in phpdbg_resolve_opline_break.
  • Fixed off-by-one in phpdbg_safe_class_lookup() causing class lookups to always fail during phpdbg's signal-safe interruption path.

Reflection

  • Fixed bug GH-22324 (Ignore leading namespace separator in ReflectionParameter::__construct()).
  • Fixed bug GH-22441 (ReflectionClass::hasProperty() and getProperty() ignore dynamic properties shadowing a private parent property).
  • Fixed bug GH-22658 (ReflectionConstant::__toString() with a string value with null bytes truncates output).
  • Fixed bug GH-22683 (Reflection(Class)Constant::__toString() should not warn on NAN conversions).
  • Fixed bug GH-22681 (Reflection*::__toString() truncates on null bytes).

Session

  • Fixed bug GH-21314 (Different session garbage collector behavior between PHP 8.3 and PHP 8.5).

SPL

  • Fix class_parents for classes with leading slash in non-autoload mode.
  • Ignore leading back-slash in class_parents(), class_implements(), and class_uses().
  • Fixed bug GH-16217 (SplFileObject::fputcsv() on an uninitialized object segfaults).

Standard

  • Fixed bug GH-22395 (base_convert() outputs at most 64 characters).
  • Fixed bug GH-22678 (Use-after-free in array_multisort() when the comparator mutates the array being sorted).

URI

  • Fixed behavior of Uri\WhatWg\Url wither methods with regards to empty opaque hosts.
  • Fixed bug GH-22628 (Percent-encoding of caret in WHATWG URL paths is not performed).
  • Fixed bug GH-22629 (WHATWG Validation error incorrect with empty host and non-empty userinfo).

Zip

  • Fixed bug GH-22649 (ZipArchive::setCommentName() and setCommentIndex() could crash after overwriting an entry and resetting its inherited unchanged comment).
  • Fixed bug GH-21705 (ZipArchive::getFromIndex() ignores ZipArchive::FL_UNCHANGED for deleted entries).

Commit List

alhudz

  • ext/dba: fix oob read on malformed length field in dba flatfile handler in a9c7dfefbd

arshidkv12

  • ext/calendar: Fix integer overflow in GregorianToSdn() and JulianToJd() in GH-22604
  • ext/ldap: fix ldap_explode_dn result ordering in 7809f94b1f

Daniel Scherzer

David Carlier

  • Fix GH-22360: convert.base64-encode corruption on incremental flush in bd8a9bd3b1
  • ext/openssl: openssl_encrypt() zend mm heap overflow on AES-WRAP-PAD mode in cbc0489126
  • ext/soap: backport GH-22586 fix in cf2f699a6d
  • ext/standard: getimagesize()/getimagesizefromstring() overflow in f08491bf08
  • ext/dom: fix GH-22570 new test in 33d243c214
  • ext/dom: getElementsByClassName() item() returns wrong element on random access in 7f97b83976
  • GH-22617: avoid null byte truncation of persistent stream keys in df773093ef

Derick Rethans

  • Updated to version 2026.3 (2026c) in 29f8f56b1e
  • Update timelib to 2022.17, which has fixes for PHP bugs in d83851dae8
  • Fix GH-11310: __debugInfo does nothing on userland classes extending Date classes in GH-22655
  • Fixed __debugInfo() usage on PHP 8.5 and later for DatePeriod in GH-22677

Eyüp Can Akman

  • ext/exif: Fix GH-11020: spurious "Illegal IFD size" warning in exif_read_data() in 6317a472f4

Gina Peter Banyard

  • NEWS entries for recent SPL bug fixes in 6a323eb7a4

Ilia Alshanetsky

  • Remove stray printf() on invalid DSN version in pdo_dblib in 8e3ab80667
  • Fix buffer overflow converting @@IDENTITY in pdo_dblib lastInsertId in 1a5a81ca9f
  • zend_ast: Escape control bytes in exported string literals in f3cf2f4527
  • Fix leak of preserved input string with FILTER_THROW_ON_FAILURE in 235b9b5cc1
  • Fix MIME charset sniffing advancing by name length not value length in 98563c2d8e
  • Fix heap over-read seeding the long-column buffer in pdo_odbc in 91ea928c9b
  • Fix file descriptor leak when proc_open() descriptor setup fails in 100938b40b
  • ext/ftp: fix out-of-bounds read in ftp_get() ASCII CRLF translation in 35fde02e42
  • Fix leak of resolved address list in netsnmp_session_init() in 3704b9d3c9
  • Fix socket_sendmsg() sending wrong fd for Socket objects in SCM_RIGHTS in e463914fb2
  • Fix SOAP client failing to follow a scheme-less redirect Location in de39a14cc7
  • Fix GH-22158: JIT observer dispatch through wrong run_time_cache slot in 19f595fd9e
  • ext/gd: fix out-of-bounds write reading font header on short reads in df1250dc64
  • ext/com_dotnet: release the held IUnknown in com_get_active_object() in ca4561cda6
  • Throw on below-minimum opslimit/memlimit in sodium pwhash in df7fd97212
  • ext/ftp: fix off-by-one terminator write in ftp_readline() in 34a9a43904
  • pdo_pgsql: preserve the pending exception when a COPY row fails to convert in f0236f11ba
  • Fix session save-handler argv leak on recursive rejection in 087a08d970
  • Fix freeing uninitialized memory in LDAP sort control parsing in a15654ece0
  • Fix posix_getpwnam()/posix_getpwuid() crash on NULL passwd fields in 84d8342580
  • Fix int32_t overflow in intl_charFromString() capacity calculation in 4d70d745ab
  • ext/gd: pack imageloadfont short-read test in native byte order in 5af56148a2
  • Fix invalid Firebird isolation level proceeding with the connection in 06037f8b7b
  • Fix signed dbconvert() return stored into size_t in dblib lastInsertId in c94681937f
  • Fix posix_getgrnam()/posix_getgrgid() crash on NULL group name in be55be0a4d
  • soap: do not overwrite the parsed host on a protocol-relative redirect in 27c10ddce6
  • Guard uninitialized SplFileObject in fputcsv() and next() in 60d8e92ed4
  • Report dynamic property shadowing a private parent in Reflection in 86d78cc24f
  • JIT: Fix run_time_cache offset stored without map_ptr dereference in a0ddc2aa57
  • Fix int truncation of read length in shmop_read() in 64cf7b2dba
  • Fix use-after-free in Collator::sort() with a mutating comparator in 5fa74db18d
  • Fix use-after-free in RecursiveIteratorIterator on reentry in 1cbd3b9ba9
  • Fix use-after-free in XPath php:function argument nodes in f9821dd1dd
  • Fix use-after-free in RecursiveIteratorIterator on reentrant teardown in efbf47300b
  • Fix GH-17387: crash on unterminated quote in phpdbg lexer in 2e564a747c
  • Fix GH-18173: ext/hash relies on implementation-defined malloc alignment in 8da53b5d31
  • Fix GH-20726: crash in pdo_odbc with pooling and no credentials in GH-22512
  • Fix infinite recursion in property hook getter in opcache preloaded trait in d27da095b1
  • Fix GH-22570: stack overflow serializing a deeply nested Dom\XMLDocument in dd57694402
  • Fix GH-22678: array_multisort() use-after-free on mutating comparator in 1e9f56cdb4
  • Fix use-after-free on re-entrant ftp_close() during a transfer in 1feb20156b
  • Install the SQLite ODBC driver in CI in c3236b922d
  • Fix GH-22667: pdo_odbc heap over-read on oversized column value in 103c84ff4c
  • Fix GH-22668: odbc heap over-read on oversized column value in 8e4daeff7a
  • Fix GH-22666: pdo_odbc heap overflow on oversized output param in a7539ff834
  • Fix GH-22665: pdo_odbc OOB write on oversized diagnostic length in 345b88deeb

Ilija Tovilo

Jakub Zelenka

Jarne Clauw

  • Fixing memory leak in openssl_x509_parse when str_serial creation fails in GH-21751
  • Fixing memory leak in openssl_pkcs12_read when zout initialisation fails in GH-21752
  • Fixing memory leak in php_openssl_x509_fingerprint when getting mdtype with php_openssl_get_evp_md_by_name in GH-21965
  • Fixing memory leak in zif_openssl_seal and zif_openssl_open when fetching cipher with php_openssl_get_evp_cipher_by_name in GH-21967

Jorg Adam Sowa

  • ext/spl: fix class_parents for classes with leading slash in non-autoload mode in GH-22283
  • ext/spl: ignore leading namespace separator in spl_autoload() in GH-22323
  • phpdbg: Fix off-by-one in phpdbg_safe_class_lookup() signal-safe class lookup in GH-22593
  • CI: Revert timeout fix for Symfony community build in GH-22682

Jorg Sowa

  • Ignore leading namespace separator in ReflectionParameter::__construct() in 47f060ca33
  • ci: add 180-minute timeout to test-suite jobs in 98b86328b6
  • ext/session: fix GH-21314 (session GC behaviour is different since 8.4) in fe53521e92
  • phpdbg: fix leaked lowercased lookup keys in phpdbg_resolve_opline_break in b6938a25ee

Khaled Alam

  • Fix GH-22683: Reflection(Class)Constant::__toString() should not warn on NAN conversions in GH-22694

Michael Orlitzky

  • ext/sockets/tests/gh21161.phpt: skip if no ipv6 in GH-22403
  • ext/iconv/tests/bug76249.phpt: fallback for non-GNU iconv() in GH-22552
  • ext/iconv/tests/bug52211.phpt: use per-iconv charset names in GH-22543
  • ext/iconv/tests/eucjp2iso2022jp.phpt: skip for "unknown" iconv in ebbfb3c02b
  • ext/iconv/tests/iconv_mime_encode.phpt: skip for "unknown" iconv in 863263a775
  • ext/gd/tests/gh19{666,739}.phpt: skip for external libgd in b51f575ba1
  • Alpine CI: don't install gnu-libiconv-dev in a095c57f03

Máté Kocsis

  • Apply lexbor fix for empty hosts in GH-22485
  • Fix macOS compatibility of update-lexbor.sh in f40c8f2b98
  • ext/uri: Fix GH-22629 WHATWG validation error incorrect with empty host and non-empty userinfo in GH-22699
  • ext/uri: Fix GH-22628 Percent-encoding of caret in WHATWG URL paths is not performed in GH-22700

NickSdot

  • zend_objects: Readonly properties must be re-locked after clone-with in GH-22654

Nora Dossche

  • openssl: Use proper error propagation when X509_dup() fails in openssl_x509_read() in GH-21953
  • Fix NULL deref when enabling TLS fails and the peer name needs to be reset in fc0f25f286

P3p111n0

Peter Kokot

Recep A.

  • Fix out-of-bounds write in ext-bcmath bccomp() via bc_str2num() in ce2ec8a707

Tim Düsterhus

  • lexbor: Refresh patch files in GH-22517
  • lexbor: Run update_lexbor.sh (PHP 8.5) in cf308c858c

Volker Dusch

Weilin Du

  • ext/phar: Fix ZIP extra field length underflow in GH-22330
  • ext/intl: Fix Locale::lookup() fallback on invalid language tags in GH-22306
  • ext/intl: Fix Locale::lookup() test expectations in GH-22306
  • ext/intl: Fix double construction leaks in GH-22386
  • ext/intl: Fix Spoofchecker build after double construction change in GH-22386
  • ext/Intl: Fix IntlListFormatter double construction leak in GH-22394
  • Fix GH-22395: Avoid truncating base_convert() output at 64 characters in GH-22406
  • ext/phar: Fix .phar-prefixed non-magic directory handling in GH-22372
  • Fix GH-21705: ZipArchive::getFromIndex() ignores FL_UNCHANGED in GH-21706
  • Fix GH-22649: avoid ZipArchive comment reset crash in GH-22652

Xuyang Zhang

  • ext/intl: Reset IntlChar error state on method entry in GH-22500
Subscribe to PHP.Watch newsletter for monthly updates

You will receive an email on last Wednesday of every month and on major PHP releases with new articles related to PHP, upcoming changes, new features and what's changing in the language. No marketing emails, no selling of your contacts, no click-tracking, and one-click instant unsubscribe from any email you receive.