PHP 8.6.0RC5: Downloads, Changelog, News • PHP.Watch

Release Information

Release: 8.6.0RC5
PHP Version: PHP 8.6
Release Date: 2026 Nov 05
Release Type: Security Update
Release Status: QA Release Latest
Branch Status: Upcoming Release

PHP 8.6 is a development version, and is not recommended for production use. PHP 8.6 is scheduled to reach General Availability on 2026-11-19. This is the latest QA release in the series.

ChangeLog

Core

Fix function and constant imports in compile_to_ast and add support for grouping.
Fixed bug GH-24668 (zend_set_local_var() leaks the previous value of an existing CV).
Fixed unmapping of an unrelated range when the aligned chunk mmap fails
Fixed bug GH-25023 (ZEND_CONTAINER_OF() fails to compile with -std=c11).
Fixed bug GH-25007 (Partial function application: named args in a constant expression cause out-of-bounds write in zp_compile()).
Fixed AST printing dropping final on class constants and properties, and abstract on properties.
Fixed AST export of readonly anonymous classes dropping the readonly modifier.
Fixed memory leak of a duplicate named argument in new in initializer.
Fixed bug GH-25061 ($x = $x - 1 on null is optimized to PRE_DEC).
Fixed bug GH-23911 (Don't use static closure cache when called_scope diverges).
Fixed first-class callables to static methods in trait constant expressions resolving to the method of the first using class and bypassing visibility checks.

CLI

Fixed bug GH-24697 (PHP_HTTP_PARSER_STRICT build option doesn't work).
Fixed bug GH-9670 (List -C and -q in the CLI help).

COM

Fixed bug GH-25008 (com_event_sink() and com_print_typeinfo() crash resolving an event source with no loaded typelib).

Curl

Fix use-after-free of CURLOPT_STDERR stream on cloned curl handle.
Fix UAF on clone due to callback data pointer mismatch.

DBA

Fixed bug GH-24641 (ndbm backend never checks dbm_open() return value, NULL deref on first use after a failed open).

DOM

Fixed a use-after-free when reflected attribute setters replace an attribute whose child still has a live wrapper.
Fix error paths in dom_xml_serializing_a_document_node().

FFI

Fixed bug GH-24582 (Memory leaks in ext/ffi parser when finalize_type() bails out).

FPM

Fixed crash and stack memory disclosure in the worker output logging with a pool name longer than the message prefix buffer or log_limit.
Fixed bug GH-24046 (FPM worker stdio pipe fd closed twice when a child process outlives the worker, breaking a later worker's stdio).
Fixed memory leaks of the _GET string on the status page error and HEAD request paths.
Fixed use-after-free of the scoreboard copy when logging invalid status values.
Fixed null pointer dereference in fpm_get_status() when the scoreboard copy fails.

GD

Fixed imagetruecolortopalette() error message.

Hash

Fix GOST and Snefru digests of 512 MiB or more.

Intl

Fixed IntlDateFormatter parse functions truncating an $offset below INT_MIN.

JSON

Fixed json_encode() leaving the recursion guard set on objects with hooked properties after running out of memory while escaping a property name.
Fixed json_encode() silently narrowing $depth values outside the int range, which wrapped to an unrelated depth.
Fixed json_encode() continuing to encode after an array or object key failed to encode.

LDAP

Fix crash in ldap_exop_sync() when $response_data is omitted.

MBString

Fixed negative mbstring.regex_stack_limit and mbstring.regex_retry_limit on 32bit platforms.

MySQLnd

Fixed bug GH-24609 (OK packets without an info message rejected on x32 builds).

ODBC

Fixed bug GH-25036 (odbc_prepare() corrupts the heap when the driver cannot describe a parameter).

Opcache

Fixed bug GH-24397 (Assertion failure when dumping JIT IR).
Fixed tracing JIT returning a wrapped integer instead of a float on integer overflow after an integer was compared with a float or numeric-string literal.
Fixed use-after-free in JIT ASSIGN_DIM_OP when concatenating into an empty array element.
Fixed bug GH-24396 (Assertion failure in zend_jit_def_reg() "reg forwarding" with chained Pi nodes).
Fixed JIT treating an array as packed after a string key write turned it into a hash.
Fixed bug GH-24436 (Tracing JIT: keep the SEND_VAL type guard after assigning to a reference).
Fixed bug GH-24745 (File cache loses attributes on constants on 32-bit builds).
Fixed bug GH-17733 (System entropy does not take into account function order, resulting in wrong functions possibly called in different configurations).
Fixed bug GH-24438 (Preserve indirect types in JIT side traces).
Fixed bug GH-24577 (CE-cache flag on interned class name visible before map_ptr offset).
Fixed tracing JIT losing register-allocated CVs when an interrupt is handled at the end of a loop trace.
Fixed bug GH-24675 (function with >~1.7 MB of machine code corrupts JIT buffer accounting).
Call orig_post_shutdown_cb().
Fixed JIT segfault on switch over a string reference holding a non-string value.
Fixed AArch64 JIT encoding of invalid logical immediates.
Fixed JIT crashes when handling a VM interrupt with a stale saved opline in the tailcall VM.
Fixed function JIT misinterpreting VM-enter results after an interrupt callback in the CALL and TAILCALL VMs.
Fixed unsound shift_left_overflows range when shift wraps.
Fixed bug GH-23572 (Tracing JIT calls the wrong method for self::/parent:: static calls in trait methods shared by several classes).
Fix block pass dropping ZEND_FAST_CALL OP2 definition.
Fixed bug GH-23626 (orphaned temporaries cause leaks and assertions).
Fix preloaded functions JIT-compiled on load being overwritten after restart.
Fix opcache.interned_strings_buffer being 0 in threads started later (ZTS).
Fixed potential infinite recursion/hang (HYBRID/TAILCALL respectively) when zend_interrupt_function resets EG(vm_interrupt).
Fix JIT losing the called scope of self::/parent:: calls in included files.
Fixed preloaded functions not JIT-compiled again after OPcache restart.
Fixed bug GH-24988 (Incorrect opcode range check causes bugs with exceptions in function JIT).
Fix opcache phar check.

OpenSSL

Fixed build with OpenSSL 4.1.
Fixed bug GH-24784 (openssl_pkcs7_read() and openssl_cms_read() overwrite certificates with CRLs).
Fixed use-after-free in the TLS session remove callback when the listener stream is closed while a shared context is still in use.
Fixed heap buffer overflow in TLS PSK callbacks.

PDO_Firebird

Fixed bug GH-25006 (getColumnMeta() reads out of bounds for an out-of-range column index).

PDO_PGSQL

Fixed bug GH-24461 (DISCARD ALL on persistent connection cleanup drops PgBouncer's prepared statements).
Fixed a use-after-free when a persistent connection receives a notice after the request that called Pdo\Pgsql::setNoticeCallback() has ended.

PDO_SQLite

Fixed bug GH-24990 (Statement unusable after a failed execute()).

Phar

Fixed bug GH-25093 (Phar::webPhar() redirect reads past the request URI).
Fixed bug GH-25089 (Heap buffer over-read via crafted alias size in zip-based phar).
Fixed bug GH-8469 (Phar::decompressFiles() and Phar::compressFiles() retain compressed contents after changing compression).
Fixed bug GH-24740 (Oversized tar metadata exhausts the memory limit).
Fixed bug GH-25090 (UAF in phar rename() of an entry with metadata).
Fixed bug GH-25091 (UAF in phar rename() when source and destination are equal).
Fixed bug GH-25092 (Double free in Phar::copy() on link and mounted entries).
Fixed bug GH-24531 (Crash when modifying a zip-based phar whose file was renamed).
Fixed Phar::buildFromIterator() accepting a negative getMTime() on 32bit platforms.

Reflection

Fixed bug GH-21768 (Assertion failure in ReflectionProperty::isReadable() and isWritable() on internal virtual properties).

SAPI

Fixed infinite loop in sapi_header_op() for headers of 4 GiB or more.

Session

Validate whole session ID instead of stopping at the first NUL byte.

Sodium

Pass sodium_crypto_xof_*() state via objects instead of by-ref strings.

SPL

Fixed bug GH-24264 (Unwind/GracefulExit discarded in spl_iterators.c).

Sockets

Fixed bug GH-24748 (socket_set_option() crashes with declared object properties).

Standard

Fixed bug GH-25086 (Io\Poll kqueue backend leaks memory on every Watcher::modifyEvents() call).
Fixed Io\Poll WSAPoll backend accepting handles that are not sockets, which were then silently dropped by wait(). Adding them now fails with ERROR_NOSUPPORT.
Fixed memory leaks in checkdnsrr() and dns_check_record() on Windows.
Fixed __unserialize() and __wakeup() being called for objects with a missing closing brace.
Fixed bug GH-24308 (Request shutdown calls closelog() even when syslog was not opened by PHP).
Fixed bug GH-24552 (Case-insensitive substr_compare(), ksort() and krsort() are still locale-dependent).
Fix use-after-free in Randomizer::shuffleArray() when the engine throws.

Streams

Fixed bug GH-24506 (stream_select() leaks a stream-error operation level on its FD_SETSIZE failure path).
Fixed bug GH-24508 (HTTP wrapper leaks the dechunk filter when header parsing fails after Transfer-Encoding).
Fixed bug GH-24509 (HTTP wrapper leaks Location buffer on empty Location header).
Fix out-of-bounds reads parsing ftp:// wrapper server replies.

URI

Upgrade to uriparser 1.0.3. (CVE-2026-48841)

Windows

Fixed bug GH-25009 (GetConsoleTitleW() buffer size passed in bytes).
Fixed sapi_windows_cp_set() and sapi_windows_cp_conv() accepting a negative codepage on 32bit platforms.

Zip

Reject broken libzip versions 1.3.1, 1.7.0 and 1.12.0 during Windows configuration.
Excluded libzip 1.12.0 due to a regression preventing additions and replacements in torrentzip archives.

Zlib

Fixed bug GH-24533 (zlib.lib could not be found because zlib 1.3.2 CMake build does not emit it).

Commit List

aasim

Fix GH-24438: Preserve indirect types in JIT side traces in 061f0ce293

aasul

Add FPM test for INI diagnostics after fatal error with backtrace in GH-24638

Alejandro Pacheco

Fix out-of-bounds reads parsing ftp:// wrapper server replies in 7774891f16

Alessio Attilio

ext/intl: Adapt timezone test expectations for ICU 79.1 in 47d959923c
Backport: Adapt intl timezone test expectations for ICU 79.1 in GH-24684

Alexander Danilov

Fix GH-24784: Preserve certificates when reading PKCS7/CMS CRLs in GH-24785
Fix json_encode() reporting false "Recursion detected" after OOM for hooked-property objects in GH-24992

Alexandre Rulleau

Load DECLARE_LAMBDA_FUNCTION cache slot once in GH-24598

Arnaud Le Blanc

JIT: Fix TLS access with SHM reattachment (8.6 follow-up) in GH-24456
Fix merge in a4b0658540

berce

Fix GH-24508: HTTP wrapper leaks dechunk filter when header parsing fails in 4fd56dc469
Fix GH-24509: HTTP wrapper leaks Location buffer on empty Location header in ad7ad7c425

Bob Weinand

Fix assertion in VM when taking ref-returning fcall by-value in 8fc9e7c8e8
Regenerate stub file hash in 63045d5b99

C. Scott Ananian

Fix GH-24480: finally block running twice when a VM interrupt throws in FAST_RET in 07fc1f9d2f

cuishuang

Fix json_encode() depth range check before narrowing in 1ef1dd53bb

Daniel Scherzer

ext/zip: add regression tests for behavior with ZIP_CREATE in da4babf4fa
ext/zip: use ZIP_RDONLY when calling zip_open() in zip_stream.c in 1ea350861a
ext/exif: avoid overflow in exif_process_IFD_in_TIFF_impl() in GH-23807
[%pS migration] Use %pS in ext/dba in GH-23151
[%pS migration] Use %pS in ext/spl/php_spl.c in eb95848903
[%pS migration] Use %pS in ext/spl/spl_array.c in ff85732a0e
[%pS migration] Use %pS in ext/spl/spl_directory.c in 1c6ed5db7e
[%pS migration] Use %pS in ext/spl/spl_heap.c in 7851dae949
[%pS migration] Use %pS in ext/spl/spl_iterators.c in 19e86db05e
[%pS migration] Use %pS in ext/spl/spl_observer.c in 0e63b7a255
LiteSpeed: document security considerations for executed paths in GH-24450
[%pS migration] Use %pS in Zend/zend_API.c in cb513b01ee
[%pS migration] Use %pS in Zend/zend_ast.c in 4be92aab67
[%pS migration] Use %pS in Zend/zend_attributes.c in 93260994f1
[%pS migration] Use %pS in Zend/zend_builtin_functions.c in 01dd5e368b
[%pS migration] Use %pS in Zend/zend_closures.c in 35c796e90c
[%pS migration] Use %pS in Zend/zend_compile.c in 20e627e09b
[%pS migration] Use %pS in Zend/zend_constants.c in 8b0165a27c
[%pS migration] Use %pS in Zend/zend_enum.c in 4a3481a4cc
[%pS migration] Use %pS in Zend/zend_exceptions.c in f62939f243
[%pS migration] Use %pS in Zend/zend_execute_API.c in ea78eb60ed
[%pS migration] Use %pS in Zend/zend_execute.c in fc06d39544
[%pS migration] Use %pS in Zend/zend_fibers.c in e428710ef1
[%pS migration] Use %pS in Zend/zend_inheritance.c in 6d12365bce
[%pS migration] Use %pS in Zend/zend_ini.c in 46e6ff6f66
[%pS migration] Use %pS in Zend/zend_interfaces.c in 86fc9764fe
[%pS migration] Use %pS in Zend/zend_lazy_objects.c in 70f10de1ba
[%pS migration] Use %pS in Zend/zend_object_handlers.c in 387cefb4f5
[%pS migration] Use %pS in Zend/zend_objects.c in de62dd459f
[%pS migration] Use %pS in Zend/zend_operators.c in abcd49ef47
[%pS migration] Use %pS in Zend/zend_partial.c in b997563d2f
[%pS migration] Use %pS in Zend/zend_property_hooks.c in 1ad7bc3098
[%pS migration] Use %pS in Zend/zend_vm_def.h in a95e8e26bb
[%pS migration] Use %pS in Zend/zend_weakrefs.c in 952452704e
[%pS migration] Use %pS in Zend/zend.c in e2fa0c9f7f
[%pS migration] Use %pS in ext/pcntl in GH-23161
[%pS migration] Use %pS in ext/pdo_pgsql in GH-23163
[%pS migration] Use %pS in ext/pgsql in GH-23165
[%pS migration] Use %pS in ext/xmlreader in GH-23174
[%pS migration] Use %pS in ext/date in GH-23150
[%pS migration] Use %pS in ext/dom/parentnode/tree.c in e9afe3406a
[%pS migration] Use %pS in ext/dom/document.c in 06c5e8b313
[%pS migration] Use %pS in ext/dom/html_collection.c in 67509a8636
[%pS migration] Use %pS in ext/dom/node.c in ff05c67e2c
[%pS migration] Use %pS in ext/dom/nodelist.c in 1c921ff04a
[%pS migration] Use %pS in ext/dom/php_dom.c in a78d5a6045
[%pS migration] Use %pS in ext/dom/php_dom.h in b7f1b60a99
[%pS migration] Use %pS in ext/dom/xml_common.h in 8661547102
[%pS migration] Use %pS in ext/standard/basic_functions.c in 9b69969a91
[%pS migration] Use %pS in ext/standard/browscap.c in e13e9f1dbc
[%pS migration] Use %pS in ext/standard/filestat.c in 1589b65d5d
[%pS migration] Use %pS in ext/standard/fsock.c in 996e49b3a6
[%pS migration] Use %pS in ext/standard/ftp_fopen_wrapper.c in 256ef3e816
[%pS migration] Use %pS in ext/standard/head.c in 8b93363758
[%pS migration] Use %pS in ext/standard/http_fopen_wrapper.c in 3fb28307b8
[%pS migration] Use %pS in ext/standard/http.c in 921cb72ec8
[%pS migration] Use %pS in ext/standard/info.c in 2b9d25fe1a
[%pS migration] Use %pS in ext/standard/mail.c in 0c1a86426f
[%pS migration] Use %pS in ext/standard/proc_open.c in 4c73172d8b
[%pS migration] Use %pS in ext/standard/streamsfuncs.c in 5ce8c887d7
[%pS migration] Use %pS in ext/standard/string.c in 9b622db7fc
[%pS migration] Use %pS in ext/standard/var_unserializer.re in 6bfe63761f
[%pS migration] Use %pS in ext/standard/var.c in 5ed6625e4c
Persist the pear/install-pear-nozlib.phar file in a082f1211a

David Carlier

ext/pdo: persistent_shutdown run while the connection is still shared in a9138d768a
ext/pdo_pgsql: persistent connection reset drops prepared statements and plans in ce6c465902
pdo_pgsql_request_shutdown() leaves statements of freed PDO objects prepared in 296e8eac57
Fix GH-24373: serialize() context reused by destructors during teardown in 08f4b64e0a
Fix GH-22554: ext/dom: UAF with XPath callback returning foreign-doc node in a44a529d26
Fix GH-24265: zend_fiber_execute() discards exit() in a destroyed fiber in afd156921e
ext/dom: fix UAF on namespace axis results with foreign-doc XPath callback nodes in 98b580b0d2
Fix GH-24989: Use-after-free in GC when an exception is thrown in 7abaad3e21
Fix GH-21768: Reflection assertion failure on internal virtual properties in f752eddff8
Fix GH-24534: inheritance cache records unlinked child dependencies in 614f935fe0
Fix GH-25118: Dom\HTMLDocument::createFromString() crash on OOM in 0614b703d8
sapi/cli: php_cli_server_client_save_header() crash on repeated headers in 53681619e9

Derick Rethans

Updated to version 2026.6 (2026f) in aec4f50908

evanford

Fix GH-24488: GC double-frees the SimpleXMLElement properties table in f963484725

George Wang

Update LiteSpeed API to v8.4 in 084e7a07b7

Gina Peter Banyard

dba: fix GH-24641 (NULL dereferencement with ndbm backend) in b309533729

Ian P. Christian

Fix GH-24046: FPM worker stdio pipe fd closed twice in cd161267c0

Ilia Alshanetsky

ext/opcache: Fix tracing JIT range narrowing against a non-integer operand in 07fc708950
phpdbg: Backport watchpoint fixes to PHP-8.4 in 055e11e0c7
ext/standard: Free Windows DNS query results in b175769022
ext/pdo_firebird: Fix getColumnMeta() bounds check in 5577b0b540
ext/odbc: Fix double free on parameter description failure in 083e1a6d79
ext/standard: Validate objects before queuing unserialize callbacks in 2b99297b76
ext/opcache: Clear vacated MERGE inputs before conversion to BEGIN in 84da3f525a
ext/json: Stop encoding after a key fails to encode in de6ffebd1a
Fix GH-24531: Crash when flushing a renamed zip-based phar in 985b66bb67
ext/session: Skip session lock test on Solaris in 96cbae8f88
ext/com_dotnet: Fix GH-25008 event source typelib crash in 2c4fdd71b3
ext/pdo_pgsql: Clear the notice callback when a persistent handle is released in 6e6ec4b267

Jakub Zelenka

Fix flaky FPM log-bwd-multiple-msgs-stdout-stderr test and remove XFAIL in GH-24998
Fix flaky FPM test for bug #77023 (#24999) in 084271b8fd
Revert "Update LiteSpeed API to v8.4" in ce76acbdbd
Fix UAF in reflected attribute write paths in GH-25120
Report Io\Poll level watchers with buffered stream data in GH-24017
openssl: Fix use-after-free in TLS session remove callback in 7e86f2c443
openssl: Fix heap buffer overflow in TLS PSK callbacks in 4f2bee40e0

Joe Ferguson

Update versions for PHP 8.6.0RC5 in a1132636c2

Jorg Sowa

JIT: Fix use-after-free in ASSIGN_DIM_OP with CONCAT in fe8ce13ef7
ext/mbstring: fix over-read in php_mb_rfc1867_getword() in f6852befa3
ext/standard: Skip proc_open descriptor 0 tests without /proc/self/fd symlinks in 0ddabc30e8
Fix JIT reading packed-turned-hash array as packed after string key write in 51808ac547
Fix JIT SWITCH_STRING type checks on referenced operand in ef873f64f3
Fix AArch64 JIT encoding of invalid logical immediates in aa6e3a84e8
Fix GH-23572: JIT calls wrong static method from trait clones in 62a2b3d8c9
Fix AST printing of final and abstract on class constants and properties in ce899c8c68
Fix preloaded functions not JIT-compiled again after OPcache restart in 896f76d2c7
Fix AST export of readonly anonymous classes in 5300734e3f
Fix leak of duplicate named argument in new in initializer in dfcc0433fc
Fix FCC in trait const expressions resolving to the first using class in 44a2a2c3db

Juan Versolato Lopes

Fix GH-23875: Skip gh7980.phpt without windows-1258 in GH-24789
Fix GH-9670: List -C and -q in the CLI help in b4539c0e1b

Kévin Dunglas

Fix free of uninitialized date last_errors after a failed request startup in GH-25127

Labish Bardiya

Fix GH-24605: Guard var_export() against native stack overflow in GH-24671

lacatoire

Fix use-after-free of CURLOPT_STDERR stream on cloned curl handle in 59f8e1d265
ext/ldap: fix crash in ldap_exop_sync() when $response_data is omitted in 56bd75634f

lazerg

Fix GH-24308: Preserve syslog handles not opened by PHP in GH-24310
Fix GH-24264: Unwind/GracefulExit discarded in spl_iterators.c in 861d2b6c4e
Fix GH-24745: File cache loses attributes on constants on 32-bit builds in a2052f318a
Fix GH-24552: Use ASCII case folding in string comparisons in GH-24558
ext/sockets: Handle declared object properties in socket_set_option() in 7adcf5a580
ext/phar: Bound tar metadata size before allocation in f9129bd1a1
Fix GH-24668: zend_set_local_var() leaks the previous CV value in GH-24670
Fix GH-25029: Align the fileinfo built-in magic database in GH-25030
Fix GH-25019: Uri\Rfc3986\Uri rejects a port with leading zeros as out of range in c95e572696
Fix GH-25061: $x = $x - 1 on null is optimized to PRE_DEC in 0c406ea172
Fix GH-25089: Heap buffer over-read via crafted alias size in zip-based phar in GH-25099
Fix GH-25090: UAF in phar rename() of an entry with metadata in d0828881d5
Fix GH-25091: UAF in phar rename() when source and destination are equal in 24377a0adc
Fix GH-25092: Double free in Phar::copy() on link and mounted entries in 99ec10237a
Fix GH-25009: GetConsoleTitleW() buffer size passed in bytes in 113bc87d5a
Fix GH-25093: Phar::webPhar() redirect reads past the request URI in GH-25102
Fix GH-24990: pdo_sqlite statement unusable after failed execute() in GH-24991

Lazizbek Ergashev

Fix GH-24523: UAF in zend_test_compile_to_ast() on parse error in GH-24524
Fix GH-24533: Accept z.lib from zlib 1.3.2 CMake builds on Windows in GH-24539
Fix GH-24695: FPM tester sends signal to process group when PID is missing in GH-24698
Fix GH-24736: php_odbc_connstr_is_quoted() accepts missing closing brace in GH-24737
Fix GH-25023: ZEND_CONTAINER_OF() fails to compile with -std=c11 in GH-25027
Fix GH-25007: PFA named args in constant expression write out of bounds in GH-25012
Fix GH-24609: mysqlnd OK packets without info rejected on x32 builds in GH-24614
Fix GH-25086: Io\Poll kqueue backend leaks memory on every modifyEvents() in GH-25087

Levi Morrison

JIT: fix lost register-allocated CVs on interrupt at the end of a loop trace in GH-24610
JIT: fix vm_interrupt resumption in TAILCALL/CALL VMs in GH-24793
Fix potential infinite recursion in HYBRID/TAILCALL VMs in GH-25039

mainframe98

zend_test: Fix function and constant imports in compile_to_ast and add support for grouping in f6c9428b97

Marc

Fix windows embedded CLI argv overwriting in GH-24733

Marc Bennewitz

Fix IntlDateFormatter parse functions truncating an $offset below INT_MIN in GH-24781
Fix ZEND_LONG_UINT_OVFL() accepting negative values on 32-bit platforms in GH-24778
Add test for Phar::buildFromIterator() with a negative getMTime() in GH-24779
Fix imagetruecolortopalette() error message for $num_colors in GH-24780

Marcel Hernandez

fpm: fix potential null dereference in fpm_status_export_to_zval() in ce3e1bac17
fpm: fix a use-after-free of scoreboard_p in 3aa4da4a20
fpm: fix _GET_str memory leaks and test headers_only status path in 0e7e36c896

Martin Mirchev

Fix infinite loop in sapi_header_op() for headers of 4 GiB or more in GH-24540
Fix GOST and Snefru digests of 512 MiB or more in 89f4d82157
Fix unmapping of an unrelated range when the aligned chunk mmap fails in GH-24542
Fix GH-24616: Socket transports accept ports above 65535 in bad5aaca7a
Fix FPM worker output prefix longer than its buffer or log_limit in 974de49381
Fix use-after-free in Randomizer::shuffleArray() when the engine throws in 3a8bcb6d18

Matyapiro31

Fix GH-24582: Memory leaks in ext/ffi parser when finalize_type() bails out in b97f7881de

Michael Voříšek

Fix GH-25021: SQLite createFunction corrupts large integers in 9c69d7c6a7

mkrishna793

Fix zend_inference: fix unsound shift_left_overflows range when shift wraps in 8df212a4b6

Mrmaxmeier

Fix block pass dropping ZEND_FAST_CALL OP2 definition in 139c84bc2d

Máté Kocsis

ext/uri: Fix decreasing of a cost variable in 91dc887163

ndossche

zend_test: Backport zend_test_compile_to_ast() function in 359ce15176
Fix GH-24396: Assertion failure in zend_jit_def_reg() "reg forwarding" with chained Pi nodes in fc05c9bf24
Fix error paths in dom_xml_serializing_a_document_node() in 6454e102d8
Fix GH-17733: System entropy does not take into account function order, resulting in wrong functions possibly called in different configurations in d6541df639
Fix GH-24697: cli: passing PHP_HTTP_PARSER_STRICT build option doesn't work in 470af312dd
IR: Backport code buffer rollback fix in ddde35ce8b
JIT: Discard veneers if generation failed in 11bea59cfb
opcache: Call orig_post_shutdown_cb() in 37f495c3f5
curl: Fix UAF on clone due to callback data pointer mismatch in 154b090df2
Fix GH-23626: OPcache: orphaned temporaries cause leaks and assertions in c7ea9b1758
Fix JIT losing the called scope of self::/parent:: calls in included files in a7a49e039d
Fix GH-24988: Incorrect opcode range check causes bugs with exceptions in function JIT in bc3a830f94
Fix deprecation warn in test in 8b03a99f87
Fix merge in ext/phar in cf31f5b891
Fix macOS nightly failure in 3ccde25486
Fix coverage nightly job failure in 1256242883
Fix opcache phar check in cbd65db2af
Fix test expectation match for 8.6+ in 2b7045bc1a

Nicolas Grekas

Fix the WSAPoll backend of Io\Poll accepting handles that are not sockets in f2fbe476d3

Pavel Gushcha

Fix preloaded functions JIT-compiled on load being overwritten after restart in 5e7bad4748
Fix opcache.interned_strings_buffer being 0 in threads started later (ZTS) in 38eabd0452

Peter Kokot

Update PEAR failed download installation banner in GH-14216

Pratik Bhujel

Fix GH-24577: CE-cache flag on interned class name visible before map_ptr offset in GH-24585

Raphael Paez

Fix GH-8469: Phar::decompressFiles() keeps compressed contents in GH-25045

Roman Ondráček

Don't use static closure cache when called_scope diverges in e46e742f45

Seifeddine Gmati

Fix stream error operation leak in stream_select() in 2762817831

Shivam Mathur

Fix SQL test on Windows in GH-24755
Fix calling conventions in Windows alertable sleep test in GH-25125
Fix linking ext/curl against OpenSSL (#13262) in GH-25129
Preserve PATH in filter OOM tests for Windows ASan in GH-25163

Sjoerd Langkemper

ext/session: validate full length of session ID in 55230ecea9

Tim Düsterhus

sodium: Use opaque objects for SHAKE state in GH-24351
Add SodiumCryptoXof*State classes to UPGRADING in 94f0a9a158
Update GitHub Action workflows to actions/checkout@v7 in 6a1a57dc4b
Update GitHub Action workflows to actions/checkout@v7 (8.4) in 6f5a41524d
Update GitHub Action workflows to actions/checkout@v7 (8.5) in dad7ab67c5
Update GitHub Action workflows to actions/checkout@v7 (8.6) in 66dc9f5c8e
uri: Update to uriparser-1.0.3 in GH-25145

waroad

JIT: Fix function JIT level 1 crash on FETCH_OBJ_FUNC_ARG of a hooked property in cfe77b82a6
Tracing JIT: give the type guard on entry of an inlined call an exit opline in b4ca62e317
Tracing JIT: keep the SEND_VAL type guard after assigning to a reference in d5ab3605e9

Weilin Du

ci: Fix stale zend_test stub hash on PHP 8.4 in GH-24483
ci: Fix OOM failures in header_over_4gib.phpt in b232da5d0a
JIT: Fix Windows build of zend_jit_ir.c in 547a26bd17
JIT: Fix upper-bound inference in tracing JIT comparisons in GH-24633
JIT: Fix operand type check in zend_redo_pass_two_ex() in GH-24658
ext/zip: Exclude broken libzip 1.12 in GH-24358
ext/zip: Reject broken libzip versions on Windows in GH-24371
Backport: Adapt intl timezone test expectations for ICU 79.1 in GH-24724
ext/openssl: Fix build with OpenSSL 4.1 in GH-24686
ext/phar: Fix repeated compression with the same algorithm in 7dd0cebbc8
ext/openssl: Restore OpenSSL 4.x compatibility on PHP 8.4 in GH-25140
ext/openssl: Restore OpenSSL 4.x compatibility on PHP 8.5 in GH-25139