[php-src] PHP-8.4.27: Add NEWS entry

Author: Ilija Tovilo (iluuu1994) Pusher: DanielEScherzer Date: 2026-10-18T19:23:32+02:00 Commit: https://github.com/php/php-src/commit/2f966f79f6bd14339f1888052d88b051283f3827 Raw diff: https://github.com/php/php-src/commit/2f966f79f6bd14339f1888052d88b051283f3827.diff Add NEWS entry Changed paths: M NEWS Diff: diff --git a/NEWS b/NEWS index b5be760cfbc3..5341ca10ac54 100644 --- a/NEWS +++ b/NEWS @@ -2,25 +2,10 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? ??? ????, PHP 8.4.27 -- BCMath: - . Fixed BcMath\Number results that truncate to zero keeping a negative sign - and comparing less than zero. (Ilia Alshanetsky) - -- BZ2: - . Fixed double close of the descriptor and use-after-free of the inner - stream when bzopen() is given a stream resource. (Jakub Zelenka) - -- CLI - . Fix GH-22567 (Windows ZTS CLI SAPI should refresh its TSRMLS cache during - request activation). (matyhtf) - . Fixed bug GH-23764 (Built-in server leaks a file descriptor on every HEAD - request for a static file). (jakubskopal) - . Fixed crash in the built-in server when a client is reset before being - accepted. (David Carlier) - . Fixed the built-in server truncating an error page and leaking its - unsent part after a partial socket write. (Ilia Alshanetsky) - -- Core +- Core: + . Fixed GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp (Avoid state corruption via + bailout). (CVE-2026-109618, CVE-2026-109619) (Arnaud, ilutov, Jakub Zelenka, + ndossche, Nicolas Grekas) . Fix GH-21999: GC inconsistency with lazy object, var_dump(), and object comparison. (Arnaud) . Fixed OSS-Fuzz #536440507 (Immutable class incorrect assertion). @@ -39,6 +24,24 @@ PHP NEWS . Fixed exception thrown by destructor during GC in a Fiber not being rethrown into the frame that triggered the GC. (Nicolas Grekas) +- BCMath: + . Fixed BcMath\Number results that truncate to zero keeping a negative sign + and comparing less than zero. (Ilia Alshanetsky) + +- BZ2: + . Fixed double close of the descriptor and use-after-free of the inner + stream when bzopen() is given a stream resource. (Jakub Zelenka) + +- CLI: + . Fix GH-22567 (Windows ZTS CLI SAPI should refresh its TSRMLS cache during + request activation). (matyhtf) + . Fixed bug GH-23764 (Built-in server leaks a file descriptor on every HEAD + request for a static file). (jakubskopal) + . Fixed crash in the built-in server when a client is reset before being + accepted. (David Carlier) + . Fixed the built-in server truncating an error page and leaking its + unsent part after a partial socket write. (Ilia Alshanetsky) + - DOM: . Fixed use-after-free when re-constructing a DOMXPath whose php:function registrations are freed while still reachable from the cycle collector.