[php-src] PHP-8.5.12: Add NEWS entry

Author: Ilija Tovilo (iluuu1994) Pusher: DanielEScherzer Date: 2026-10-18T19:23:47+02:00 Commit: https://github.com/php/php-src/commit/3d37ab3b8ee604c32bf30147b512ff60d41dad12 Raw diff: https://github.com/php/php-src/commit/3d37ab3b8ee604c32bf30147b512ff60d41dad12.diff Add NEWS entry Changed paths: M NEWS Diff: diff --git a/NEWS b/NEWS index 6d6ed897bd2e..9b6ef574e7a3 100644 --- a/NEWS +++ b/NEWS @@ -2,25 +2,10 @@ PHP NEWS ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ?? ??? ????, PHP 8.5.12 -- BCMath: - . Fixed BcMath\Number results that truncate to zero keeping a negative sign - and comparing less than zero. (Ilia Alshanetsky) - -- BZ2: - . Fixed double close of the descriptor and use-after-free of the inner - stream when bzopen() is given a stream resource. (Jakub Zelenka) - -- CLI - . Fix GH-22567 (Windows ZTS CLI SAPI should refresh its TSRMLS cache during - request activation). (matyhtf) - . Fixed bug GH-23764 (Built-in server leaks a file descriptor on every HEAD - request for a static file). (jakubskopal) - . Fixed crash in the built-in server when a client is reset before being - accepted. (David Carlier) - . Fixed the built-in server truncating an error page and leaking its - unsent part after a partial socket write. (Ilia Alshanetsky) - -- Core +- Core: + . Fixed GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp (Avoid state corruption via + bailout). (CVE-2026-109618, CVE-2026-109619) (Arnaud, ilutov, Jakub Zelenka, + ndossche, Nicolas Grekas) . Fixed bug GH-23644 (Optimizer leaves a constant-vs-constant comparison unfolded, crashing the VM in zval_undefined_cv). (ndossche) . Fixed OSS-Fuzz 532353396 (assertion failure with static type). (Girgias) @@ -39,6 +24,24 @@ PHP NEWS . Fixed exception thrown by destructor during GC in a Fiber not being rethrown into the frame that triggered the GC. (Nicolas Grekas) +- BCMath: + . Fixed BcMath\Number results that truncate to zero keeping a negative sign + and comparing less than zero. (Ilia Alshanetsky) + +- BZ2: + . Fixed double close of the descriptor and use-after-free of the inner + stream when bzopen() is given a stream resource. (Jakub Zelenka) + +- CLI: + . Fix GH-22567 (Windows ZTS CLI SAPI should refresh its TSRMLS cache during + request activation). (matyhtf) + . Fixed bug GH-23764 (Built-in server leaks a file descriptor on every HEAD + request for a static file). (jakubskopal) + . Fixed crash in the built-in server when a client is reset before being + accepted. (David Carlier) + . Fixed the built-in server truncating an error page and leaking its + unsent part after a partial socket write. (Ilia Alshanetsky) + - DOM: . Fixed use-after-free when re-constructing a DOMXPath whose php:function registrations are freed while still reachable from the cycle collector.