[web-php] master: Announce PHP 8.4.26

Author: Saki Takamachi (SakiTakamachi) Date: 2026-09-25T00:28:31+09:00 Commit: https://github.com/php/web-php/commit/0e3b395c9e86e82973d8cc3006e70bab06df007c Raw diff: https://github.com/php/web-php/commit/0e3b395c9e86e82973d8cc3006e70bab06df007c.diff Announce PHP 8.4.26 Changed paths: A public/archive/entries/2026-09-24-5.xml A public/releases/8_4_26.php M include/release-qa.php M include/releases.inc M include/version.inc M public/ChangeLog-8.php M public/archive/archive.xml Diff: diff --git a/include/release-qa.php b/include/release-qa.php index 43c4ea1db0..240e7a7a6d 100644 --- a/include/release-qa.php +++ b/include/release-qa.php @@ -75,12 +75,12 @@ 'active' => true, 'release' => [ 'type' => 'RC', - 'number' => 1, - 'sha256_bz2' => 'afaf140fa8f2593b3e08e3cff2ec81f62d1d8b21834439309e456c90a9ca1312', - 'sha256_gz' => '48a559ba2cb17f21a4bbbf21624e616e5c7e3d4ce92eba7ffbc260c3b52bba5f', - 'sha256_xz' => 'c6e6f52752510c3b3fbaf9e34a9ec37fb17f6741fb8b2637d6804a8a71c4fc37', + 'number' => 0, + 'sha256_bz2' => '', + 'sha256_gz' => '', + 'sha256_xz' => '', 'date' => '10 September 2026', - 'baseurl' => 'https://downloads.php.net/~saki/', + 'baseurl' => 'https://downloads.php.net/', ], ], diff --git a/include/releases.inc b/include/releases.inc index b6df286cf8..6e054b427a 100644 --- a/include/releases.inc +++ b/include/releases.inc @@ -2,6 +2,43 @@ $OLDRELEASES = array ( 8 => array ( + '8.4.25' => + array ( + 'announcement' => + array ( + 'English' => '/releases/8_4_25.php', + ), + 'tags' => + array ( + 0 => '', + ), + 'date' => '27 Aug 2026', + 'source' => + array ( + 0 => + array ( + 'filename' => 'php-8.4.25.tar.gz', + 'name' => 'PHP 8.4.25 (tar.gz)', + 'sha256' => '5cde1da976b728fa09e6b549a4c8afcd0c180337028dacf34f73b11be50253db', + 'date' => '27 Aug 2026', + ), + 1 => + array ( + 'filename' => 'php-8.4.25.tar.bz2', + 'name' => 'PHP 8.4.25 (tar.bz2)', + 'sha256' => '952ccc1785266b958f4a1dcfc580e08eabbb79f44222d1eff192bcd98d91f6e3', + 'date' => '27 Aug 2026', + ), + 2 => + array ( + 'filename' => 'php-8.4.25.tar.xz', + 'name' => 'PHP 8.4.25 (tar.xz)', + 'sha256' => 'dc1ad8b4109898d9db49744450403874858c23efc685b1032a50bd1e83906848', + 'date' => '27 Aug 2026', + ), + ), + 'museum' => false, + ), '8.2.33' => array ( 'announcement' => diff --git a/include/version.inc b/include/version.inc index e1ba94a178..d467b7d987 100644 --- a/include/version.inc +++ b/include/version.inc @@ -34,13 +34,13 @@ $RELEASES = (function () { /* PHP 8.4 Release */ $data['8.4'] = [ - 'version' => '8.4.25', - 'date' => '27 Aug 2026', - 'tags' => [''], // Set to ['security'] for security releases. + 'version' => '8.4.26', + 'date' => '24 Sep 2026', + 'tags' => ['security'], // Set to ['security'] for security releases. 'sha256' => [ - 'tar.gz' => '5cde1da976b728fa09e6b549a4c8afcd0c180337028dacf34f73b11be50253db', - 'tar.bz2' => '952ccc1785266b958f4a1dcfc580e08eabbb79f44222d1eff192bcd98d91f6e3', - 'tar.xz' => 'dc1ad8b4109898d9db49744450403874858c23efc685b1032a50bd1e83906848', + 'tar.gz' => 'c248abaebc4bb777b80968f0760da0da8e989836e896c9ff637b6775d7d37662', + 'tar.bz2' => '4209694d7b0f63c45a3773e07cdc2bbfc71249265a5d951b1ff53e1147edc5ca', + 'tar.xz' => '32a2de53862ad44ed4a5005244ce4f1b50c271e74dced215449a4443b40569f1', ] ]; diff --git a/public/ChangeLog-8.php b/public/ChangeLog-8.php index 33deec6b0b..ddd1f0b7ce 100644 --- a/public/ChangeLog-8.php +++ b/public/ChangeLog-8.php @@ -1466,6 +1466,153 @@ <a id="PHP_8_4"></a> +<section class="version" id="8.4.26"><!-- {{{ 8.4.26 --> +<h3>Version 8.4.26</h3> +<b><?php release_date('24-Sep-2026'); ?></b> +<ul><li>BCMath: +<ul> + <li>Fixed out-of-bounds read in bc_is_zero_for_scale() when scale exceeds n_scale.</li> +</ul></li> +<li>Core: +<ul> + <li>Fixed out-of-bounds reads during automatic UTF-16/32 encoding detection.</li> + <li>Fixed bug <?php githubissuel('php/php-src', 15375); ?> (Nested "yield from" skips items after a valid() or next() call on the inner generator).</li> + <li>Fixed bug <?php githubissuel('php/php-src', 23232); ?> (lone namespace separator asks the autoloader for an empty class name).</li> + <li>Fixed bug <?php githubissuel('php/php-src', 23301); ?> (Nested "yield from" yields a value twice when the middle generator delegates again).</li> +</ul></li> +<li>CLI: +<ul> + <li>Fixed bug <?php githubissuel('php/php-src', 23425); ?> (sapi_cli_server_send_headers() does not check the return value of php_cli_server_client_send_through()).</li> +</ul></li> +<li>DOM: +<ul> + <li>Fixed NamedNodeMap::getNamedItemNS() with an empty URI not matching the null namespace in spec-following mode.</li> + <li>Fixed a use-after-free when cloning a DOMNameSpaceNode after DOMDocument::xinclude().</li> + <li>Fixed bug <?php githubissuel('php/php-src', 23331); ?> (UAF when node_list_unlink() skips attribute children that still have a live wrapper).</li> + <li>Fixed a use-after-free when Dom\Element::setAttributeNS() replaces the value of an attribute whose child still has a live wrapper.</li> +</ul></li> +<li>GD: +<ul> + <li>Fixed imageaffinematrixget() and imageaffinematrixconcat() reporting the wrong argument in error messages.</li> + <li>Fixed bug <?php githubissuel('php/php-src', 23457); ?> (imagebmp() is extremely slow when writing to a file).</li> +</ul></li> +<li>FPM: +<ul> + <li>Fixed bug <?php githubissuel('php/php-src', 19320); ?> (FPM UID and GID overflow).</li> + <li>Fixed <?php githubsecurityl('php/php-src', '62xp-839h-2637'); ?> (IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison). (CVE-2026-91768)</li> +</ul></li> +<li>Hash: +<ul> + <li>Fixed a buffer overflow in hash_pbkdf2() with a large output length.</li> +</ul></li> +<li>Intl: +<ul> + <li>Fixed grapheme_strpos() and grapheme_strrpos() with an empty needle returning UTF-16 offsets instead of grapheme offsets.</li> + <li>Fixed a memory leak when dumping IntlCalendar instances.</li> + <li>Fixed a memory leak when iterating IntlBreakIterator::getPartsIterator() results.</li> + <li>Fixed a double-free when IntlGregorianCalendar construction fails after the ICU constructor adopts the TimeZone.</li> + <li>Fixed bug <?php githubissuel('php/php-src', 23094); ?> (NumberFormatter parsing offsets use UTF-16 positions for UTF-8 strings).</li> + <li>Fixed Locale::parseLocale() reading past a trailing '-' or '_'.</li> + <li>Fixed grapheme_str_split() treating UBRK_DONE as a byte index.</li> + <li>Fixed a leak in Locale::getKeywords() when a keyword value cannot be read.</li> + <li>Fixed a use-after-free when IntlRuleBasedBreakIterator is constructed from compiled rules.</li> +</ul></li> +<li>MBString: +<ul> + <li>Fixed mb_ereg_replace() emitting a NUL or out-of-bounds bytes in the replacement when a \k&lt;name&gt; backref has no closing delimiter.</li> +</ul></li> +<li>MySQLnd: +<ul> + <li>Fixed <?php githubsecurityl('php/php-src', 'r6x9-5r99-36j7'); ?> (Various packet overreads in mysqlnd wire protocol). (CVE-2025-1218)</li> +</ul></li> +<li>ODBC: +<ul> + <li>Fixed odbc_field_len(), odbc_field_scale() and odbc_field_type() returning uninitialized memory when SQLColAttribute fails.</li> +</ul></li> +<li>Opcache: +<ul> + <li>Fixed a crash when the huge page SHM remap discarded mappings outside the reserved address range.</li> + <li>Fixed opcache.protect_memory race under ZTS.</li> + <li>Fixed bug <?php githubissuel('php/php-src', 23288); ?> (Crash on restart when opcache.interned_strings_buffer is overridden in an individual FPM pool).</li> + <li>Fixed a tracing JIT crash when compiling a side trace for a method of a class that could not be stored in the inheritance cache.</li> +</ul></li> +<li>OpenSSL: +<ul> + <li>Fixed <?php githubsecurityl('php/php-src', 'vvx9-73fr-5jjx'); ?> (TLS hostname verification falls back to CN after SAN mismatch). (CVE-2026-91769)</li> + <li>Fixed <?php githubsecurityl('php/php-src', 'xr7j-rvgx-xq5p'); ?> (Heap buffer overflow in php_openssl_matches_wildcard_name() on crafted server certificate wildcard CN). (CVE-2026-91767)</li> +</ul></li> +<li>PDO: +<ul> + <li>Fixed a leak when a persistent connection failed a liveness check with no other live PDO handle.</li> +</ul></li> +<li>PDO_ODBC: +<ul> + <li>Fixed bug <?php githubissuel('php/php-src', 23444); ?> (ODBC_ATTR_ASSUME_UTF8 corrupts Unicode data outside Windows).</li> +</ul></li> +<li>PDO_PGSQL: +<ul> + <li>Fixed PDO::CURSOR_SCROLL statements closing a cursor that does not exist.</li> +</ul></li> +<li>PDO Sqlite: +<ul> + <li>Fixed bug <?php githubissuel('php/php-src', 20214); ?> (PDO::FETCH_DEFAULT unexpected behavior with PDOStatement::setFetchMode).</li> +</ul></li> +<li>Phar: +<ul> + <li>Fixed bug <?php githubissuel('php/php-src', 23418); ?> (Use-after-free when looking up mounted directories).</li> + <li>Fixed bug <?php githubissuel('php/php-src', 23477); ?> (Memory leak on duplicate native Phar manifest entries).</li> + <li>Fixed <?php githubsecurityl('php/php-src', 'j3wh-g957-2m85'); ?> (Integer overflow in phar_tar_number() allowing TAR archive entry injection). (CVE-2026-6103)</li> +</ul></li> +<li>SNMP: +<ul> + <li>Fixed bug <?php githubissuel('php/php-src', 23453); ?> (SNMP::setSecurity() frees a non-malloced address with a context engine ID longer than 32 bytes).</li> +</ul></li> +<li>SOAP: +<ul> + <li>Fixed bug <?php githubissuel('php/php-src', 23447); ?> (Segfault when a class passed to SoapServer::setClass() fails to initialize).</li> + <li>Fixed WSDL cache corruption when a soap:header defines headerfaults.</li> + <li>Fixed stack overflow when parsing a WSDL with self-referential schema groups or attributeGroups.</li> + <li>Fixed <?php githubsecurityl('php/php-src', 'rgrp-mwpx-f6rm'); ?> (Unbounded recursion in server-side cleanup_xml_node()). (CVE-2026-91765)</li> + <li>Fixed <?php githubsecurityl('php/php-src', 'cj93-vc83-wgqv'); ?> (Integer overflow to buffer overflow in SOAP HTTP parsing). (CVE-2025-14181)</li> +</ul></li> +<li>Standard: +<ul> + <li>Fixed a segfault when a stream filter callback unsets StreamBucket::$data before re-attaching the bucket.</li> + <li>Fixed <?php githubsecurityl('php/php-src', '7875-c8px-7q5f'); ?> (Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header). (CVE-2026-93682)</li> + <li>Fixed a memory leak in array_merge_recursive() when the recursive merge of an object converted to an array fails.</li> + <li>Fixed read buffer compaction in php_stream_filter_flush().</li> + <li>Fixed bug <?php githubissuel('php/php-src', 22410); ?> (Incorrect float behavior with large numbers).</li> + <li>Fixed <?php githubissuel('php/php-src', 23338); ?> (fsockopen()/pfsockopen() ValueError reported wrong argument number for $timeout).</li> + <li>Fixed bug <?php githubissuel('php/php-src', 23576); ?> (Next index for array returned from array_keys() is wrong).</li> + <li>Fixed <?php githubsecurityl('php/php-src', '88hq-2827-7pg6'); ?> (Out-of-bounds read in convert.* stream filters when line-break-chars contains NUL). (CVE-2026-92842)</li> + <li>Fixed <?php githubsecurityl('php/php-src', 'fpwc-w8rq-cr92'); ?> (Cross-origin credential leak in HTTP stream wrapper redirects). (CVE-2026-91766)</li> +</ul></li> +<li>SimpleXML: +<ul> + <li>Fixed writing to a dimension of the object returned by attributes() not creating the attribute.</li> + <li>Fixed child elements of the element returned by SimpleXMLElement::addChild() not being accessible by property name when namespaces are involved.</li> +</ul></li> +<li>Windows: +<ul> + <li>Fixed <?php githubsecurityl('php/php-src', '9f67-6fw4-hpfp'); ?> (Reserved device names are not rejected before file and stream I/O). (CVE-2026-17545)</li> +</ul></li> +<li>Zip: +<ul> + <li>Fixed bug <?php githubissuel('php/php-src', 23276); ?> (ZipArchive subclass storing its own stream cannot be garbage collected).</li> + <li>Fixed ZipArchive::extractTo() and ZipArchive::getFrom*() reporting success on corrupted entries.</li> + <li>Fixed ZipArchive::getNameIndex() truncating the entry index to int.</li> + <li>Fixed fstat() on a zip:// stream reporting success when the archive cannot be opened.</li> +</ul></li> +<li>SAPI: +<ul> + <li>Fixed fuzzer targets failing to build in isolation.</li> + <li>Fixed returns uninitialized value on LiteSpeed lsapi SAPI (Go Kudo)</li> +</ul></li> +</ul> +<!-- }}} --></section> + + + <section class="version" id="8.4.25"><!-- {{{ 8.4.25 --> <h3>Version 8.4.25</h3> <b><?php release_date('27-Aug-2026'); ?></b> diff --git a/public/archive/archive.xml b/public/archive/archive.xml index d571efbb19..d4c7137d01 100644 --- a/public/archive/archive.xml +++ b/public/archive/archive.xml @@ -9,6 +9,7 @@ <uri>http://php.net/contact</uri> <email>php-webmaster@lists.php.net</email> </author> + <xi:include href="entries/2026-09-24-5.xml"/> <xi:include href="entries/2026-09-24-4.xml"/> <xi:include href="entries/2026-09-24-3.xml"/> <xi:include href="entries/2026-09-24-2.xml"/> diff --git a/public/archive/entries/2026-09-24-5.xml b/public/archive/entries/2026-09-24-5.xml new file mode 100644 index 0000000000..74a65822bb --- /dev/null +++ b/public/archive/entries/2026-09-24-5.xml @@ -0,0 +1,21 @@ +<?xml version="1.0" encoding="utf-8"?> +<entry xmlns="http://www.w3.org/2005/Atom"> + <title>PHP 8.4.26 Released!</title> + <id>https://www.php.net/archive/2026.php#2026-09-24-5</id> + <published>2026-09-24T15:26:06+00:00</published> + <updated>2026-09-24T15:26:06+00:00</updated> + <link href="https://www.php.net/index.php#2026-09-24-5" rel="alternate" type="text/html"/> + <link href="https://www.php.net/archive/2026.php#2026-09-24-5" rel="via" type="text/html"/> + <category term="releases" label="New PHP release"/> + <category term="frontpage" label="PHP.net frontpage news"/> + <content type="xhtml"> + <div xmlns="http://www.w3.org/1999/xhtml"><p>The PHP development team announces the immediate availability of PHP 8.4.26. This is a security release.</p> + +<p>All PHP 8.4 users are encouraged to upgrade to this version.</p> + +<p>For source downloads of PHP 8.4.26 please visit our <a href="https://www.php.net/downloads.php">downloads page</a>, +Windows source and binaries can also be found <a href="https://www.php.net/downloads.php?os=windows&amp;version=8.4">there</a>. +The list of changes is recorded in the <a href="https://www.php.net/ChangeLog-8.php#8.4.26">ChangeLog</a>. +</p> </div> + </content> +</entry> diff --git a/public/releases/8_4_26.php b/public/releases/8_4_26.php new file mode 100644 index 0000000000..27dc175f17 --- /dev/null +++ b/public/releases/8_4_26.php @@ -0,0 +1,16 @@ +<?php +$_SERVER['BASE_PAGE'] = 'releases/8_4_26.php'; +require_once __DIR__ . '/../../include/prepend.inc'; +site_header('PHP 8.4.26 Release Announcement', ['cache' => true, 'cache_control' => 30 * 60]); +?> +<h1>PHP 8.4.26 Release Announcement</h1> + +<p>The PHP development team announces the immediate availability of PHP 8.4.26. This is a security release.</p> + +<p>All PHP 8.4 users are encouraged to upgrade to this version.</p> + +<p>For source downloads of PHP 8.4.26 please visit our <a href="https://www.php.net/downloads.php">downloads page</a>, +Windows source and binaries can also be found <a href="https://www.php.net/downloads.php?os=windows&amp;version=8.4">there</a>. +The list of changes is recorded in the <a href="https://www.php.net/ChangeLog-8.php#8.4.26">ChangeLog</a>. +</p> +<?php site_footer();