Author: Saki Takamachi (SakiTakamachi)
Date: 2026-09-25T00:28:31+09:00
Commit: https://github.com/php/web-php/commit/0e3b395c9e86e82973d8cc3006e70bab06df007c
Raw diff: https://github.com/php/web-php/commit/0e3b395c9e86e82973d8cc3006e70bab06df007c.diff
Announce PHP 8.4.26
Changed paths:
A public/archive/entries/2026-09-24-5.xml
A public/releases/8_4_26.php
M include/release-qa.php
M include/releases.inc
M include/version.inc
M public/ChangeLog-8.php
M public/archive/archive.xml
Diff:
diff --git a/include/release-qa.php b/include/release-qa.php
index 43c4ea1db0..240e7a7a6d 100644
--- a/include/release-qa.php
+++ b/include/release-qa.php
@@ -75,12 +75,12 @@
'active' => true,
'release' => [
'type' => 'RC',
- 'number' => 1,
- 'sha256_bz2' =>
'afaf140fa8f2593b3e08e3cff2ec81f62d1d8b21834439309e456c90a9ca1312',
- 'sha256_gz' =>
'48a559ba2cb17f21a4bbbf21624e616e5c7e3d4ce92eba7ffbc260c3b52bba5f',
- 'sha256_xz' =>
'c6e6f52752510c3b3fbaf9e34a9ec37fb17f6741fb8b2637d6804a8a71c4fc37',
+ 'number' => 0,
+ 'sha256_bz2' => '',
+ 'sha256_gz' => '',
+ 'sha256_xz' => '',
'date' => '10 September 2026',
- 'baseurl' => 'https://downloads.php.net/~saki/',
+ 'baseurl' => 'https://downloads.php.net/',
],
],
diff --git a/include/releases.inc b/include/releases.inc
index b6df286cf8..6e054b427a 100644
--- a/include/releases.inc
+++ b/include/releases.inc
@@ -2,6 +2,43 @@
$OLDRELEASES = array (
8 =>
array (
+ '8.4.25' =>
+ array (
+ 'announcement' =>
+ array (
+ 'English' => '/releases/8_4_25.php',
+ ),
+ 'tags' =>
+ array (
+ 0 => '',
+ ),
+ 'date' => '27 Aug 2026',
+ 'source' =>
+ array (
+ 0 =>
+ array (
+ 'filename' => 'php-8.4.25.tar.gz',
+ 'name' => 'PHP 8.4.25 (tar.gz)',
+ 'sha256' =>
'5cde1da976b728fa09e6b549a4c8afcd0c180337028dacf34f73b11be50253db',
+ 'date' => '27 Aug 2026',
+ ),
+ 1 =>
+ array (
+ 'filename' => 'php-8.4.25.tar.bz2',
+ 'name' => 'PHP 8.4.25 (tar.bz2)',
+ 'sha256' =>
'952ccc1785266b958f4a1dcfc580e08eabbb79f44222d1eff192bcd98d91f6e3',
+ 'date' => '27 Aug 2026',
+ ),
+ 2 =>
+ array (
+ 'filename' => 'php-8.4.25.tar.xz',
+ 'name' => 'PHP 8.4.25 (tar.xz)',
+ 'sha256' =>
'dc1ad8b4109898d9db49744450403874858c23efc685b1032a50bd1e83906848',
+ 'date' => '27 Aug 2026',
+ ),
+ ),
+ 'museum' => false,
+ ),
'8.2.33' =>
array (
'announcement' =>
diff --git a/include/version.inc b/include/version.inc
index e1ba94a178..d467b7d987 100644
--- a/include/version.inc
+++ b/include/version.inc
@@ -34,13 +34,13 @@ $RELEASES = (function () {
/* PHP 8.4 Release */
$data['8.4'] = [
- 'version' => '8.4.25',
- 'date' => '27 Aug 2026',
- 'tags' => [''], // Set to ['security'] for security
releases.
+ 'version' => '8.4.26',
+ 'date' => '24 Sep 2026',
+ 'tags' => ['security'], // Set to ['security'] for
security releases.
'sha256' => [
- 'tar.gz' =>
'5cde1da976b728fa09e6b549a4c8afcd0c180337028dacf34f73b11be50253db',
- 'tar.bz2' =>
'952ccc1785266b958f4a1dcfc580e08eabbb79f44222d1eff192bcd98d91f6e3',
- 'tar.xz' =>
'dc1ad8b4109898d9db49744450403874858c23efc685b1032a50bd1e83906848',
+ 'tar.gz' =>
'c248abaebc4bb777b80968f0760da0da8e989836e896c9ff637b6775d7d37662',
+ 'tar.bz2' =>
'4209694d7b0f63c45a3773e07cdc2bbfc71249265a5d951b1ff53e1147edc5ca',
+ 'tar.xz' =>
'32a2de53862ad44ed4a5005244ce4f1b50c271e74dced215449a4443b40569f1',
]
];
diff --git a/public/ChangeLog-8.php b/public/ChangeLog-8.php
index 33deec6b0b..ddd1f0b7ce 100644
--- a/public/ChangeLog-8.php
+++ b/public/ChangeLog-8.php
@@ -1466,6 +1466,153 @@
<a id="PHP_8_4"></a>
+<section class="version" id="8.4.26"><!-- {{{ 8.4.26 -->
+<h3>Version 8.4.26</h3>
+<b><?php release_date('24-Sep-2026'); ?></b>
+<ul><li>BCMath:
+<ul>
+ <li>Fixed out-of-bounds read in bc_is_zero_for_scale() when scale exceeds
n_scale.</li>
+</ul></li>
+<li>Core:
+<ul>
+ <li>Fixed out-of-bounds reads during automatic UTF-16/32 encoding detection.</li>
+ <li>Fixed bug <?php githubissuel('php/php-src', 15375); ?> (Nested
"yield from" skips items after a valid() or next() call on the inner
generator).</li>
+ <li>Fixed bug <?php githubissuel('php/php-src', 23232); ?> (lone namespace
separator asks the autoloader for an empty class name).</li>
+ <li>Fixed bug <?php githubissuel('php/php-src', 23301); ?> (Nested
"yield from" yields a value twice when the middle generator delegates again).</li>
+</ul></li>
+<li>CLI:
+<ul>
+ <li>Fixed bug <?php githubissuel('php/php-src', 23425); ?>
(sapi_cli_server_send_headers() does not check the return value of
php_cli_server_client_send_through()).</li>
+</ul></li>
+<li>DOM:
+<ul>
+ <li>Fixed NamedNodeMap::getNamedItemNS() with an empty URI not matching the null namespace
in spec-following mode.</li>
+ <li>Fixed a use-after-free when cloning a DOMNameSpaceNode after
DOMDocument::xinclude().</li>
+ <li>Fixed bug <?php githubissuel('php/php-src', 23331); ?> (UAF when
node_list_unlink() skips attribute children that still have a live wrapper).</li>
+ <li>Fixed a use-after-free when Dom\Element::setAttributeNS() replaces the value of an
attribute whose child still has a live wrapper.</li>
+</ul></li>
+<li>GD:
+<ul>
+ <li>Fixed imageaffinematrixget() and imageaffinematrixconcat() reporting the wrong argument
in error messages.</li>
+ <li>Fixed bug <?php githubissuel('php/php-src', 23457); ?> (imagebmp() is
extremely slow when writing to a file).</li>
+</ul></li>
+<li>FPM:
+<ul>
+ <li>Fixed bug <?php githubissuel('php/php-src', 19320); ?> (FPM UID and GID
overflow).</li>
+ <li>Fixed <?php githubsecurityl('php/php-src', '62xp-839h-2637');
?> (IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison).
(CVE-2026-91768)</li>
+</ul></li>
+<li>Hash:
+<ul>
+ <li>Fixed a buffer overflow in hash_pbkdf2() with a large output length.</li>
+</ul></li>
+<li>Intl:
+<ul>
+ <li>Fixed grapheme_strpos() and grapheme_strrpos() with an empty needle returning UTF-16
offsets instead of grapheme offsets.</li>
+ <li>Fixed a memory leak when dumping IntlCalendar instances.</li>
+ <li>Fixed a memory leak when iterating IntlBreakIterator::getPartsIterator()
results.</li>
+ <li>Fixed a double-free when IntlGregorianCalendar construction fails after the ICU
constructor adopts the TimeZone.</li>
+ <li>Fixed bug <?php githubissuel('php/php-src', 23094); ?> (NumberFormatter
parsing offsets use UTF-16 positions for UTF-8 strings).</li>
+ <li>Fixed Locale::parseLocale() reading past a trailing '-' or
'_'.</li>
+ <li>Fixed grapheme_str_split() treating UBRK_DONE as a byte index.</li>
+ <li>Fixed a leak in Locale::getKeywords() when a keyword value cannot be read.</li>
+ <li>Fixed a use-after-free when IntlRuleBasedBreakIterator is constructed from compiled
rules.</li>
+</ul></li>
+<li>MBString:
+<ul>
+ <li>Fixed mb_ereg_replace() emitting a NUL or out-of-bounds bytes in the replacement when a
\k<name> backref has no closing delimiter.</li>
+</ul></li>
+<li>MySQLnd:
+<ul>
+ <li>Fixed <?php githubsecurityl('php/php-src', 'r6x9-5r99-36j7');
?> (Various packet overreads in mysqlnd wire protocol). (CVE-2025-1218)</li>
+</ul></li>
+<li>ODBC:
+<ul>
+ <li>Fixed odbc_field_len(), odbc_field_scale() and odbc_field_type() returning
uninitialized memory when SQLColAttribute fails.</li>
+</ul></li>
+<li>Opcache:
+<ul>
+ <li>Fixed a crash when the huge page SHM remap discarded mappings outside the reserved
address range.</li>
+ <li>Fixed opcache.protect_memory race under ZTS.</li>
+ <li>Fixed bug <?php githubissuel('php/php-src', 23288); ?> (Crash on
restart when opcache.interned_strings_buffer is overridden in an individual FPM pool).</li>
+ <li>Fixed a tracing JIT crash when compiling a side trace for a method of a class that
could not be stored in the inheritance cache.</li>
+</ul></li>
+<li>OpenSSL:
+<ul>
+ <li>Fixed <?php githubsecurityl('php/php-src', 'vvx9-73fr-5jjx');
?> (TLS hostname verification falls back to CN after SAN mismatch). (CVE-2026-91769)</li>
+ <li>Fixed <?php githubsecurityl('php/php-src', 'xr7j-rvgx-xq5p');
?> (Heap buffer overflow in php_openssl_matches_wildcard_name() on crafted server certificate
wildcard CN). (CVE-2026-91767)</li>
+</ul></li>
+<li>PDO:
+<ul>
+ <li>Fixed a leak when a persistent connection failed a liveness check with no other live
PDO handle.</li>
+</ul></li>
+<li>PDO_ODBC:
+<ul>
+ <li>Fixed bug <?php githubissuel('php/php-src', 23444); ?>
(ODBC_ATTR_ASSUME_UTF8 corrupts Unicode data outside Windows).</li>
+</ul></li>
+<li>PDO_PGSQL:
+<ul>
+ <li>Fixed PDO::CURSOR_SCROLL statements closing a cursor that does not exist.</li>
+</ul></li>
+<li>PDO Sqlite:
+<ul>
+ <li>Fixed bug <?php githubissuel('php/php-src', 20214); ?>
(PDO::FETCH_DEFAULT unexpected behavior with PDOStatement::setFetchMode).</li>
+</ul></li>
+<li>Phar:
+<ul>
+ <li>Fixed bug <?php githubissuel('php/php-src', 23418); ?> (Use-after-free
when looking up mounted directories).</li>
+ <li>Fixed bug <?php githubissuel('php/php-src', 23477); ?> (Memory leak on
duplicate native Phar manifest entries).</li>
+ <li>Fixed <?php githubsecurityl('php/php-src', 'j3wh-g957-2m85');
?> (Integer overflow in phar_tar_number() allowing TAR archive entry injection).
(CVE-2026-6103)</li>
+</ul></li>
+<li>SNMP:
+<ul>
+ <li>Fixed bug <?php githubissuel('php/php-src', 23453); ?>
(SNMP::setSecurity() frees a non-malloced address with a context engine ID longer than 32
bytes).</li>
+</ul></li>
+<li>SOAP:
+<ul>
+ <li>Fixed bug <?php githubissuel('php/php-src', 23447); ?> (Segfault when a
class passed to SoapServer::setClass() fails to initialize).</li>
+ <li>Fixed WSDL cache corruption when a soap:header defines headerfaults.</li>
+ <li>Fixed stack overflow when parsing a WSDL with self-referential schema groups or
attributeGroups.</li>
+ <li>Fixed <?php githubsecurityl('php/php-src', 'rgrp-mwpx-f6rm');
?> (Unbounded recursion in server-side cleanup_xml_node()). (CVE-2026-91765)</li>
+ <li>Fixed <?php githubsecurityl('php/php-src', 'cj93-vc83-wgqv');
?> (Integer overflow to buffer overflow in SOAP HTTP parsing). (CVE-2025-14181)</li>
+</ul></li>
+<li>Standard:
+<ul>
+ <li>Fixed a segfault when a stream filter callback unsets StreamBucket::$data before
re-attaching the bucket.</li>
+ <li>Fixed <?php githubsecurityl('php/php-src', '7875-c8px-7q5f');
?> (Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty
Location header). (CVE-2026-93682)</li>
+ <li>Fixed a memory leak in array_merge_recursive() when the recursive merge of an object
converted to an array fails.</li>
+ <li>Fixed read buffer compaction in php_stream_filter_flush().</li>
+ <li>Fixed bug <?php githubissuel('php/php-src', 22410); ?> (Incorrect float
behavior with large numbers).</li>
+ <li>Fixed <?php githubissuel('php/php-src', 23338); ?>
(fsockopen()/pfsockopen() ValueError reported wrong argument number for $timeout).</li>
+ <li>Fixed bug <?php githubissuel('php/php-src', 23576); ?> (Next index for
array returned from array_keys() is wrong).</li>
+ <li>Fixed <?php githubsecurityl('php/php-src', '88hq-2827-7pg6');
?> (Out-of-bounds read in convert.* stream filters when line-break-chars contains NUL).
(CVE-2026-92842)</li>
+ <li>Fixed <?php githubsecurityl('php/php-src', 'fpwc-w8rq-cr92');
?> (Cross-origin credential leak in HTTP stream wrapper redirects). (CVE-2026-91766)</li>
+</ul></li>
+<li>SimpleXML:
+<ul>
+ <li>Fixed writing to a dimension of the object returned by attributes() not creating the
attribute.</li>
+ <li>Fixed child elements of the element returned by SimpleXMLElement::addChild() not being
accessible by property name when namespaces are involved.</li>
+</ul></li>
+<li>Windows:
+<ul>
+ <li>Fixed <?php githubsecurityl('php/php-src', '9f67-6fw4-hpfp');
?> (Reserved device names are not rejected before file and stream I/O).
(CVE-2026-17545)</li>
+</ul></li>
+<li>Zip:
+<ul>
+ <li>Fixed bug <?php githubissuel('php/php-src', 23276); ?> (ZipArchive
subclass storing its own stream cannot be garbage collected).</li>
+ <li>Fixed ZipArchive::extractTo() and ZipArchive::getFrom*() reporting success on corrupted
entries.</li>
+ <li>Fixed ZipArchive::getNameIndex() truncating the entry index to int.</li>
+ <li>Fixed fstat() on a zip:// stream reporting success when the archive cannot be
opened.</li>
+</ul></li>
+<li>SAPI:
+<ul>
+ <li>Fixed fuzzer targets failing to build in isolation.</li>
+ <li>Fixed returns uninitialized value on LiteSpeed lsapi SAPI (Go Kudo)</li>
+</ul></li>
+</ul>
+<!-- }}} --></section>
+
+
+
<section class="version" id="8.4.25"><!-- {{{ 8.4.25 -->
<h3>Version 8.4.25</h3>
<b><?php release_date('27-Aug-2026'); ?></b>
diff --git a/public/archive/archive.xml b/public/archive/archive.xml
index d571efbb19..d4c7137d01 100644
--- a/public/archive/archive.xml
+++ b/public/archive/archive.xml
@@ -9,6 +9,7 @@
<uri>http://php.net/contact</uri>
<email>php-webmaster@lists.php.net</email>
</author>
+ <xi:include href="entries/2026-09-24-5.xml"/>
<xi:include href="entries/2026-09-24-4.xml"/>
<xi:include href="entries/2026-09-24-3.xml"/>
<xi:include href="entries/2026-09-24-2.xml"/>
diff --git a/public/archive/entries/2026-09-24-5.xml b/public/archive/entries/2026-09-24-5.xml
new file mode 100644
index 0000000000..74a65822bb
--- /dev/null
+++ b/public/archive/entries/2026-09-24-5.xml
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="utf-8"?>
+<entry xmlns="http://www.w3.org/2005/Atom">
+ <title>PHP 8.4.26 Released!</title>
+ <id>https://www.php.net/archive/2026.php#2026-09-24-5</id>
+ <published>2026-09-24T15:26:06+00:00</published>
+ <updated>2026-09-24T15:26:06+00:00</updated>
+ <link href="https://www.php.net/index.php#2026-09-24-5"
rel="alternate" type="text/html"/>
+ <link href="https://www.php.net/archive/2026.php#2026-09-24-5"
rel="via" type="text/html"/>
+ <category term="releases" label="New PHP release"/>
+ <category term="frontpage" label="PHP.net frontpage news"/>
+ <content type="xhtml">
+ <div xmlns="http://www.w3.org/1999/xhtml"><p>The PHP
development team announces the immediate availability of PHP 8.4.26. This is a security
release.</p>
+
+<p>All PHP 8.4 users are encouraged to upgrade to this version.</p>
+
+<p>For source downloads of PHP 8.4.26 please visit our <a href="https://www.php.net/downloads.php">downloads
page</a>,
+Windows source and binaries can also be found <a href="https://www.php.net/downloads.php?os=windows&version=8.4">there</a>.
+The list of changes is recorded in the <a href="https://www.php.net/ChangeLog-8.php#8.4.26">ChangeLog</a>.
+</p> </div>
+ </content>
+</entry>
diff --git a/public/releases/8_4_26.php b/public/releases/8_4_26.php
new file mode 100644
index 0000000000..27dc175f17
--- /dev/null
+++ b/public/releases/8_4_26.php
@@ -0,0 +1,16 @@
+<?php
+$_SERVER['BASE_PAGE'] = 'releases/8_4_26.php';
+require_once __DIR__ . '/../../include/prepend.inc';
+site_header('PHP 8.4.26 Release Announcement', ['cache' => true,
'cache_control' => 30 * 60]);
+?>
+<h1>PHP 8.4.26 Release Announcement</h1>
+
+<p>The PHP development team announces the immediate availability of PHP 8.4.26. This is a
security release.</p>
+
+<p>All PHP 8.4 users are encouraged to upgrade to this version.</p>
+
+<p>For source downloads of PHP 8.4.26 please visit our <a href="https://www.php.net/downloads.php">downloads
page</a>,
+Windows source and binaries can also be found <a href="https://www.php.net/downloads.php?os=windows&version=8.4">there</a>.
+The list of changes is recorded in the <a href="https://www.php.net/ChangeLog-8.php#8.4.26">ChangeLog</a>.
+</p>
+<?php site_footer();