[web-php] master: Announce PHP 8.4.27

Author: Daniel Scherzer (DanielEScherzer) Date: 2026-10-21T05:59:20-07:00 Commit: https://github.com/php/web-php/commit/c69ad6253d2bf4e68b1f0216186c64b8a76491a9 Raw diff: https://github.com/php/web-php/commit/c69ad6253d2bf4e68b1f0216186c64b8a76491a9.diff Announce PHP 8.4.27 Changed paths: A public/archive/entries/2026-10-21-3.xml A public/releases/8_4_27.php M include/release-qa.php M include/releases.inc M include/version.inc M public/ChangeLog-8.php M public/archive/archive.xml Diff: diff --git a/include/release-qa.php b/include/release-qa.php index 851e112561..2391233499 100644 --- a/include/release-qa.php +++ b/include/release-qa.php @@ -75,10 +75,10 @@ 'active' => true, 'release' => [ 'type' => 'RC', - 'number' => 1, - 'sha256_bz2' => '50e9b8f99df25f9290030dd0a273ff5aeeee324593da5f34c2435f5b24caa4df', - 'sha256_gz' => '877bffdf6a65e61b9375e6bdabc1be30fd444887e7c2ca9916573a637a623540', - 'sha256_xz' => '40b5d8682e1789e54347714ba8c0d71817c2b8b377120c3f6c43b749dd39b74e', + 'number' => 0, + 'sha256_bz2' => '', + 'sha256_gz' => '', + 'sha256_xz' => '', 'date' => '08 October 2026', 'baseurl' => 'https://downloads.php.net/~calvinb/', ], diff --git a/include/releases.inc b/include/releases.inc index 4bc7dc6726..d90f5ec14e 100644 --- a/include/releases.inc +++ b/include/releases.inc @@ -2,6 +2,43 @@ $OLDRELEASES = array ( 8 => array ( + '8.4.26' => + array ( + 'announcement' => + array ( + 'English' => '/releases/8_4_26.php', + ), + 'tags' => + array ( + 0 => 'security', + ), + 'date' => '24 Sep 2026', + 'source' => + array ( + 0 => + array ( + 'filename' => 'php-8.4.26.tar.gz', + 'name' => 'PHP 8.4.26 (tar.gz)', + 'sha256' => 'c248abaebc4bb777b80968f0760da0da8e989836e896c9ff637b6775d7d37662', + 'date' => '24 Sep 2026', + ), + 1 => + array ( + 'filename' => 'php-8.4.26.tar.bz2', + 'name' => 'PHP 8.4.26 (tar.bz2)', + 'sha256' => '4209694d7b0f63c45a3773e07cdc2bbfc71249265a5d951b1ff53e1147edc5ca', + 'date' => '24 Sep 2026', + ), + 2 => + array ( + 'filename' => 'php-8.4.26.tar.xz', + 'name' => 'PHP 8.4.26 (tar.xz)', + 'sha256' => '32a2de53862ad44ed4a5005244ce4f1b50c271e74dced215449a4443b40569f1', + 'date' => '24 Sep 2026', + ), + ), + 'museum' => false, + ), '8.3.35' => array ( 'announcement' => diff --git a/include/version.inc b/include/version.inc index fd22b25c4c..d2f0473ced 100644 --- a/include/version.inc +++ b/include/version.inc @@ -34,13 +34,13 @@ $RELEASES = (function () { /* PHP 8.4 Release */ $data['8.4'] = [ - 'version' => '8.4.26', - 'date' => '24 Sep 2026', + 'version' => '8.4.27', + 'date' => '21 Oct 2026', 'tags' => ['security'], // Set to ['security'] for security releases. 'sha256' => [ - 'tar.gz' => 'c248abaebc4bb777b80968f0760da0da8e989836e896c9ff637b6775d7d37662', - 'tar.bz2' => '4209694d7b0f63c45a3773e07cdc2bbfc71249265a5d951b1ff53e1147edc5ca', - 'tar.xz' => '32a2de53862ad44ed4a5005244ce4f1b50c271e74dced215449a4443b40569f1', + 'tar.gz' => '5bafed9994c1a49796b25b5f61c22c9183bfe046b6acc7b363842d03c77f972f', + 'tar.bz2' => 'b2530a877c722f4b08c9e174a30cb08bac2b7e1903ee6e9e315f0aa9f5f82c24', + 'tar.xz' => 'dcf93923b0e38e0d5252b25b796520b5a47761a08b3488b6d0b5d1115764d3f0', ] ]; diff --git a/public/ChangeLog-8.php b/public/ChangeLog-8.php index c07c4afce4..0ab515e8f7 100644 --- a/public/ChangeLog-8.php +++ b/public/ChangeLog-8.php @@ -1466,6 +1466,193 @@ <a id="PHP_8_4"></a> +<section class="version" id="8.4.27"><!-- {{{ 8.4.27 --> +<h3>Version 8.4.27</h3> +<b><?php release_date('22-Oct-2026'); ?></b> +<ul><li>Core: +<ul> + <li>Fixed <?php githubsecurityl('php/php-src', 'w8hw-w9fx-j79w'); ?>, <?php githubsecurityl('php/php-src', '6wmf-4rv5-p3rp'); ?> (Avoid state corruption via bailout).</li> + <li>Fix <?php githubissuel('php/php-src', 21999); ?>: GC inconsistency with lazy object, var_dump(), and object comparison.</li> + <li>Fixed OSS-Fuzz #536440507 (Immutable class incorrect assertion).</li> + <li>Fixed AVX being reported as supported when the OS has not enabled AVX state.</li> + <li>Fixed <?php githubissuel('php/php-src', 23980); ?> (ZEND_ASSERT violation @ ZEND_INCLUDE_OR_EVAL).</li> + <li>Fixed bug <?php githubissuel('php/php-src', 23896); ?> (Assertion failure in zend_call_function() after a throwing deprecation).</li> + <li>Fixed use-after-free when a dl()-loaded extension declares a frameless function and a later request calls it.</li> + <li>Fixed System V shared memory emulation for Windows attaching segments past the end of their mapping.</li> + <li>Fixed bug <?php githubissuel('php/php-src', 24050); ?> (GC frees an object still held by a resurrected closure when (object) and use share an array).</li> + <li>Fixed exception thrown by destructor during GC in a Fiber not being rethrown into the frame that triggered the GC.</li> +</ul></li> +<li>BCMath: +<ul> + <li>Fixed BcMath\Number results that truncate to zero keeping a negative sign and comparing less than zero.</li> +</ul></li> +<li>BZ2: +<ul> + <li>Fixed double close of the descriptor and use-after-free of the inner stream when bzopen() is given a stream resource.</li> +</ul></li> +<li>CLI: +<ul> + <li>Fix <?php githubissuel('php/php-src', 22567); ?> (Windows ZTS CLI SAPI should refresh its TSRMLS cache during request activation).</li> + <li>Fixed bug <?php githubissuel('php/php-src', 23764); ?> (Built-in server leaks a file descriptor on every HEAD request for a static file).</li> + <li>Fixed crash in the built-in server when a client is reset before being accepted.</li> + <li>Fixed the built-in server truncating an error page and leaking its unsent part after a partial socket write.</li> +</ul></li> +<li>DOM: +<ul> + <li>Fixed use-after-free when re-constructing a DOMXPath whose php:function registrations are freed while still reachable from the cycle collector.</li> + <li>Fixed bug <?php githubissuel('php/php-src', 23365); ?> (DOMNode::insertBefore($n, $n) drops the node and leaves a self-referencing sibling list).</li> + <li>Fixed Dom\HTMLDocument::getElementById() not finding ids of SVG and MathML elements.</li> + <li>Fixed Dom\HTMLDocument giving attributes the namespace of their element when a fragment is parsed with an xlink, xml or xmlns context element.</li> + <li>Fixed bug <?php githubissuel('php/php-src', 23729); ?> (DOMXPath::__construct() use-after-free during an evaluation).</li> + <li>Fixed bug <?php githubissuel('php/php-src', 23897); ?> (php:function() assertion failure after a failed registerPHPFunctions()).</li> + <li>Fixed DOMXPath and Dom\XPath losing the context node and in-scope namespaces of an evaluation after a php:function() callback evaluated another expression on the same object.</li> +</ul></li> +<li>FFI: +<ul> + <li>Fixed crashes with FFI callbacks created from __call() trampolines and array callables whose object is released.</li> +</ul></li> +<li>FTP: +<ul> + <li>Fixed bug <?php githubissuel('php/php-src', 23619); ?> (cryptic error on servers that don't support TLS session resumption on data connection).</li> +</ul></li> +<li>GD: +<ul> + <li>Fixed undefined behavior with GD2 images with INT_MAX-sized chunks.</li> + <li>Fixed undefined behavior with GIFs with problematic LZW compression data.</li> +</ul></li> +<li>Intl: +<ul> + <li>Fixed IntlDateFormatter::parse(), localtime() and parseToCalendar() treating the offset as UTF-16 code units instead of bytes.</li> + <li>Fixed cloning IntlDateFormatter and MessageFormatter losing PHP-side state such as dateType, timeType, calendar and the message pattern.</li> + <li>Fixed Collator attribute and strength methods not rejecting an unconstructed Collator.</li> + <li>Fixed grapheme_strstr() and grapheme_stristr() returning incorrect substrings when supplementary characters precede the match.</li> + <li>Fixed grapheme_strstr() and grapheme_strpos() missing canonically equivalent matches, and grapheme searches reporting ICU errors for empty haystacks.</li> + <li>Fixed grapheme_strrpos() and grapheme_strripos() skipping overlapping matches when using a negative offset.</li> +</ul></li> +<li>Lexbor: +<ul> + <li>Merge patches lexbor/lexbor@8a14bc0 and lexbor/lexbor@f67ce4b, fixing a heap buffer overflow in :lexbor-contains() parsing and buffer overflows in malformed decode replay.</li> +</ul></li> +<li>MBString: +<ul> + <li>Fixed bug <?php githubissuel('php/php-src', 23106); ?> (mb_strpos() reads past the end of a haystack ending in a truncated UTF-8 sequence).</li> + <li>Fixed mbstring functions emitting surrogates in UTF-8 output and flagging it as valid UTF-8.</li> +</ul></li> +<li>MySQLi: +<ul> + <li>Fix <?php githubissuel('php/php-src', 22854); ?>: Fixed failed assertion when accessing mysqli property after failed reconnection.</li> +</ul></li> +<li>MySQLnd: +<ul> + <li>Fixed field_count not resetting on OK packet.</li> + <li>Fixed memory leak when closing a prepared statement after its connection was killed.</li> +</ul></li> +<li>Opcache: +<ul> + <li>Fixed OSS-Fuzz #546798343 (Heap-buffer-overflow in optimizer with FCCs and inlining).</li> + <li>Fixed bug <?php githubissuel('php/php-src', 23693); ?> (Tracing JIT produces wrong results for a guard on a loop-invariant addition).</li> + <li>Fixed OSS-Fuzz #5674034779193344 (Read of uninitialized memory in is_cacheable_stream_path()).</li> + <li>Fix zend_analyze_calls() call_stack buffer overrun.</li> + <li>Fixed bug <?php githubissuel('php/php-src', 23637); ?> (PHP-FPM worker SIGSEGV: run_time_cache map_ptr offset beyond CG(map_ptr_last) when a class is reached through the CE cache).</li> + <li>Fix multiple incorrect DCE due to unsound escape analysis.</li> + <li>Fixed bug <?php githubissuel('php/php-src', 24063); ?> (OPcache optimizer folds $cond ? -0.0 : 0.0 into a single -0.0 constant).</li> + <li>Fixed crash when a file cache is reused with a different set of extensions declaring frameless functions.</li> + <li>Fixed bug <?php githubissuel('php/php-src', 23991); ?> (JIT generates invalid IR for multiple recursive calls).</li> + <li>Fix SCCP evaluation of isset()/empty() on dimension of non-escaping object.</li> +</ul></li> +<li>OpenSSL: +<ul> + <li>Fixed stream_socket_enable_crypto() leaving the socket non-blocking after a handshake timeout.</li> + <li>Fixed feof() on a TLS stream staying false after a close_notify on Windows.</li> +</ul></li> +<li>PCNTL: +<ul> + <li>Fixed pcntl_signal_dispatch() dropping the queued signals when it runs while an exception is pending.</li> + <li>Fixed pcntl_signal_dispatch() dropping the signals queued behind a handler that throws.</li> + <li>Fixed pcntl_setcpuaffinity() error message advertising the cpu count as the inclusive upper bound.</li> + <li>Fixed pcntl_setqos_class() requiring its optional $qos_class argument.</li> + <li>Fixed bug <?php githubissuel('php/php-src', 23986); ?> (/proc/self paths resolve to the parent process after pcntl_fork()).</li> +</ul></li> +<li>PDO: +<ul> + <li>Fixed PDOStatement::getColumnMeta() reading out of bounds for an invalid column index.</li> + <li>Fixed PDOStatement::bindColumn() registering a binding for a column name that is not in the result set.</li> + <li>Fixed PDOStatement::execute() leaving the previous result available after a failed execution.</li> + <li>Fixed a use-after-free when bindValue()/execute()/closeCursor() is called from a bound parameter's __toString() during execute().</li> + <li>Fixed bug <?php githubissuel('php/php-src', 23962); ?> (Destroying a persistent PDO instance rolls back a transaction still in use by another instance).</li> + <li>Fixed PDO::setAttribute() installing a PDO::ATTR_STATEMENT_CLASS class whose constructor arguments it rejects.</li> + <li>Fixed PDO::ATTR_STATEMENT_CLASS constructor_args type errors reporting "array given" regardless of the value passed.</li> + <li>Fixed PDOStatement::bindParam() and bindColumn() leaking the driver options value.</li> + <li>Fixed PDOStatement not reporting its bound parameters and columns to the cycle collector.</li> + <li>Fixed PDOStatement::setFetchMode() not applying changes atomically.</li> +</ul></li> +<li>PDO_DBLIB: +<ul> + <li>Fixed bug <?php githubissuel('php/php-src', 23741); ?> (segfault after a failed query inside a PDO transaction). Errors raised by beginTransaction(), commit(), rollBack() and lastInsertId() are now reported instead of being dropped.</li> +</ul></li> +<li>PDO_Firebird: +<ul> + <li>Fixed bug <?php githubissuel('php/php-src', 23758); ?> (PDO_Firebird returns null for non-null empty BLOBs).</li> +</ul></li> +<li>Readline: +<ul> + <li>Fixed a heap over-read in the interactive shell prompt when cli.prompt is set to an empty string.</li> +</ul></li> +<li>Session: +<ul> + <li>Fixed session_start() continuing after a failed create_sid() when session.use_strict_mode rejects the supplied ID.</li> + <li>Fixed exceptions from user-defined create_sid() handlers being replaced by return-value validation errors.</li> +</ul></li> +<li>SimpleXML: +<ul> + <li>Fixed reconstructing a SimpleXMLElement freeing a child element that another variable still references.</li> +</ul></li> +<li>SOAP: +<ul> + <li>Fixed bug <?php githubissuel('php/php-src', 22895); ?> (Heap use-after-free while encoding a Traversable with an illegal key).</li> + <li>Fixed memory leak when load_wsdl_ex() failed to load.</li> +</ul></li> +<li>Sockets: +<ul> + <li>Fixed socket_select() silently truncating sets larger than FD_SETSIZE on Windows.</li> +</ul></li> +<li>SPL: +<ul> + <li>Fixed SplFixedArray::setSize() doing nothing on subclasses whose constructor does not call parent::__construct().</li> + <li>Fixed memory leak when __construct(), __wakeup() or __unserialize() is called from an element destructor during setSize(0).</li> +</ul></li> +<li>SQLite: +<ul> + <li>Fixed a crash when SQLite3::close() is called from a userland callback.</li> +</ul></li> +<li>Standard: +<ul> + <li>Fixed sha1_file() returning a digest for incomplete data after a stream read failure.</li> + <li>Fixed iptcembed() corrupting JPEG headers when called recursively from an output handler.</li> + <li>Fixed proc_open() leaking descriptor zero when descriptor setup fails.</li> + <li>Fixed three Windows-only proc_open() defects: an uninitialized PROCESS_INFORMATION, an indeterminate comspec pointer after a failed lookup, and an unchecked CreateFileA() failure.</li> + <li>Fix persistent stream context lifetime during shutdown (Levi Morrison)</li> + <li>Fix wordwrap() ignoring an existing break at the end of the string (Nicolas Grekas)</li> + <li>Fixed convert.quoted-printable-decode decoding lowercase hex digits to the wrong byte.</li> +</ul></li> +<li>Tidy: +<ul> + <li>Fixed a use-after-free when a tidyNode is used after its document is reparsed.</li> +</ul></li> +<li>XSL: +<ul> + <li>Fixed bug <?php githubissuel('php/php-src', 23730); ?> (use-after-free when XSLTProcessor::importStylesheet() is called during a transformation).</li> +</ul></li> +<li>Zip: +<ul> + <li>Fixed ZipArchive::extractTo() ignoring files given in a non-list array.</li> + <li>Fixed bug <?php githubissuel('php/php-src', 23747); ?> (ZipArchive::close() use-after-free from a progress or cancel callback).</li> +</ul></li> +</ul> +<!-- }}} --></section> + + + <section class="version" id="8.4.26"><!-- {{{ 8.4.26 --> <h3>Version 8.4.26</h3> <b><?php release_date('24-Sep-2026'); ?></b> diff --git a/public/archive/archive.xml b/public/archive/archive.xml index 91b2d5523e..8a81945105 100644 --- a/public/archive/archive.xml +++ b/public/archive/archive.xml @@ -9,6 +9,7 @@ <uri>http://php.net/contact</uri> <email>php-webmaster@lists.php.net</email> </author> + <xi:include href="entries/2026-10-21-3.xml"/> <xi:include href="entries/2026-10-21-2.xml"/> <xi:include href="entries/2026-10-21-1.xml"/> <xi:include href="entries/2026-10-20-1.xml"/> diff --git a/public/archive/entries/2026-10-21-3.xml b/public/archive/entries/2026-10-21-3.xml new file mode 100644 index 0000000000..c4b83a5f41 --- /dev/null +++ b/public/archive/entries/2026-10-21-3.xml @@ -0,0 +1,32 @@ +<?xml version="1.0" encoding="utf-8"?> +<entry xmlns="http://www.w3.org/2005/Atom"> + <title>PHP 8.4.27 Released!</title> + <id>https://www.php.net/archive/2026.php#2026-10-21-3</id> + <published>2026-10-21T00:20:54+00:00</published> + <updated>2026-10-21T00:20:54+00:00</updated> + <link href="https://www.php.net/index.php#2026-10-21-3" rel="alternate" type="text/html"/> + <link href="https://www.php.net/archive/2026.php#2026-10-21-3" rel="via" type="text/html"/> + <category term="releases" label="New PHP release"/> + <category term="frontpage" label="PHP.net frontpage news"/> + <content type="xhtml"> + <div xmlns="http://www.w3.org/1999/xhtml"> +<p> + The PHP development team announces the immediate availability of PHP 8.4.27. + <strong> + This is a security release fixing two critical vulnerabilities + (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote + code execution. All PHP 8.4 users are strongly encouraged to update immediately. + </strong> +</p> + +<p> + There are no complete mitigations, updating is the only safe choice. See the + <a href="https://www.php.net/archive/2026.php#2026-10-21-5">security advisory</a> for details. +</p> + +<p>For source downloads of PHP 8.4.27 please visit our <a href="https://www.php.net/downloads.php">downloads page</a>, +Windows source and binaries can also be found <a href="https://www.php.net/downloads.php?os=windows&amp;version=8.4">there</a>. +The list of changes is recorded in the <a href="https://www.php.net/ChangeLog-8.php#8.4.27">ChangeLog</a>. +</p> </div> + </content> +</entry> diff --git a/public/releases/8_4_27.php b/public/releases/8_4_27.php new file mode 100644 index 0000000000..620b0691f0 --- /dev/null +++ b/public/releases/8_4_27.php @@ -0,0 +1,16 @@ +<?php +$_SERVER['BASE_PAGE'] = 'releases/8_4_27.php'; +require_once __DIR__ . '/../../include/prepend.inc'; +site_header('PHP 8.4.27 Release Announcement', ['cache' => true, 'cache_control' => 30 * 60]); +?> +<h1>PHP 8.4.27 Release Announcement</h1> + +<p>The PHP development team announces the immediate availability of PHP 8.4.27. This is a security release.</p> + +<p>All PHP 8.4 users are encouraged to upgrade to this version.</p> + +<p>For source downloads of PHP 8.4.27 please visit our <a href="https://www.php.net/downloads.php">downloads page</a>, +Windows source and binaries can also be found <a href="https://www.php.net/downloads.php?os=windows&amp;version=8.4">there</a>. +The list of changes is recorded in the <a href="https://www.php.net/ChangeLog-8.php#8.4.27">ChangeLog</a>. +</p> +<?php site_footer();