PHP Release 5.6.18


    PHP 5.6.18 Release Announcement

    The PHP development team announces the immediate availability of PHP 5.6.18. This is a security release. Several security bugs were fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version.

    For source downloads of PHP 5.6.18 please visit our downloads page, Windows binaries can be found on windows.php.net/download/. The list of changes is recorded in the ChangeLog.

    Source Code
    PHP 5.6.18 (tar.bz2)
    SHA256: c3cd4a29a9562309d36e2b128407d6eaa5c7dde590d2b1a464457383e517f4ed
    PHP 5.6.18 (tar.gz)
    SHA256: 76da4150dc2da86b7b63b1aad3c20d1d11964796251ac0dd4d26d0a3f5045015
    PHP 5.6.18 (tar.xz)
    SHA256: 54dd9106c3469bc7028644d72ac140af00655420bbaaf4a742a64e9ed02ec1b0
    Change Logs
    core
    • Fixed bug #71039 (exec functions ignore length but look for NULL termination).
    • Fixed bug #71089 (No check to duplicate zend_extension).
    • Fixed bug #71201 (round() segfault on 64-bit builds).
    • Added support for new HTTP 451 code.
    • Fixed bug #71273 (A wrong ext directory setup in php.ini leads to crash).
    • Fixed bug #71323 (Output of stream_get_meta_data can be falsified by its input).
    • Fixed bug #71459 (Integer overflow in iptcembed()).
    apache2handler
    • Fix >2G Content-Length headers in apache2handler.
    ftp
    • Implemented FR #55651 (Option to ignore the returned FTP PASV address).
    opcache
    • Fixed bug #71127 (Define in auto_prepend_file is overwrite).
    • Fixed bug #71024 (Unable to use PHP 7.0 x64 side-by-side with PHP 5.6 x32 on the same server).
    pcre
    • Upgraded bundled PCRE library to 8.38.
    phar
    • Fixed bug #71354 (Heap corruption in tar/zip/phar parser). (CVE-2016-4342)
    • Fixed bug #71331 (Uninitialized pointer in phar_make_dirstream()). (CVE-2016-4343)
    • Fixed bug #71391 (NULL Pointer Dereference in phar_tar_setupmetadata()).
    • Fixed bug #71488 (Stack overflow when decompressing tar archives). (CVE-2016-2554)
    session
    • Fixed bug #69111 (Crash in SessionHandler::read()).
    soap
    • Fixed bug #70979 (crash with bad soap request).
    spl
    • Fixed bug #71204 (segfault if clean spl_autoload_funcs while autoloading).
    wddx
    • Fixed bug #71335 (Type Confusion in WDDX Packet Deserialization).
    PHP logo

    PHP is developed and maintained by a global community of contributors.

    The PHP Foundation helps fund this work. If PHP is part of your business or projects, consider sponsoring the Foundation.
    PHP

    Learn

    The PHP Foundation

    Legal

    Copyright © 2001 - 2026 the PHP Group. All Rights Reserved.
    To Top