PHP Release 5.6.26


    PHP 5.6.26 Release Announcement

    The PHP development team announces the immediate availability of PHP 5.6.26. This is a security release. Several security bugs were fixed in this release. All PHP 5.6 users are encouraged to upgrade to this version.

    For source downloads of PHP 5.6.26 please visit our downloads page, Windows source and binaries can be found on windows.php.net/download/. The list of changes is recorded in the ChangeLog.

    Source Code
    PHP 5.6.26 (tar.bz2)
    SHA256: d47aab8083a4284b905777e1b45dd7735adc53be827b29f896684750ac8b6236
    PHP 5.6.26 (tar.gz)
    SHA256: f76b6cc23739d9dabf875aee57d91ae73f15e88ddf78803369b8b4728b19b924
    PHP 5.6.26 (tar.xz)
    SHA256: 203a854f0f243cb2810d1c832bc871ff133eccdf1ff69d32846f93bc1bef58a8
    Change Logs
    core
    • Fixed bug #72907 (null pointer deref, segfault in gc_remove_zval_from_buffer (zend_gc.c:260)).
    dba
    • Fixed bug #71514 (Bad dba_replace condition because of wrong API usage).
    • Fixed bug #70825 (Cannot fetch multiple values with group in ini file).
    exif
    • Fixed bug #72926 (Uninitialized Thumbail Data Leads To Memory Leakage in exif_process_IFD_in_TIFF).
    ftp
    • Fixed bug #70195 (Cannot upload file using ftp_put to FTPES with require_ssl_reuse).
    gd
    • Fixed bug #66005 (imagecopy does not support 1bit transparency on truecolor images).
    • Fixed bug #72913 (imagecopy() loses single-color transparency on palette images).
    • Fixed bug #68716 (possible resource leaks in _php_image_convert()).
    intl
    • Fixed bug #73007 (add locale length check).
    json
    • Fixed bug #72787 (json_decode reads out of bounds).
    mbstring
    • Fixed bug #66797 (mb_substr only takes 32-bit signed integer).
    • Fixed bug #72910 (Out of bounds heap read in mbc_to_code() / triggered by mb_ereg_match()).
    mssql
    • Fixed bug #72039 (Use of uninitialised value on mssql_guid_string).
    mysqlnd
    • Fixed bug #72293 (Heap overflow in mysqlnd related to BIT fields).
    phar
    • Fixed bug #72928 (Out of bound when verify signature of zip phar in phar_parse_zipfile).
    • Fixed bug #73035 (Out of bound when verify signature of tar phar in phar_parse_tarfile).
    pdo
    • Fixed bug #60665 (call to empty() on NULL result using PDO::FETCH_LAZY returns false).
    pdo_pgsql
    • Implemented FR #72633 (Postgres PDO lastInsertId() should work without specifying a sequence).
    • Fixed bug #72759 (Regression in pgo_pgsql).
    spl
    • Fixed bug #73029 (Missing type check when unserializing SplArray).
    standard
    • Fixed bug #72823 (strtr out-of-bound access).
    • Fixed bug #72278 (getimagesize returning FALSE on valid jpg).
    • Fixed bug #65550 (get_browser() incorrectly parses entries with "+" sign).
    • Fixed bug #71882 (Negative ftruncate() on php://memory exhausts memory).
    • Fixed bug #73011 (integer overflow in fgets cause heap corruption).
    • Fixed bug #73017 (memory corruption in wordwrap function).
    • Fixed bug #73045 (integer overflow in fgetcsv caused heap corruption).
    • Fixed bug #73052 (Memory Corruption in During Deserialized-object Destruction)
    streams
    • Fixed bug #72853 (stream_set_blocking doesn't work).
    wddx
    • Fixed bug #72860 (wddx_deserialize use-after-free).
    • Fixed bug #73065 (Out-Of-Bounds Read in php_wddx_push_element).
    xml
    • Fixed bug #72085 (SEGV on unknown address zif_xml_parse).
    • Fixed bug #72927 (integer overflow in xml_utf8_encode).
    zip
    • Fixed bug #68302 (impossible to compile php with zip support).
    PHP logo

    PHP is developed and maintained by a global community of contributors.

    The PHP Foundation helps fund this work. If PHP is part of your business or projects, consider sponsoring the Foundation.
    PHP

    Learn

    The PHP Foundation

    Legal

    Copyright © 2001 - 2026 the PHP Group. All Rights Reserved.
    To Top