5.6 has reached end-of-life and will no longer receive
bugfixes or security patches from the PHP Project. Some downstream distributions may still continue to provide
backported fixes for a time, depending on their support policy.
Fixed bug #70958 (Invalid opcode while using ::class as trait method paramater default value).
Fixed bug #70957 (self::class can not be resolved with reflection for abstract class).
Fixed bug #70944 (try{ } finally{} can create infinite chains of exceptions).
Fixed bug #61751 (SAPI build problem on AIX: Undefined symbol: php_register_internal_extensions).
fpm
Fixed bug #70755 (fpm_log.c memory leak and buffer overflow).
gd
Fixed bug #70976 (Memory Read via gdImageRotateInterpolated Array Index Out of Bounds). (CVE-2016-1903)
mysqlnd
Fixed bug #68077 (LOAD DATA LOCAL INFILE / open_basedir restriction).
soap
Fixed bug #70900 (SoapClient systematic out of memory error).
standard
Fixed bug #70960 (ReflectionFunction for array_unique returns wrong number of parameters).
pdo_firebird
Fixed bug #60052 (Integer returned as a 64bit integer on X64_86).
wddx
Fixed bug #70661 (Use After Free Vulnerability in WDDX Packet Deserialization).
Fixed bug #70741 (Session WDDX Packet Deserialization Type Confusion Vulnerability).
xmlrpc
Fixed bug #70728 (Type Confusion Vulnerability in PHP_to_XMLRPC_worker()).
PHP 5.6.16
Released 26 Nov, 2015
core
Fixed bug #70828 (php-fpm 5.6 with opcache crashes when referencing a non-existent constant).
Fixed bug #70748 (Segfault in ini_lex () at Zend/zend_ini_scanner.l).
mysqlnd
Fixed bug #68344 (MySQLi does not provide way to disable peer certificate validation) by introducing MYSQLI_CLIENT_SSL_DONT_VERIFY_SERVER_CERT connection flag.
Made calls from incompatible context issue an E_DEPRECATED warning instead of E_STRICT (phase 1 of RFC: https://wiki.php.net/rfc/incompat_ctx).
Uploads equal or greater than 2GB in size are now accepted.
Reduced POST data memory usage by 200-300%. Changed INI setting always_populate_raw_post_data to throw a deprecation warning when enabling and to accept -1 for never populating the $HTTP_RAW_POST_DATA global variable, which will be the default in future PHP versions.
Implemented dedicated syntax for variadic functions (RFC: https://wiki.php.net/rfc/variadics).
Fixed bug #50333 Improving multi-threaded scalability by using emalloc/efree/estrdup
Implemented constant scalar expressions (with support for constants) (RFC: https://wiki.php.net/rfc/const_scalar_exprs).
Moved GMP to use object as the underlying structure and implemented various improvements based on this. (RFC: https://wiki.php.net/rfc/operator_overloading_gmp).
Added gmp_root() and gmp_rootrem() functions for calculating nth roots.
Peer name verification matches SAN DNS names for certs using the Subject Alternative Name x509 extension.
Fixed segfault when built against OpenSSL>=1.0.1
Added SPKAC support.
Fallback to Windows CA cert store for peer verification if no openssl.cafile ini directive or "cafile" SSL context option specified in Windows.
The openssl.cafile and openssl.capath ini directives introduced in alpha2 now have PHP_INI_PERDIR accessibility (was PHP_INI_ALL).
New "peer_name" SSL context option replaces "CN_match" (which still works as before but triggers E_DEPRECATED).
Fixed segfault when accessing non-existent context for client SNI use
Fixed bug #66501 (Add EC key support to php_openssl_is_private_key).
Fixed Bug #47030 (add new boolean "verify_peer_name" SSL context option allowing clients to verify cert names separately from the cert itself). "verify_peer_name" is enabled by default for client streams.
New openssl_get_cert_locations() function to aid CA file and peer verification debugging.
Encrypted stream wrappers now disable TLS compression by default.
New "capture_session_meta" SSL context option allows encrypted client and server streams access to negotiated protocol/cipher information.
New "honor_cipher_order" SSL context option allows servers to prioritize cipher suites of their choosing when negotiating SSL/TLS handshakes.
New "single_ecdh_use" and "single_dh_use" SSL context options allow for improved forward secrecy in encrypted stream servers.
New "dh_param" SSL context option allows stream servers control over the parameters when negotiating DHE cipher suites.
New "ecdh_curve" SSL context option allowing stream servers to specify the curve to use when negotiating ephemeral ECDHE ciphers (defaults to NIST P-256).
New "rsa_key_size" SSL context option gives stream servers control over the key size (in bits) used for RSA key agreements.
Crypto methods for encrypted client and server streams now use bitwise flags for fine-grained protocol support.
Added new tlsv1.0 stream wrapper to specify TLSv1 client/server method. tls wrapper now negotiates TLSv1, TLSv1.1 or TLSv1.2.
Encrypted client streams now enable SNI by default.
Encrypted streams now prioritize ephemeral key agreement and high strength ciphers by default.
New OPENSSL_DEFAULT_STREAM_CIPHERS constant exposes default cipher list.
New STREAM_CRYPTO_METHOD_* constants for enhanced control over the crypto methods negotiated encrypted server/client sessions.
Encrypted stream servers now automatically mitigate potential DoS vector arising from client-initiated TLS renegotiation. New "reneg_limit", "reneg_window" and "reneg_limit_callback" SSL context options for custom renegotiation limiting control.
Fixed memory leak in windows cert verification on verify failure.
Peer certificate capturing via SSL context options now functions even if peer verification fails.
Encrypted TLS servers now support the server name indication TLS extension via the new "SNI_server_certs" SSL context option.
Fixed bug #66833 (Default disgest algo is still MD5, switch to SHA1).
Fixed bug #67215 (php-cgi work with opcache, may be segmentation fault happen)
pcre
Fixed bug #67238 (Ungreedy and min/max quantifier bug, applied patch from the upstream).
Upgraded to PCRE 8.34.
Added support for (*MARK) backtracking verbs.
pgsql
Fixed bug #67550 (Error in code "form" instead of "from", pgsql.c, line 756), which affected builds against libpq < 7.3.
pg_insert()/pg_select()/pg_update()/pg_delete() are no longer EXPERIMENTAL.
Impremented FR #25854 Return value for pg_insert should be resource instead of bool.
Implemented FR #41146 - Add "description" with exteneded flag pg_meta_data(). pg_meta_data(resource $conn, string $table [, bool extended]) It also made pg_meta_data() return "is enum" always.
Read-only access to the socket stream underlying database connections is exposed via a new pg_socket() function to allow read/write polling when establishing asynchronous connections and executing queries in non-blocking applications.
Asynchronous connections are now possible using the PGSQL_CONNECT_ASYNC flag in conjunction with a new pg_connect_poll() function and connection polling status constants.
New pg_flush() and pg_consume_input() functions added to manually complete non-blocking reads/writes to underlying connection sockets.
pg_version() returns full report which obtained by PQparameterStatus().
Added pg_lo_truncate().
Added 64bit large object support for PostgreSQL 9.3 and later.
Fixed bug #67555 (Cannot build against libpq 7.3).
phpdbg
Fixed bug #67575 (Compilation fails for phpdbg when the build directory != src directory).
Fixed Bug #67499 (readline feature not enabled when build with libedit).
Fix issue krakjoe/phpdbg#94 (List behavior is inconsistent).
Fix issue krakjoe/phpdbg#97 (The prompt should always ensure it is on a newline).
Fix issue krakjoe/phpdbg#98 (break if does not seem to work).
Fix issue krakjoe/phpdbg#99 (register function has the same behavior as run).
Fix issue krakjoe/phpdbg#100 (No way to list the current stack/frames) (Help entry was missing).
Fixed bug which caused phpdbg to fail immediately on startup in non-debug builds.
Fixed Bug #63657 (pgsqlCopyFromFile, pgsqlCopyToArray use Postgres < 7.3 syntax).
Cleaned up code by increasing the requirements to libpq versions providing PQexecParams, PQprepare, PQescapeStringConn, PQescapeByteaConn. According to the release notes that means 8.0.8+ or 8.1.4+.
Deprecated PDO::PGSQL_ATTR_DISABLE_NATIVE_PREPARED_STATEMENT, an undocument constant effectively equivalent to PDO::ATTR_EMULATE_PREPARES.
Added PDO::PGSQL_ATTR_DISABLE_PREPARES constant to execute the queries without preparing them, while still passing parameters separately from the command text using PQexecParams.
pdo_firebird
Fixed Bug #66071 (memory corruption in error handling)
phar
Fixed bug #64498 ($phar->buildFromDirectory can't compress file with an accent in its name).
Fixed bug #67587 (Redirection loop on nginx with FPM).
readline
Fixed bug #55496 (Interactive mode doesn't force a newline before the prompt).
Fixed bug #67496 (Save command history when exiting interactive shell with control-c).
reflection
Implemented FR #67713 (loosen the restrictions on ReflectionClass::newInstanceWithoutConstructor()).
session
Fixed bug #67694 (Regression in session_regenerate_id()).
Fixed missing type checks in php_session_create_id .
Fixed bug #66827 (Session raises E_NOTICE when session name variable is array).
Fixed Bug #65315 (session.hash_function silently fallback to default md5)
Implemented Request #17860 (Session write short circuit).
Implemented Request #20421 (session_abort() and session_reset() function).
Remove session_gc() and session_serializer_name() wich were introduced in the first 5.6.0 alpha.
