PHP Release 7.2.21


    PHP 7.2.21 Release Announcement

    The PHP development team announces the immediate availability of PHP 7.2.21. This is a security release which also contains several minor bug fixes.

    All PHP 7.2 users are encouraged to upgrade to this version.

    For source downloads of PHP 7.2.21 please visit our downloads page, Windows source and binaries can be found on windows.php.net/download/. The list of changes is recorded in the ChangeLog.

    Source Code
    PHP 7.2.21 (tar.bz2)
    SHA256: 343183a1be8336670171885c761d57ffcae99cbbcf1db43da7cb5565056b14ef
    PHP 7.2.21 (tar.gz)
    SHA256: 8327682bee4a8fd2edf5bbfcc393d986b945bec433fc74458d05e766701b313c
    PHP 7.2.21 (tar.xz)
    SHA256: de06aff019d8f5079115795bd7d8eedd4cd03daecb62d58abb18f492dd995c95
    Change Logs
    date
    • Fixed bug #69044 (discrepency between time and microtime).
    exif
    • Fixed bug #78256 (heap-buffer-overflow on exif_process_user_comment). (CVE-2019-11042)
    • Fixed bug #78222 (heap-buffer-overflow on exif_scan_thumbnail). (CVE-2019-11041)
    fileinfo
    • Fixed bug #78183 (finfo_file shows wrong mime-type for .tga file).
    ftp
    • Fixed bug #77124 (FTP with SSL memory leak).
    libxml
    • Fixed bug #78279 (libxml_disable_entity_loader settings is shared between requests (cgi-fcgi)).
    litespeed
    • Updated to LiteSpeed SAPI V7.4.3 (increased response header count limit from 100 to 1000, added crash handler to cleanly shutdown PHP request, added CloudLinux mod_lsapi mode).
    • Fixed bug #76058 (After "POST data can't be buffered", using php://input makes huge tmp files).
    openssl
    • Fixed bug #78231 (Segmentation fault upon stream_socket_accept of exported socket-to-stream).
    opcache
    • Fixed bug #78189 (file cache strips last character of uname hash).
    • Fixed bug #78202 (Opcache stats for cache hits are capped at 32bit NUM).
    • Fixed bug #78291 (opcache_get_configuration doesn't list all directives).
    phar
    • Fixed bug #77919 (Potential UAF in Phar RSHUTDOWN).
    phpdbg
    • Fixed bug #78297 (Include unexistent file memory leak).
    pdo_sqlite
    • Fixed bug #78192 (SegFault when reuse statement after schema has changed).
    sqlite
    • Upgraded to SQLite 3.28.0.
    standard
    • Fixed bug #78241 (touch() does not handle dates after 2038 in PHP 64-bit).
    • Fixed bug #78269 (password_hash uses weak options for argon2).
    xmlrpc
    • Fixed bug #78173 (XML-RPC mutates immutable objects during encoding).
    PHP logo

    PHP is developed and maintained by a global community of contributors.

    The PHP Foundation helps fund this work. If PHP is part of your business or projects, consider sponsoring the Foundation.
    PHP

    Learn

    The PHP Foundation

    Legal

    Copyright © 2001 - 2026 the PHP Group. All Rights Reserved.
    To Top