7.4 has reached end-of-life and will no longer receive
bugfixes or security patches from the PHP Project. Some downstream distributions may still continue to provide
backported fixes for a time, depending on their support policy.
Fixed bug #78833 (Integer overflow in pack causes out-of-bound access).
Fixed bug #78814 (strip_tags allows / in tag name => whitelist bypass).
PHP 7.4.0
Released 28 Nov, 2019
core
Implemented RFC: Deprecate curly brace syntax for accessing array elements and string offsets. https://wiki.php.net/rfc/deprecate_curly_braces_array_access
Implemented RFC: Deprecations for PHP 7.4. https://wiki.php.net/rfc/deprecations_php_7_4
Fixed incorrect usage of QM_ASSIGN instruction. It must not return IS_VAR. As a side effect, this allowed passing left hand list() "by reference", instead of compile-time error.
cli
The built-in CLI server now reports the request method in log files.
com
Deprecated registering of case-insensitive constants from typelibs.
Implemented RFC where password_hash() has argon2i(d) implementations from ext/sodium when PHP is built without libargon: https://wiki.php.net/rfc/sodium.argon.hash
Implemented FR #38301 (field enclosure behavior in fputcsv).
Implemented FR #51496 (fgetcsv should take empty string as an escape).
Fixed bug #73535 (php_sockop_write() returns 0 on error, can be used to trigger Denial of Service).
Fixed bug #74764 (Bindto IPv6 works with file_get_contents but fails with stream_socket_client).
Fixed bug #76859 (stream_get_line skips data if used with data-generating filter).
Implemented FR #77377 (No way to handle CTRL+C in Windows).
Fixed bug #77930 (stream_copy_to_stream should use mmap more often).
