PHP: Version 8.0

Unsupported Version

8.0 has reached end-of-life and will no longer receive bugfixes or security patches from the PHP Project.
Some downstream distributions may still continue to provide backported fixes for a time, depending on their support policy.

For more information please see our support policy.

PHP 8.0.30

Released 03 Aug, 2023

libxml

Fixed bug GHSA-3qrf-m4j2-pcrr (Security issue with external entity loading in XML without enabling it). (CVE-2023-3823)

phar

Fixed bug GHSA-jqcx-ccgc-xwhv (Buffer mismanagement in phar_dir_read()). (CVE-2023-3824)

PHP 8.0.29

Released 08 Jun, 2023

soap

Fixed bug GHSA-76gg-c692-v2mw (Missing error check and insufficient random bytes in HTTP Digest authentication for SOAP). (CVE-2023-3247)

PHP 8.0.28

Released 14 Feb, 2023

core

Fixed bug #81744 (Password_verify() always return true with some hash). (CVE-2023-0567).
Fixed bug #81746 (1-byte array overrun in common path resolve code). (CVE-2023-0568).

sapi

Fixed bug GHSA-54hq-v5wp-fqgv (DOS vulnerability when parsing multipart request body). (CVE-2023-0662)

PHP 8.0.27

Released 05 Jan, 2023

pdo/sqlite

Fixed bug #81740 (PDO::quote() may return unquoted string). (CVE-2022-31631)

PHP 8.0.26

Released 24 Nov, 2022

cli

Fixed bug GH-9709 (Null pointer dereference with -w/-s options).

core

Fixed bug GH-9752 (Generator crashes when interrupted during argument evaluation with extra named params).
Fixed bug GH-9801 (Generator crashes when memory limit is exceeded during initialization).
Fixed potential NULL pointer dereference in Windows shm*() functions.
Fixed bug GH-9750 (Generator memory leak when interrupted during argument evaluation.

date

Fixed bug GH-9763 (DateTimeZone ctr mishandles input and adds null byte if the argument is an offset larger than 100*60 minutes).

fpm

Fixed bug GH-9754 (SaltStack (using Python subprocess) hangs when running php-fpm 8.1.11).
Fixed bug GH-9959 (Solaris port event mechanism is still broken after bug #66694).

mysqli

Fixed bug GH-9841 (mysqli_query throws warning despite using silenced error mode).

openssl

Fixed bug GH-8430 (OpenSSL compiled with no-md2, no-md4 or no-rmd160 does not build).

soap

Fixed GH-9720 (Null pointer dereference while serializing the response).

PHP 8.0.25

Released 27 Oct, 2022

Fixed bug #81739: OOB read due to insufficient input validation in imageloadfont(). (CVE-2022-31630)

hash

Fixed bug #81738: buffer overflow in hash_update() on long parameter. (CVE-2022-37454)

session

Fixed bug GH-9583 (session_create_id() fails with user defined save handler that doesn't have a validateId() method).

streams

Fixed bug GH-9590 (stream_select does not abort upon exception or empty valid fd set).

PHP 8.0.24

Released 29 Sep, 2022

core

Fixed bug GH-9323 (Crash in ZEND_RETURN/GC/zend_call_function)
Fixed bug GH-9361 (Segmentation fault on script exit #9379).
Fixed bug GH-9407 (LSP error in eval'd code refers to wrong class for static type).
Fixed bug #81727: Don't mangle HTTP variable names that clash with ones that have a specific semantic meaning. (CVE-2022-31629).

dom

Fixed bug #79451 (DOMDocument->replaceChild on doctype causes double free).

fpm

Fixed bug GH-8885 (FPM access.log with stderr begins to write logs to error_log after daemon reload).
Fixed bug #77780 ("Headers already sent..." when previous connection was aborted).
GMP
Fixed bug GH-9308 (GMP throws the wrong error when a GMP object is passed to gmp_init()).
Intl
Fixed bug GH-9421 (Incorrect argument number for ValueError in NumberFormatter).

pdo_pgsql

Fixed bug GH-9411 (PgSQL large object resource is incorrectly closed).

phar

Fixed bug #81726: phar wrapper: DOS when using quine gzip file. (CVE-2022-31628).

reflection

Fixed bug GH-8932 (ReflectionFunction provides no way to get the called class of a Closure).
Fixed bug GH-9409 (Private method is incorrectly dumped as "overwrites").

streams

Fixed bug GH-9316 ($http_response_header is wrong for long status line).

PHP 8.0.23

Released 01 Sep, 2022

core

Fixed incorrect double to long casting in latest clang.

dba

Fixed LMDB driver memory leak on DB creation failure
Fixed bug GH-9155 (dba_open("non-existing", "c-", "flatfile") segfaults).

intl

Fixed IntlDateFormatter::formatObject() parameter type.

opcache

Fixed bug GH-9033 (Loading blacklist file can fail due to negative length).

openssl

Fixed bug GH-9339 (OpenSSL oid_file path check warning contains uninitialized path).

pdo_sqlite

Fixed bug GH-9032 (SQLite3 authorizer crashes on NULL values).

sqlite3

Fixed bug GH-9032 (SQLite3 authorizer crashes on NULL values).

standard

Fixed bug GH-9017 (php_stream_sock_open_from_socket could return NULL).

streams

Fixed bug GH-8472 (The resource returned by stream_socket_accept may have incorrect metadata).
Fixed bug GH-8409 (SSL handshake timeout leaves persistent connections hanging).

PHP 8.0.22

Released 04 Aug, 2022

cli

Fixed potential overflow for the builtin server via the PHP_CLI_SERVER_WORKERS environment variable.

core

Fixed bug GH-8923 (error_log on Windows can hold the file write lock).
Fixed bug GH-8995 (WeakMap object reference offset causing TypeError).

date

Fixed bug #80047 (DatePeriod doesn't warn with custom DateTimeImmutable).

dba

Fixed LMDB driver hanging when attempting to delete a non-existing key

fpm

Fixed zlog message prepend, free on incorrect address.
Fixed possible double free on configuration loading failure. .

Fixed bug GH-8848 (imagecopyresized() error refers to the wrong argument).

intl

Fixed build for ICU 69.x and onwards.

opcache

Fixed bug GH-8847 (PHP hanging infinitly at 100% cpu when check php syntaxe of a valid file).

standard

Fixed the crypt_sha256/512 api build with clang > 12.
Uses CCRandomGenerateBytes instead of arc4random_buf on macOs. .

PHP 8.0.21

Released 07 Jul, 2022

core

Fixed potential use after free in php_binary_init().

cli

Fixed GH-8827 (Intentionally closing std handles no longer possible).

com

Fixed bug GH-8778 (Integer arithmethic with large number variants fails).

curl

Fixed CURLOPT_TLSAUTH_TYPE is not treated as a string option.

date

Fixed bug #74671 (DST timezone abbreviation has incorrect offset).
Fixed bug #77243 (Weekdays are calculated incorrectly for negative years).
Fixed bug #78139 (timezone_open accepts invalid timezone string argument).

fpm

Fixed bug #67764 (fpm: syslog.ident don't work).

mbstring

Fixed bug GH-8685 (pcre not ready at mbstring startup).

odbc

Fixed handling of single-key connection strings.

openssl

Fixed bug #50293 (Several openssl functions ignore the VCWD).
Fixed bug #81713 (NULL byte injection in several OpenSSL functions working with certificates).

pdo_odbc

Fixed errorInfo() result on successful PDOStatement->execute().
Fixed handling of single-key connection strings.

zip

Fixed bug GH-8781 (ZipArchive::close deletes zip file without updating stat cache).

PHP 8.0.20

Released 09 Jun, 2022

cli

Fixed bug GH-8575 (CLI closes standard streams too early).

core

Fixed Haiku ZTS builds.

date

Fixed bug #72963 (Null-byte injection in CreateFromFormat and related functions).
Fixed bug GH-8471 (Segmentation fault when converting immutable and mutable DateTime instances created using reflection).

fpm

Fixed ACL build check on MacOS.
Fixed bug #72185: php-fpm writes empty fcgi record causing nginx 502.
Fixes use after free. .

mysqlnd

Fixed bug #81719: mysqlnd/pdo password buffer overflow. (CVE-2022-31626)

opcache

Fixed bug GH-8466 (ini_get() is optimized out when the option does not exist).

pgsql

Fixed bug #81720: Uninitialized array in pg_query_params(). (CVE-2022-31625)

pcntl

Fixed Haiku build.

soap

Fixed bug GH-8578 (Error on wrong parameter on SoapHeader constructor).
Fixed bug GH-8538 (SoapClient may strip parts of nmtokens).

spl

Fixed bug GH-8235 (iterator_count() may run indefinitely).

zip

Fixed type for index in ZipArchive::replaceFile.

PHP 8.0.19

Released 12 May, 2022

core

Fixed bug GH-8289 (Exceptions thrown within a yielded from iterator are not rethrown into the generator).

date

Fixed bug GH-7979 (DatePeriod iterator advances when checking if valid).

ffi

Fixed bug GH-8433 (Assigning function pointers to structs in FFI leaks).

fpm

Fixed bug #76003 (FPM /status reports wrong number of active processe).
Fixed bug #77023 (FPM cannot shutdown processes).
Fixed comment in kqueue remove callback log message.

iconv

Fixed bug GH-8218 (ob_end_clean does not reset Content-Encoding header).

intl

Fixed bug GH-8364 (msgfmt_format $values may not support references).

mysqli

Fixed bug GH-8267 (MySQLi uses unsupported format specifier on Windows).

spl

Fixed bug GH-8366 (ArrayIterator may leak when calling __construct()).
Fixed bug GH-8273 (SplFileObject: key() returns wrong value).

streams

Fixed php://temp does not preserve file-position when switched to temporary file.

zlib

Fixed bug GH-8218 (ob_end_clean does not reset Content-Encoding header).

PHP 8.0.18

Released 14 Apr, 2022

core

Fixed freeing of internal attribute arguments.
Fixed bug GH-8070 (memory leak of internal function attribute hash).
Fixed bug GH-8160 (ZTS support on Alpine is broken).
Fixed potential race condition during resource ID allocation.

filter

Fixed signedness confusion in php_filter_validate_domain().

hash

Fixed bug #81714 (segfault when serializing finalized HashContext).

intl

Fixed bug GH-8142 (Compilation error on cygwin).

mbstring

Fixed bug GH-8208 (mb_encode_mimeheader: $indent functionality broken).

mysqli

Fixed bug GH-8068 (mysqli_fetch_object creates inaccessible properties).

pcntl

Fixed bug GH-8142 (Compilation error on cygwin).

pgsql

Fixed result_type related stack corruption on LLP64 architectures.
Fixed bug GH-8253 (pg_insert() fails for references).

sockets

Fixed Solaris builds.
Fix undefined behavior in php_set_inet6_addr.

spl

Fixed bug GH-8121 (SplFileObject - seek and key with csv file inconsistent).

standard

Fixed bug GH-8048 (Force macOS to use statfs).

PHP 8.0.17

Released 17 Mar, 2022

core

Fixed Haiku ZTS build.

Fixed libpng warning when loading interlaced images.

fpm

Fixed bug #76109 (Unsafe access to fpm scoreboard).

iconv

Fixed bug GH-7953 (ob_clean() only does not set Content-Encoding).
Fixed bug GH-7980 (Unexpected result for iconv_mime_decode).

mysqlnd

Fixed bug GH-8058 (NULL pointer dereference in mysqlnd package).

opcache

Fixed bug GH-8074 (Wrong type inference of range() result).

reflection

Fixed bug GH-8080 (ReflectionClass::getConstants() depends on def. order).
Fixed bug GH-8421 (Closures should accept attributes with Attribute::TARGET_FUNCTION).

zlib

Fixed bug GH-7953 (ob_clean() only does not set Content-Encoding).

PHP 8.0.16

Released 17 Feb, 2022

core

Fixed bug #81430 (Attribute instantiation leaves dangling pointer).
Fixed bug GH-7896 (Environment vars may be mangled on Windows).

ffi

Fixed bug GH-7867 (FFI::cast() from pointer to array is broken).

filter

Fix #81708: UAF due to php_filter_float() failing for ints. (CVE-2021-21708)

fpm

Fixed memory leak on invalid port.

mbstring

Fixed bug GH-7902 (mb_send_mail may delimit headers with LF only).

mysqlnd

Fixed bug GH-7972 (MariaDB version prefix 5.5.5- is not stripped).

sockets

Fixed ext/sockets build on Haiku.
Fixed bug GH-7978 (sockets extension compilation errors).

standard

Fixed bug GH-7875 (mails are sent even if failure to log throws exception).

PHP 8.0.15

Released 20 Jan, 2022

core

Fixed bug #81656 (GCC-11 silently ignores -R).
Fixed bug #81585 (cached_chunks are not counted to real_size on shutdown).

filter

Fixed FILTER_FLAG_NO_RES_RANGE flag.

hash

Fixed bug GH-7759 (Incorrect return types for hash() and hash_hmac()).
Fixed bug GH-7826 (Inconsistent argument name in hash_hmac_file and hash_file).

mysqlnd

Fixed bug where large bigints may be truncated.

oci8

Fixed bug GH-7765 (php_oci_cleanup_global_handles segfaults at second call).

opcache

Fixed bug #81679 (Tracing JIT crashes on reattaching).

pdo_pgsql

Fixed error message allocation of PDO PgSQL.

sockets

Avoid void* arithmetic in sockets/multicast.c on NetBSD.

spl

Fixed bug #75917 (SplFileObject::seek broken with CSV flags).

PHP 8.0.14

Released 16 Dec, 2021

core

Fixed bug #81582 (Stringable not implicitly declared if __toString() came from a trait).
Fixed bug #81591 (Fatal Error not properly logged in particular cases).
Fixed bug #81626 (Error on use static:: in __сallStatic() wrapped to Closure::fromCallable()).
Fixed bug #81631 (::class with dynamic class name may yield wrong line number).

fpm

Fixed bug #81513 (Future possibility for heap overflow in FPM zlog).

Fixed bug #71316 (libpng warning from imagecreatefromstring).

imap

Fixed bug #81649 (imap_(un)delete accept sequences, not single numbers).

openssl

Fixed bug #75725 (./configure: detecting RAND_egd).

pcre

Fixed bug #74604 (Out of bounds in php_pcre_replace_impl).

spl

Fixed bug #81587 (MultipleIterator Segmentation fault w/ SimpleXMLElement attached).

standard

Fixed bug #81618 (dns_get_record fails on FreeBSD for missing type).
Fixed bug #81659 (stream_get_contents() may unnecessarily overallocate).

PHP 8.0.13

Released 18 Nov, 2021

core

Fixed bug #81518 (Header injection via default_mimetype / default_charset).

date

Fixed bug #81500 (Interval serialization regression since 7.3.14 / 7.4.2).

dba

Fixed bug #81588 (TokyoCabinet driver leaks memory).

mbstring

Fixed bug #76167 (mbstring may use pointer from some previous request).

opcache

Fixed bug #81512 (Unexpected behavior with arrays and JIT).
Fixed bug #81652 (The value of error_reporting() gets overridden).

pcre

Fixed bug #81424 (PCRE2 10.35 JIT performance regression).

xml

Fixed bug #79971 (special character is breaking the path in xml function). (CVE-2021-21707)

xmlreader

Fixed bug #81521 (XMLReader::getParserProperty may throw with a valid property).

PHP 8.0.12

Released 21 Oct, 2021

cli

Fixed bug #81496 (Server logs incorrect request method).

core

Fixed bug #81435 (Observer current_observed_frame may point to an old (overwritten) frame).
Fixed bug #81380 (Observer may not be initialized properly).

dom

Fixed bug #81433 (DOMElement::setIdAttribute() called twice may remove ID).

ffi

Fixed bug #79576 ("TYPE *" shows unhelpful message when type is not defined).

fileinfo

Fixed bug #78987 (High memory usage during encoding detection).

filter

Fixed bug #61700 (FILTER_FLAG_IPV6/FILTER_FLAG_NO_PRIV|RES_RANGE failing).

fpm

Fixed bug #81026 (PHP-FPM oob R/W in root process leading to privilege escalation) (CVE-2021-21703).

opcache

Fixed bug #81472 (Cannot support large linux major/minor device number when read /proc/self/maps).

reflection

ReflectionAttribute is no longer final.

spl

Fixed bug #80663 (Recursive SplFixedArray::setSize() may cause double-free).
Fixed bug #81477 (LimitIterator + SplFileObject regression in 8.0.1).

standard

Fixed bug #69751 (Change Error message of sprintf/printf for missing/typo position specifier).

streams

Fixed bug #81475 (stream_isatty emits warning with attached stream wrapper).

xml

Fixed bug #70962 (XML_OPTION_SKIP_WHITE strips embedded whitespace).

zip

Fixed bug #81490 (ZipArchive::extractTo() may leak memory).
Fixed bug #77978 (Dirname ending in colon unzips to wrong dir).

PHP 8.0.11

Released 23 Sep, 2021

core

Fixed bug #81302 (Stream position after stream filter removed).
Fixed bug #81346 (Non-seekable streams don't update position after write).
Fixed bug #73122 (Integer Overflow when concatenating strings).
Fixed bug #53580 (During resize gdImageCopyResampled cause colors change).

opcache

Fixed bug #81353 (segfault with preloading and statically bound closure).

shmop

Fixed bug #81407 (shmop_open won't attach and causes php to crash).

standard

Fixed bug #71542 (disk_total_space does not work with relative paths).
Fixed bug #81400 (Unterminated string in dns_get_record() results).

sysvmsg

Fixed bug #78819 (Heap Overflow in msg_send).

xml

Fixed bug #81351 (xml_parse may fail, but has no error code).

zip

Fixed bug #80833 (ZipArchive::getStream doesn't use setPassword).
Fixed bug #81420 (ZipArchive::extractTo extracts outside of destination). (CVE-2021-21706)

PHP 8.0.10

Released 26 Aug, 2021

core

Fixed bug #72595 (php_output_handler_append illegal write access).
Fixed bug #66719 (Weird behaviour when using get_called_class() with call_user_func()).
Fixed bug #81305 (Built-in Webserver Drops Requests With "Upgrade" Header).

bcmath

Fixed bug #78238 (BCMath returns "-0").

cgi

Fixed bug #80849 (HTTP Status header truncation).

date

Fixed bug #64975 (Error parsing when AM/PM not at the end).
Fixed bug #78984 (DateTimeZone accepting invalid UTC timezones).
Fixed bug #79580 (date_create_from_format misses leap year).
Fixed bug #80409 (DateTime::modify() loses time with 'weekday' parameter).

Fixed bug #51498 (imagefilledellipse does not work for large circles).

mysqli

Fixed bug #74544 (Integer overflow in mysqli_real_escape_string()).

opcache

Fixed bug #81225 (Wrong result with pow operator with JIT enabled).
Fixed bug #81249 (Intermittent property assignment failure with JIT enabled).
Fixed bug #81206 (Multiple PHP processes crash with JIT enabled).
Fixed bug #81272 (Segfault in var[] after array_slice with JIT).
Fixed Bug #81255 (Memory leak in PHPUnit with functional JIT).
Fixed Bug #80959 (infinite loop in building cfg during JIT compilation)
Fixed bug #81226 (Integer overflow behavior is different with JIT enabled).

openssl

Fixed bug #81327 (Error build openssl extension on php 7.4.22).

pdo_odbc

Fixed bug #81252 (PDO_ODBC doesn't account for SQL_NO_TOTAL).

shmop

Fixed bug #81283 (shmop can't read beyond 2147483647 bytes).

simplexml

Fixed bug #81325 (Segfault in zif_simplexml_import_dom).

standard

Fixed bug #72146 (Integer overflow on substr_replace).
Fixed bug #81265 (getimagesize returns 0 for 256px ICO images).
Fixed bug #74960 (Heap buffer overflow via str_repeat).

streams

Fixed bug #81294 (Segfault when removing a filter).

PHP 8.0.9

Released 29 Jul, 2021

core

Fixed bug #81145 (copy() and stream_copy_to_stream() fail for +4GB files).
Fixed bug #81163 (incorrect handling of indirect vars in __sleep).
Fixed bug #81159 (Object to int warning when using an object as a string offset).
Fixed bug #80728 (PHP built-in web server resets timeout when it can kill the process).
Fixed bug #73630 (Built-in Weberver - overwrite $_SERVER['request_uri']).
Fixed bug #80173 (Using return value of zend_assign_to_variable() is not safe).
Fixed bug #73226 (--r[fcez] always return zero exit code).

intl

Fixed bug #72809 (Locale::lookup() wrong result with canonicalize option).
Fixed bug #68471 (IntlDateFormatter fails for "GMT+00:00" timezone).
Fixed bug #74264 (grapheme_strrpos() broken for negative offsets).

openssl

Fixed bug #52093 (openssl_csr_sign truncates $serial).

pcre

Fixed bug #81101 (PCRE2 10.37 shows unexpected result).
Fixed bug #81243 (Too much memory is allocated for preg_replace()).

reflection

Fixed bug #81208 (Segmentation fault while create newInstance from attribute).

standard

Fixed bug #81223 (flock() only locks first byte of file).

PHP 8.0.8

Released 01 Jul, 2021

core

Fixed bug #81076 (incorrect debug info on Closures with implicit binds).
Fixed bug #81068 (Double free in realpath_cache_clean()).
Fixed bug #76359 (open_basedir bypass through adding "..").
Fixed bug #81090 (Typed property performance degradation with .= operator).
Fixed bug #81070 (Integer underflow in memory limit comparison).
Fixed bug #81122: SSRF bypass in FILTER_VALIDATE_URL. (CVE-2021-21705)

bzip2

Fixed bug #81092 (fflush before stream_filter_remove corrupts stream).

fileinfo

Fixed bug #80197 (implicit declaration of function 'magic_stream' is invalid).

gmp

Fixed bug #81119 (GMP operators throw errors with wrong parameter names).

mysqlnd

Fixed bug #80761 (PDO uses too much memory).

oci8

Fixed bug #81088 (error in regression test for oci_fetch_object() and oci_fetch_array()).

opcache

Fixed bug #81051 (Broken property type handling after incrementing reference).
Fixed bug #80968 (JIT segfault with return from required file).

openssl

Fixed bug #76694 (native Windows cert verification uses CN as sever name).

pdo_firebird

Fixed bug #76448: Stack buffer overflow in firebird_info_cb. (CVE-2021-21704)
Fixed bug #76449: SIGSEGV in firebird_handle_doer. (CVE-2021-21704)
Fixed bug #76450: SIGSEGV in firebird_stmt_execute. (CVE-2021-21704)
Fixed bug #76452: Crash while parsing blob data in firebird_fetch_blob. (CVE-2021-21704)

readline

Fixed bug #72998 (invalid read in readline completion).

standard

Fixed bug #81048 (phpinfo(INFO_VARIABLES) "Array to string conversion").
Fixed bug #77627 (method_exists on Closure::__invoke inconsistency).

windows

Fixed bug #81120 (PGO data for main PHP DLL are not used).

PHP 8.0.7

Released 03 Jun, 2021

core

Fixed bug #80960 (opendir() warning wrong info when failed on Windows).
Fixed bug #67792 (HTTP Authorization schemes are treated as case-sensitive).
Fixed bug #80972 (Memory exhaustion on invalid string offset).

fpm

Fixed bug #65800 (Events port mechanism).

ftp

Fixed bug #80901 (Info leak in ftp extension).
Fixed bug #79100 (Wrong FTP error messages).

Fixed bug #81032 (GD install is affected by external libgd installation).

intl

Fixed bug #81019 (Unable to clone NumberFormatter after failed parse()).

mbstring

Fixed bug #81011 (mb_convert_encoding removes references from arrays).

odbc

Fixed bug #80460 (ODBC doesn't account for SQL_NO_TOTAL indicator).

opcache

Fixed bug #81007 (JIT "not supported" on 32-bit x86 -- build problem?).
Fixed bug #81015 (Opcache optimization assumes wrong part of ternary operator in if-condition).
Fixed bug #81046 (Literal compaction merges non-equal related literals).

pdo_mysql

Fixed bug #81037 (PDO discards error message text from prepared statement).

pdo_odbc

Fixed bug #44643 (bound parameters ignore explicit type definitions).

pgsql

Fixed php_pgsql_fd_cast() wrt. php_stream_can_cast().

spl

Fixed bug #80933 (SplFileObject::DROP_NEW_LINE is broken for NUL and CR).

xmlreader

Fixed bug #73246 (XMLReader: encoding length not checked).

zip

Fixed bug #80863 (ZipArchive::extractTo() ignores references).

PHP 8.0.6

Released 06 May, 2021

pdo_pgsql

Revert "Fixed bug #80892 " from PHP 8.0.5.

PHP 8.0.5

Released 29 Apr, 2021

core

Changed PowerPC CPU registers used by Zend VM to work around GCC bug. Old registers (r28/r29) might be clobbered by _restgpr routine used for return from C function compiled with -Os.

dom

Fixed bug #66783 (UAF when appending DOMDocument to element).

ffi

Fixed bug #80847 (CData structs with fields of type struct can't be passed as C function argument).

fpm

Fixed bug #80024 (Duplication of info about inherited socket after pool removing).

ftp

Fixed bug #80880 (SSL_read on shutdown, ftp/proc_open).

imap

Fixed bug #80710 (imap_mail_compose() header injection).

libxml

Fixed bug #73533 (Invalid memory access in php_libxml_xmlCheckUTF8).

opcache

Fixed bug #80839 (PHP problem with JIT).
Fixed bug #80861 (erronous array key overflow in 2D array with JIT).

pcntl

Fixed bug #79812 (Potential integer overflow in pcntl_exec()).

pdo_odbc

Fixed bug #80783 (PDO ODBC truncates BLOB records at every 256th byte).

pdo_pgsql

Fixed bug #80892 (PDO::PARAM_INT is treated the same as PDO::PARAM_STR).

session

Fixed bug #80889 (Cannot set save handler when save_handler is invalid).

soap

Fixed bug #69668 (SOAP special XML characters in namespace URIs not encoded).

standard

Fixed bug #80915 (Taking a reference to $_SERVER hides its values from phpinfo()).
Fixed bug #80914 ('getdir' accidentally defined as an alias of 'dir').

PHP 8.0.4

Released 01 Apr, 2021

core

Fixed bug #75776 (Flushing streams with compression filter is broken).
Fixed bug #80811 (Function exec without $output but with $restult_code parameter crashes).
Fixed bug #80814 (threaded mod_php won't load on FreeBSD: No space available for static Thread Local Storage).

dba

Fixed bug #80817 (dba_popen() may cause segfault during RSHUTDOWN).

imap

Fixed bug #80800 (imap_open() fails when the flags parameter includes CL_EXPUNGE).

intl

Fixed bug #80763 (msgfmt_format() does not accept DateTime references).

libxml

Fixed bug #51903 (simplexml_load_file() doesn't use HTTP headers).

mysqlnd

Fixed bug #80837 (Calling stmt_store_result after fetch doesn't throw an error).

opcache

Fixed bug #80786 (PHP crash using JIT).
Fixed bug #80782 (DASM_S_RANGE_VREG on PHP_INT_MIN-1).

pcre

Fixed bug #80866 (preg_split ignores limit flag when pattern with \K has 0-width fullstring match).

session

Fixed bug #80774 (session_name() problem with backslash).

standard

Fixed bug #80771 (phpinfo(INFO_CREDITS) displays nothing in CLI).
Fixed bug #78719 (http wrapper silently ignores long Location headers).
Fixed bug #80838 (HTTP wrapper waits for HTTP 1 response after HTTP 101).

zip

Fixed bug #80825 (ZipArchive::isCompressionMethodSupported does not exist).

PHP 8.0.3

Released 04 Mar, 2021

core

Fixed #80706 (mail(): Headers after Bcc headers may be ignored).

dom

Fixed bug #80600 (DOMChildNode::remove() doesn't work on CharacterData nodes).

gettext

Fixed bug #53251 (bindtextdomain with null dir doesn't return old value).

mysqlnd

Fixed bug #78680 (mysqlnd's mysql_clear_password does not transmit null-terminated password).
Fixed bug #80713 (SegFault when disabling ATTR_EMULATE_PREPARES and MySQL 8.0).

mysqli

Fixed bug #74779 (x() and y() truncating floats to integers).

opcache

Fixed bug #80634 (write_property handler of internal classes is skipped on preloaded JITted code).
Fixed bug #80682 (opcache doesn't honour pcre.jit option).
Fixed bug #80742 (Opcache JIT makes some boolean logic unexpectedly be true).
Fixed bug #80745 (JIT produces Assert failure and UNKNOWN:0 var_dumps in code involving bitshifts).

openssl

Fixed bug #80747 (Providing RSA key size < 512 generates key that crash PHP).

phar

Fixed bug #75850 (Unclear error message wrt. __halt_compiler() w/o semicolon)
Fixed bug #70091 (Phar does not mark UTF-8 filenames in ZIP archives).
Fixed bug #53467 (Phar cannot compress large archives).

socket

Fixed bug #80723 (Different sockets compare as equal (regression in 8.0)).

spl

Fixed bug#80719 (Iterating after failed ArrayObject::setIteratorClass() causes Segmentation fault).

standard

Fixed bug #80654 (file_get_contents() maxlen fails above (2**31)-1 bytes).
Fixed bug #80718 (ext/standard/dl.c fallback code path with syntax error).

PHP 8.0.2

Released 04 Feb, 2021

core

Fixed bug #80523 (bogus parse error on >4GB source code).
Fixed bug #80384 (filter buffers entire read until file closed).
Fixed bug #80596 (Invalid union type TypeError in anonymous classes).
Fixed bug #80617 (GCC throws warning about type narrowing in ZEND_TYPE_INIT_CODE).

bcmath

Fixed bug #80545 (bcadd('a', 'a') doesn't throw an exception).

curl

Fixed bug #80595 (Resetting POSTFIELDS to empty array breaks request).

date

Fixed bug #80376 (last day of the month causes runway cpu usage).

dom

Fixed bug #80537 (Wrong parameter type in DOMElement::removeAttributeNode stub).

filter

Fixed bug #80584 (0x and 0X are considered valid hex numbers by filter_var()).

gmp

Fixed bug #80560 (Strings containing only a base prefix return 0 object).

intl

Fixed bug #80644 (Missing resource causes subsequent get() calls to fail).

mysqli

Fixed bug #67983 (mysqlnd with MYSQLI_OPT_INT_AND_FLOAT_NATIVE fails to interpret bit columns).
Fixed bug #64638 (Fetching resultsets from stored procedure with cursor fails).
Fixed bug #72862 (segfault using prepared statements on stored procedures that use a cursor).
Fixed bug #77935 (Crash in mysqlnd_fetch_stmt_row_cursor when calling an SP with a cursor).

odbc

Fixed bug #80592 (all floats are the same in ODBC parameters).

opcache

Fixed bug #80422 (php_opcache.dll crashes when using Apache 2.4 with JIT).

pdo_firebird

Fixed bug #80521 (Parameters with underscores no longer recognized).

phar

Fixed bug #76929 (zip-based phar does not respect phar.require_hash).
Fixed bug #77565 (Incorrect locator detection in ZIP-based phars).
Fixed bug #69279 (Compressed ZIP Phar extractTo() creates garbage files).

phpdbg

Reverted fix for bug #76813 (Access violation near NULL on source operand).

PHP 8.0.1

Released 07 Jan, 2021

core

Fixed bug #80345 (PHPIZE configuration has outdated PHP_RELEASE_VERSION).
Fixed bug #72964 (White space not unfolded for CC/Bcc headers).
Fixed bug #80391 (Iterable not covariant to mixed).
Fixed bug #80393 (Build of PHP extension fails due to configuration gap with libtool).
Fixed bug #77069 (stream filter loses final block of data).

fileinfo

Fixed bug #77961 (finfo_open crafted magic parsing SIGABRT).

fpm

Fixed bug #69625 (FPM returns 200 status on request without SCRIPT_FILENAME env).
IMAP
Fixed bug #80438 (imap_msgno() incorrectly warns and return false on valid UIDs in PHP 8.0.0).
Fix a regression with valid UIDs in imap_savebody()
Make warnings for invalid message numbers/UIDs between functions consistent

intl

Fixed bug #80425 (MessageFormatAdapter::getArgTypeList redefined).
OCI8
Create Windows DLLs for Oracle Client 19c.

opcache

Fixed bug #80404 (Incorrect range inference result when division results in float).
Fixed bug #80377 (Opcache misses executor_globals).
Fixed bug #80433 (Unable to disable the use of the AVX command when using JIT).
Fixed bug #80447 (Strange out of memory error when running with JIT).
Fixed bug #80480 (Segmentation fault with JIT enabled).
Fixed bug #80506 (Immediate SIGSEGV upon ini_set("opcache.jit_debug", 1)).

openssl

Fixed bug #80368 (OpenSSL extension fails to build against LibreSSL due to lack of OCB support).

pdo mysql

Fixed bug #80458 (PDOStatement::fetchAll() throws for upsert queries).
Fixed bug #63185 (nextRowset() ignores MySQL errors with native prepared statements).
Fixed bug #78152 (PDO::exec() - Bad error handling with multiple commands).
Fixed bug #66878 (Multiple rowsets not returned unless PDO statement object is unset()).
Fixed bug #70066 (Unexpected "Cannot execute queries while other unbuffered queries").
Fixed bug #71145 (Multiple statements in init command triggers unbuffered query error).
Fixed bug #76815 (PDOStatement cannot be GCed/closeCursor-ed when a PROCEDURE resultset SIGNAL).
Fixed bug #79872 (Can't execute query with pending result sets).
Fixed bug #79131 (PDO does not throw an exception when parameter values are missing).
Fixed bug #72368 (PdoStatement->execute() fails but does not throw an exception).
Fixed bug #62889 (LOAD DATA INFILE broken).
Fixed bug #67004 (Executing PDOStatement::fetch() more than once prevents releasing resultset).
Fixed bug #79132 (PDO re-uses parameter values from earlier calls to execute()).

phar

Fixed bug #73809 (Phar Zip parse crash - mmap fail).
Fixed bug #75102 (`PharData` says invalid checksum for valid tar).
Fixed bug #77322 (PharData::addEmptyDir('/') Possible integer overflow).

phpdbg

Fixed bug #76813 (Access violation near NULL on source operand).

spl

Fixed #62004 (SplFileObject: fgets after seek returns wrong line).

standard

Fixed bug #77423 (FILTER_VALIDATE_URL accepts URLs with invalid userinfo). (CVE-2020-7071)
Fixed bug #80366 (Return Value of zend_fstat() not Checked).

tidy

Fixed bug #77594 (ob_tidyhandler is never reset).

tokenizer

Fixed bug #80462 (Nullsafe operator tokenize with TOKEN_PARSE flag fails).

xml

XmlParser opaque object renamed to XMLParser for consistency with other XML objects.

zlib

Fixed #48725 (Support for flushing in zlib stream).

PHP 8.0.0

Released 26 Nov, 2020

bz2

Fixed bug #71263 (fread() does not report bzip2.decompress errors).

cli

Allow debug server binding to an ephemeral port via `-S localhost:0`.

com

Fixed bug #55847 (DOTNET .NET 4.0 GAC new location).
Fixed bug #62474 (com_event_sink crashes on certain arguments).

calendar

Fixed bug #80007 (Potential type confusion in unixtojd() parameter parsing).

core

Fixed bug #36365 (scandir duplicates file name at every 65535th file).
Fixed bug #49555 (Fatal error "Function must be a string" message should be renamed).
Fixed bug #62294 (register_shutdown_function() does not correctly handle exit code).
Fixed bug #62609 (Allow implementing Traversable on abstract classes).
Fixed bug #65274 (Enhance undefined class constant error with class name).
Fixed bug #65275 (Calling exit() in a shutdown function does not change the exit value in CLI).
Fixed bug #69084 (Unclear error message when not implementing a renamed abstract trait function).
Fixed bug #70839 (Converting optional argument to variadic forbidden by LSP checks).
Fixed bug #74558 (Can't rebind closure returned by Closure::fromCallable()).
Fixed bug #77561 (Shebang line not stripped for non-primary script).
Fixed bug #77619 (Wrong reflection on MultipleIterator::__construct).
Fixed bug #77966 (Cannot alias a method named "namespace").
Fixed bug #78236 (convert error on receiving variables when duplicate [).
Fixed bug #78770 (Incorrect callability check inside internal methods).
Fixed bug #79108 (Referencing argument in a function makes it a reference in the stack trace).
Fixed bug #79368 ("Unexpected end of file" is not an acceptable error message).
Fixed bug #79462 (method_exists and property_exists incoherent behavior).
Fixed bug #79467 (data:// wrappers are writable).
Fixed bug #79521 (Check __set_state structure).
Fixed bug #79790 ("Illegal offset type" exception during AST evaluation not handled properly).
Fixed bug #79791 (Assertion failure when unsetting variable during binary op).
Fixed bug #79828 (Segfault when trying to access non-existing variable).
Fixed bug #79841 (Syntax error in configure / unescaped "[]" in php.m4).
Fixed bug #79852 (count(DOMNodeList) doesn't match count(IteratorIterator(DOMNodeList))).
Fixed bug #79867 (Promoted untyped properties should get null default value).
Fixed bug #79897 (Promoted constructor params with attribs cause crash).
Fixed bug #79927 (Generator doesn't throw exception after multiple yield from iterable).
Fixed bug #79946 (Build fails due to undeclared UINT32_C).
Fixed bug #79948 (Exit in auto-prepended file does not abort PHP execution).
Fixed bug #80045 (memleak after two set_exception_handler calls with __call).
Fixed bug #80096 (Segmentation fault with named arguments in nested call).
Fixed bug #80109 (Cannot skip arguments when extended debug is enabled).
Fixed bug #80225 (broken namespace usage in eval code).
Fixed bug #80258 (Windows Deduplication Enabled, randon permission errors).
Fixed bug #80280 (ADD_EXTENSION_DEP() fails for ext/standard and ext/date).
Fixed bug #80334 (assert() vs named parameters - confusing error).
Fixed bug #80055 (Abstract trait methods returning "self" cannot be fulfilled by traits).
Fixed faulty generator cleanup with yield from.
Implement #[Attr] Attribute syntax as per final vote in RFC https://wiki.php.net/rfc/shorter_attribute_syntax_change
Implemented FR #47074 (phpinfo() reports "On" as 1 for the some extensions).
Implemented FR #72089 (require() throws fatal error instead of exception).
Removed the pdo_odbc.db2_instance_name php.ini directive.
Use SSE2 instructions do locale independent strtolower.

curl

Bumped required libcurl version to 7.29.0.
Fixed bug #80121 (Null pointer deref if CurlHandle directly instantiated).

dom

Add property DOMXPath::$registerNodeNamespaces and constructor argument that allow global flag to configure query() or evaluate() calls.
Fixed bug #79968 (DOMChildNode API crash on unattached nodes).
Fixed bug #80268 (loadHTML() truncates at NUL bytes).

date

Fixed bug #60302 (DateTime::createFromFormat should new static(), not new self()).
Fixed bug #65547 (Default value for sunrise/sunset zenith still wrong).
Fixed bug #69044 (discrepancy between time and microtime).
Fixed bug #80057 (DateTimeImmutable::createFromFormat() does not populate time).
Implemented FR #79903 (datetime: new format "p", same as "P" but returning "Z" for UTC).

enchant

Add LIBENCHANT_VERSION macro.
Add enchant_dict_add and enchant_dict_is_added functions.
Deprecate enchant_broker_set_dict_path, enchant_broker_get_dict_path, enchant_dict_add_to_personal and enchant_dict_is_in_session.
Use libenchant-2 when available.

ffi

Added FFI\CType::getName() method.
Fixed bug #79177 (FFI doesn't handle well PHP exceptions within callback).
Fixed bug #79749 (Converting FFI instances to bool fails).

fpm

Add pm.status_listen option.

fileinfo

Upgrade to libmagic 5.39.

Added imagegetinterpolation().
Fixed bug #55005 (imagepolygon num_points requirement).
Made the $num_points parameter of php_imagepolygon optional.
Removed deprecated image2wbmp().
Removed deprecated png2wbmp() and jpeg2wbmp().
Replaced gd resources with objects.

imap

Fixed bug #64076 (imap_sort() does not return FALSE on failure).
Fixed bug #76618 (segfault on imap_reopen).
Fixed bug #80213 (imap_mail_compose() segfaults on certain $bodies).
Fixed bug #80215 (imap_mail_compose() may modify by-val parameters).
Fixed bug #80216 (imap_mail_compose() does not validate types/encodings).
Fixed bug #80220 (imap_mail_compose() may leak memory).
Fixed bug #80223 (imap_mail_compose() leaks envelope on malformed bodies).
Fixed bug #80226 (imap_sort() leaks sortpgm memory).
Fixed bug #80239 (imap_rfc822_write_address() leaks memory).
Fixed bug #80242 (imap_mail_compose() segfaults for multipart with rfc822).
Fixed minor regression caused by fixing bug #80220.

iconv

Dropped support for iconv without proper errno setting.

intl

Removed deprecated INTL_IDNA_VARIANT_2003.

jit

Fixed bug #77857 (Wrong result if executed with JIT).
Fixed bug #79255 (PHP cannot be compiled with enable JIT).
Fixed bug #79582 (Crash seen when opcache.jit=1235 and opcache.jit_debug=2).
Fixed bug #79743 (Fatal error when assigning to array property with JIT enabled).
Fixed bug #79864 (JIT segfault in Symfony OptionsResolver).
Fixed bug #79888 (Incorrect execution with JIT enabled).

json

The JSON extension is now an integral part of PHP and cannot be disabled as per RFC: https://wiki.php.net/rfc/always_enable_json

ldap

Fixed memory leaks.
Removed deprecated ldap_sort.

mbstring

Fixed bug #76999 (mb_regex_set_options() return current options).
Removed the unused $is_hex parameter from mb_decode_numericentity().

mysqli

Fixed bug #76809 (SSL settings aren't respected when persistent connections are used).

mysqlnd

Fixed #60594 (mysqlnd exposes 160 lines of stats in phpinfo).

oci8

Deprecated old OCI8 function aliases.
Modernized oci_register_taf_callback() callable argument parsing implementation.
Removed obsolete no-op function oci_internal_debug().

odbc

Fixed bug #22986 (odbc_connect() may reuse persistent connection).
Fixed bug #44618 (Fetching may rely on uninitialized data).

opcache

Fixed bug #76535 (Opcache does not replay compile-time warnings).
Fixed bug #78654 (Incorrectly computed opcache checksum on files with non-ascii characters).
Fixed bug #79665 (ini_get() and opcache_get_configuration() inconsistency).
Fixed bug #80030 (Optimizer segfault with isset on static property with undef dynamic class name).
Fixed bug #80175 (PHP8 RC1 - JIT Buffer not working).
Fixed bug #80184 (Complex expression in while / if statements resolves to false incorrectly).
Fixed bug #80255 (Opcache bug (bad condition result) in 8.0.0rc1).
Fixed run-time binding of preloaded dynamically declared function.

openssl

Added Cryptographic Message Syntax (CMS) support.

pcre

Don't ignore invalid escape sequences.
Updated to PCRE2 10.35.

pdo

Changed default PDO error mode to exceptions.
Fixed bug #77849 (Disable cloning of PDO handle/connection objects).

pdo_firebird

Fixed bug #64937 (Firebird PDO preprocessing sql).

pdo_oci

Added support for setting and getting the oracle OCI 18c call timeout.

pdo_pgsql

Bumped required libpq version to 9.1.

pgsql

Bumped required libpq version to 9.1.

phpdbg

Fixed bug #76596 (phpdbg support for display_errors=stderr).
Fixed bug #76801 (too many open files).
Fixed bug #77800 (phpdbg segfaults on listing some conditional breakpoints).
Fixed bug #77805 (phpdbg build fails when readline is shared).

reflection

Fixed bug #64592 (ReflectionClass::getMethods() returns methods out of scope).
Fixed bug #69180 (Reflection does not honor trait conflict resolution / method aliasing).
Fixed bug #74939 (Nested traits' aliased methods are lowercased).
Fixed bug #77325 (ReflectionClassConstant::$class returns wrong class when extending).
Fixed bug #78697 (ReflectionClass::implementsInterface - inaccurate error message with traits).
Fixed bug #80190 (ReflectionMethod::getReturnType() does not handle static as part of union type).
Fixed bug #80299 (ReflectionFunction->invokeArgs confused in arguments).
Fixed bug #80370 (getAttributes segfault on dynamic properties).
Implement #79628 (Add $filter parameter for ReflectionClass::getConstants and ReflectionClass::getReflectionConstants)
Implement ReflectionProperty::hasDefaultValue and Reflection::getDefaultValue

snmp

Fixed bug #70461 (disable md5 code when it is not supported in net-snmp).

spl

Fixed bug #65006 (spl_autoload_register fails with multiple callables using self, same method).
Fixed bug #65387 (Circular references in SPL iterators are not garbage collected).
Fixed bug #71236 (Second call of spl_autoload_register() does nothing if it has no arguments).
Fixed bug #79987 (Memory leak in SplFileInfo because of missing zend_restore_error_handling()).
SplFixedArray is now IteratorAggregate rather than Iterator.

sqlite3

Added SQLite3::setAuthorizer() and respective class constants.

session

Fixed bug #73529 (session_decode() silently fails on wrong input).
Fixed bug #78624 (session_gc return value for user defined session handlers).

shmop

Converted shmop resources to objects.

simplexml

Fixed bug #63575 (Root elements are not properly cloned).
Fixed bug #75245 (Don't set content of elements with only whitespaces).

sodium

Fixed bug #77646 (sign_detached() strings not terminated).

standard

Don't force rebuild of symbol table, when populating $http_response_header variable by the HTTP stream wrapper.
Fixed bug #47983 (mixed LF and CRLF line endings in mail()).
Fixed bug #64060 (lstat_stat_variation7.phpt fails on certain file systems).
Fixed bug #75902 (str_replace should warn when misused with nested arrays).
Fixed bug #76859 (stream_get_line skips data if used with data-generating filter).
Fixed bug #77204 (getimagesize(): Read error! should mention file path).
Fixed bug #78385 (parse_url() does not include 'query' when question mark is the last char).
Fixed bug #79868 (Sorting with array_unique gives unwanted result).
Fixed bug #80256 (file_get_contents strip first line with chunked encoding redirect).
Fixed bug #80266 (parse_url silently drops port number 0).
Fixed bug #80290 (Double free when ASSERT_CALLBACK is used with a dynamic message).
Implemented FR #78638 (__PHP_Incomplete_Class should be final).
Made quoting of cmd execution functions consistent.

tidy

Removed the unused $use_include_path parameter from tidy_repair_string().

tokenizer

Fixed bug #80328 (PhpToken::getAll() confusing name).

xml

Fixed bug #76874 (xml_parser_free() should never leak memory).

xmlwriter

Changed functions to accept/return XMLWriter objects instead of resources.
Implemented FR #79344 (xmlwriter_write_attribute_ns: $prefix should be nullable).
Removed return types from XMLWriter stubs.

zip

Add "flags" options to ZipArchive::addGlob and addPattern methods keeping previous behavior having FL_OVERWRITE by default.
Add ZipArchive::EM_UNKNOWN and ZipArchive::EM_TRAD_PKWARE constants.
Add ZipArchive::isCompressionMethodSupported() and ZipArchive::isEncryptionMethodSupported() method (libzip 1.7.0).
Add ZipArchive::replaceFile() method.
Add ZipArchive::setCancelCallback method (since libzip 1.6.0).
Add ZipArchive::setMtimeName and ZipArchive::setMtimeIndex methods.
Add ZipArchive::setProgressCallback method (since libzip 1.3.0).
Add lastId property to ZipArchive.
Add optional "flags" parameter to ZipArchive::addEmptyDir, addFile and addFromString methods.
Fixed bug #50678 (files extracted by ZipArchive class lost their original modified time).
Fixed bug #72374 (remove_path strips first char of filename).
Implemented FR #77960 (add compression / encryption options for ZipArchive::addGlob and ZipArchive::addPattern).
ZipArchive::status and ZipArchive::statusSys properties and ZipArchive::getStatusString() method stay valid after the archive is closed.

zlib

Fixed bug #71417 (fread() does not report zlib.inflate errors).
Fixed bug #78792 (zlib.output_compression disabled by Content-Type: image/).

Releases

Indicates security patches

8.0.30

03 Aug, 2023

8.0.29

08 Jun, 2023

8.0.28

14 Feb, 2023

8.0.27

05 Jan, 2023

8.0.26

24 Nov, 2022

8.0.25

27 Oct, 2022

8.0.24

29 Sep, 2022

8.0.23

01 Sep, 2022

8.0.22

04 Aug, 2022

8.0.21

07 Jul, 2022

8.0.20

09 Jun, 2022

8.0.19

12 May, 2022

8.0.18

14 Apr, 2022

8.0.17

17 Mar, 2022

8.0.16

17 Feb, 2022

8.0.15

20 Jan, 2022

8.0.14

16 Dec, 2021

8.0.13

18 Nov, 2021

8.0.12

21 Oct, 2021

8.0.11

23 Sep, 2021

8.0.10

26 Aug, 2021

8.0.9

29 Jul, 2021

8.0.8

01 Jul, 2021

8.0.7

03 Jun, 2021

8.0.6

06 May, 2021

8.0.5

29 Apr, 2021

8.0.4

01 Apr, 2021

8.0.3

04 Mar, 2021

8.0.2

04 Feb, 2021

8.0.1

07 Jan, 2021

8.0.0

26 Nov, 2020