PHP Release 8.1.29


    PHP 8.1.29 Release Announcement

    The PHP development team announces the immediate availability of PHP 8.1.29. This is a security release.

    All PHP 8.1 users are encouraged to upgrade to this version.

    For source downloads of PHP 8.1.29 please visit our downloads page, Windows source and binaries can be found on windows.php.net/download/. The list of changes is recorded in the ChangeLog.

    Source Code
    PHP 8.1.29 (tar.gz)
    SHA256: 8b2609bf1d3173aa38269a9af21532c65f730aadd3051f9aae011eea9e246de5
    PHP 8.1.29 (tar.bz2)
    SHA256: 87a60313263f2f533f180e719272ca5e47cd9884d4ec3c93720198eaffae0827
    PHP 8.1.29 (tar.xz)
    SHA256: 288884af60581d4284baba2ace9ca6d646f72facbd3e3c2dd2acc7fe6f903536
    Change Logs
    cgi
    • Fixed bug GHSA-3qgc-jrrr-25jv (Bypass of CVE-2012-1823, Argument Injection in PHP-CGI). (CVE-2024-4577)
    filter
    • Fixed bug GHSA-w8qr-v226-r27w (Filter bypass in filter_var FILTER_VALIDATE_URL). (CVE-2024-5458)
    openssl
    • The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: https://github.com/openssl/openssl/pull/13817 (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since the previous release. All distributors and builders should ensure that this version is used to prevent PHP from being vulnerable.
    standard
    PHP logo

    PHP is developed and maintained by a global community of contributors.

    The PHP Foundation helps fund this work. If PHP is part of your business or projects, consider sponsoring the Foundation.
    PHP

    Learn

    The PHP Foundation

    Legal

    Copyright © 2001 - 2026 the PHP Group. All Rights Reserved.
    To Top