PHP Release 8.1.8


    PHP 8.1.8 Release Announcement

    The PHP development team announces the immediate availability of PHP 8.1.8. This is a security release.

    All PHP 8.1 users are encouraged to upgrade to this version.

    For source downloads of PHP 8.1.8 please visit our downloads page, Windows source and binaries can be found on windows.php.net/download/. The list of changes is recorded in the ChangeLog.

    Source Code
    PHP 8.1.8 (tar.gz)
    SHA256: 889d910558d2492f7f2236921b9bcde620674c8b684ec02d126060f8ca45dc8d
    PHP 8.1.8 (tar.bz2)
    SHA256: b8815a5a02431453d4261e3598bd1f28516e4c0354f328c12890f257870e4c01
    PHP 8.1.8 (tar.xz)
    SHA256: 04c065515bc347bc68e0bb1ac7182669a98a731e4a17727e5731650ad3d8de4c
    Change Logs
    core
    • Fixed bug GH-8338 (Intel CET is disabled unintentionally).
    • Fixed leak in Enum::from/tryFrom for internal enums when using JIT
    • Fixed calling internal methods with a static return type from extension code.
    • Fixed bug GH-8655 (Casting an object to array does not unwrap refcount=1 references).
    • Fixed potential use after free in php_binary_init().
    • Fixed bug GH-7942 (Indirect mutation of readonly properties through references).
    cli
    • Fixed GH-8827 (Intentionally closing std handles no longer possible).
    com
    • Fixed bug GH-8778 (Integer arithmethic with large number variants fails).
    curl
    • Fixed CURLOPT_TLSAUTH_TYPE is not treated as a string option.
    date
    • Fixed bug #72963 (Null-byte injection in CreateFromFormat and related functions).
    • Fixed bug #74671 (DST timezone abbreviation has incorrect offset).
    • Fixed bug #77243 (Weekdays are calculated incorrectly for negative years).
    • Fixed bug #78139 (timezone_open accepts invalid timezone string argument).
    fileinfo
    • Fixed bug #81723 (Heap buffer overflow in finfo_buffer). (CVE-2022-31627)
    fpm
    • Fixed bug #67764 (fpm: syslog.ident don't work).
    gd
    • Fixed imagecreatefromavif() memory leak.
    mbstring
    • mb_detect_encoding recognizes all letters in Czech alphabet
    • mb_detect_encoding recognizes all letters in Hungarian alphabet
    • Fixed bug GH-8685 (pcre not ready at mbstring startup).
    • Backwards-compatible mappings for 0x5C/0x7E in Shift-JIS are restored, after they had been changed in 8.1.0.
    odbc
    • Fixed handling of single-key connection strings.
    opcache
    • Fixed bug GH-8591 (tracing JIT crash after private instance method change).
    openssl
    • Fixed bug #50293 (Several openssl functions ignore the VCWD).
    • Fixed bug #81713 (NULL byte injection in several OpenSSL functions working with certificates).
    pdo_odbc
    • Fixed handling of single-key connection strings.
    zip
    • Fixed bug GH-8781 (ZipArchive::close deletes zip file without updating stat cache).
    PHP logo

    PHP is developed and maintained by a global community of contributors.

    The PHP Foundation helps fund this work. If PHP is part of your business or projects, consider sponsoring the Foundation.
    PHP

    Learn

    The PHP Foundation

    Legal

    Copyright © 2001 - 2026 the PHP Group. All Rights Reserved.
    To Top