PHP Release 8.3.31

    PHP 8.3.31 Release Announcement

    The PHP development team announces the immediate availability of PHP 8.3.31. This is a security release.

    All PHP 8.3 users are encouraged to upgrade to this version.

    For source downloads of PHP 8.3.31 please visit our downloads page, Windows source and binaries can also be found there. The list of changes is recorded in the ChangeLog.

    Source Code
    PHP 8.3.31 (tar.gz)
    SHA256: 4e7baaf0a690e954a20e7ced3dd633ce8cb8094e2b6b612a55e703ecbbdcbf4f
    PHP 8.3.31 (tar.bz2)
    SHA256: e6986b1fd37eb25402127fe4a7278a3e03b7f9025bb7a4bd292a271bdf930fb9
    PHP 8.3.31 (tar.xz)
    SHA256: 66410cee07f4b2baeb0843140bb2a2b52ef930b5cf9b3d6e6d158b33aae8fa37
    Change Logs
    curl
    • Add support for brotli and zstd on Windows.
    fpm
    mbstring
    • Fixed GHSA-wm6j-2649-pv75 (Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()). (CVE-2026-7259)
    openssl
    • Fix compatibility issues with OpenSSL 4.0.
    pdo_firebird
    soap
    • Fixed GHSA-85c2-q967-79q5 (Stale SOAP_GLOBAL(ref_map) pointer with Apache Map). (CVE-2026-6722)
    • Fixed GHSA-m33r-qmcv-p97q (Use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION). (CVE-2026-7261)
    • Fixed GHSA-hmxp-6pc4-f3vv (Broken Apache map value NULL check). (CVE-2026-7262)
    standard
    PHP logo

    PHP is developed and maintained by a global community of contributors.

    The PHP Foundation helps fund this work. If PHP is part of your business or projects, consider sponsoring the Foundation.
    PHP

    Learn

    The PHP Foundation

    Legal

    Copyright © 2001 - 2026 the PHP Group. All Rights Reserved.
    To Top