Fixed bug GH-19577 (Avoid integer overflow when using a small offset and PHP_INT_MAX with LimitIterator).
streams
Remove incorrect call to zval_ptr_dtor() in user_wrapper_metadata().
Fix OSS-Fuzz #385993744.
tidy
Fixed GH-19021 build issue with libtidy in regard of tidyOptIsReadonly deprecation and TidyInternalCategory being available later than tidyOptGetCategory.
zip
Fix memory leak in zip when encountering empty glob result.
PHP 8.3.25
Released 28 Aug, 2025
core
Fixed GH-19169 build issue with C++17 and ZEND_STATIC_ASSERT macro.
Fixed bug GH-18581 (Coerce numeric string keys from iterators when argument unpacking).
Fixed OSS-Fuzz #434346548 (Failed assertion with throwing __toString in binary const expr).
Fixed bug GH-19305 (Operands may be being released during comparison).
Fixed bug GH-13970 (Incorrect validation of #[Attribute] flags type for non-compile-time expressions).
dom
Fix crashes when entity declaration is removed while still having entity references.
Fix references not handled correctly in C14N.
Fix crash when calling childNodes next() when iterator is exhausted.
Fix crash in ParentNode::append() when dealing with a fragment containing text nodes.
filter
Fixed bug GHSA-w8qr-v226-r27w (Filter bypass in filter_var FILTER_VALIDATE_URL). (CVE-2024-5458)
fpm
Fix bug GH-14175 (Show decimal number instead of scientific notation in systemd status).
hash
ext/hash: Swap the checking order of `__has_builtin` and `__GNUC__`
intl
Fixed build regression on systems without C++17 compilers.
mysqlnd
Fix bug GH-14255 (mysqli_fetch_assoc reports error from nested query).
opcache
Fixed bug GH-14109 (Fix accidental persisting of internal class constant in shm).
openssl
The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: https://github.com/openssl/openssl/pull/13817 (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since the previous release. All distributors and builders should ensure that this version is used to prevent PHP from being vulnerable.
Fixed bug GH-12854 (8.3 - as final trait-used method does not correctly report visibility in Reflection).
cli
Fix incorrect timeout in built-in web server when using router script and max_input_time.
dom
Fixed bug GH-12870 (Creating an xmlns attribute results in a DOMException).
Fix crash when toggleAttribute() is used without a document.
Fix crash in adoptNode with attribute references.
Fixed bug GH-13012 (DOMNode::isEqualNode() is incorrect when attribute order is different).
ffi
Fixed bug GH-9698 (stream_wrapper_register crashes with FFI\CData).
Fixed bug GH-12905 (FFI::new interacts badly with observers).
gd
Fixed GH-13082 undefined behavior with GdFont instances handling with imageload* and imagechar*.
intl
Fixed GH-12943 (IntlDateFormatter::__construct accepts 'C' as valid locale).
hash
Fixed bug GH-12936 (hash() function hangs endlessly if using sha512 on strings >= 4GiB).
mbstring
When operating on a string with invalid encoding, mb_substr (as well as mb_strstr and its variants) defines character indices in the same way as other mbstring functions such as mb_strpos.
odbc
Fix crash on Apache shutdown with persistent connections.
opcache
Fixed oss-fuzz #64727 (JIT undefined array key warning may overwrite DIM with NULL when DIM is the same var as result).
Added workaround for SELinux mprotect execheap issue. See https://bugzilla.kernel.org/show_bug.cgi?id=218258.
openssl
Fixed bug GH-12987 (openssl_csr_sign might leak new cert on error).
pdo
Fix GH-12969 (Fixed PDO::getAttribute() to get PDO::ATTR_STRINGIFY_FETCHES).
pdo_odbc
Fixed bug GH-12767 (Unable to turn on autocommit mode with setAttribute()).
pgsql
Fixed auto_reset_persistent handling and allow_persistent type.
Fixed bug GH-12974 (Apache crashes on shutdown when using pg_pconnect()).
phar
Fixed bug #77432 (Segmentation fault on including phar file).
phpdbg
Fixed bug GH-12962 (Double free of init_file in phpdbg_prompt.c).
simplexml
Fix getting the address of an uninitialized property of a SimpleXMLElement resulting in a crash.
Fixed bug GH-12929 (SimpleXMLElement with stream_wrapper_register can segfault).
tidy
Fixed bug GH-12980 (tidynode.props.attribute is missing "Boolean Attributes" and empty attributes).
PHP 8.3.1
Released 21 Dec, 2023
core
Fixed bug GH-12758 / GH-12768 (Invalid opline in OOM handlers within ZEND_FUNC_GET_ARGS and ZEND_BIND_STATIC).
Fix various missing NULL checks.
Fixed bug GH-12835 (Leak of call->extra_named_params on internal __call).
Fixed bug GH-12826 (Weird pointers issue in nested loops).
fpm
Fixed bug GH-12705 (Segmentation fault in fpm_status_export_to_zval).
Removed the BC break on IntlDateFormatter::construct which threw an exception with an invalid locale.
json
Added json_validate().
ldap
Deprecate calling ldap_connect() with separate hostname and port.
libxml
Fix compile error with -Werror=incompatible-function-pointer-types and old libxml2.
mbstring
mb_detect_encoding is better able to identify the correct encoding for Turkish text.
mb_detect_encoding's "non-strict" mode now behaves as described in the documentation. Previously, it would return false if the same byte (for example, the first byte) of the input string was invalid in all candidate encodings. More generally, it would eliminate candidate encodings from consideration when an invalid byte was seen, and if the same input byte eliminated all remaining encodings still under consideration, it would return false. On the other hand, if all candidate encodings but one were eliminated from consideration, it would return the last remaining one without regard for how many encoding errors might be encountered later in the string. This is different from the behavior described in the documentation, which says: "If strict is set to false, the closest matching encoding will be returned."
mb_strtolower, mb_strtotitle, and mb_convert_case implement conditional casing rules for the Greek letter sigma. For mb_convert_case, conditional casing only applies to MB_CASE_LOWER and MB_CASE_TITLE modes, not to MB_CASE_LOWER_SIMPLE and MB_CASE_TITLE_SIMPLE.
mb_detect_encoding is better able to identify UTF-8 and UTF-16 strings with a byte-order mark.
mb_decode_mimeheader interprets underscores in QPrint-encoded MIME encoded words as required by RFC 2047; they are converted to spaces. Underscores must be encoded as "=5F" in such MIME encoded words.
mb_encode_mimeheader no longer drops NUL (zero) bytes when QPrint-encoding the input string. This previously caused strings in certain text encodings, especially UTF-16 and UTF-32, to be corrupted by mb_encode_mimeheader.
Implement mb_str_pad() RFC.
Fixed bug GH-11514 (PHP 8.3 build fails with --enable-mbstring enabled).
Fix use-after-free of mb_list_encodings() return value.
Fixed bug GH-11992 (utf_encodings.phpt fails on Windows 32-bit).
mysqli
mysqli_fetch_object raises a ValueError instead of an Exception.
opcache
Added start, restart and force restart time to opcache's phpinfo section.
Fix GH-9139: Allow FFI in opcache.preload when opcache.preload_user=root.
Made opcache.preload_user always optional in the cli and phpdbg SAPIs.
Allows W/X bits on page creation on FreeBSD despite system settings.
Added memfd api usage, on Linux, for zend_shared_alloc_create_lock() to create an abstract anonymous file for the opcache's lock.
Avoid resetting JIT counter handlers from multiple processes/threads.
Fixed COPY_TMP type inference for references.
openssl
Added OPENSSL_CMS_OLDMIMETYPE and PKCS7_NOOLDMIMETYPE contants to switch between mime content types.
Fixed GH-11054: Reset OpenSSL errors when using a PEM public key.
Added support for additional EC parameters in openssl_pkey_new.
pcntl
SA_ONSTACK is now set for pcntl_signal.
Added SIGINFO constant.
pcre
Update bundled libpcre2 to 10.42.
pgsql
pg_fetch_object raises a ValueError instead of an Exception.
pg_cancel use thread safe PQcancel api instead.
pg_trace new PGSQL_TRACE_SUPPRESS_TIMESTAMPS/PGSQL_TRACE_REGRESS_MODE contants support.
