Fixed bug GH-18422 (int overflow in php_date_llabs).
intl
Fix incorrect argument positions in out-of-bounds errors for IntlCalendar::set(), IntlCalendar::setDate(), IntlCalendar::setDateTime(), and IntlGregorianCalendar date/time construction.
Expose Spoofchecker restriction-level APIs on all supported ICU versions.
Fix SpoofChecker::setAllowedChars() and IntlDateFormatter::__construct() to report PHP constant names instead of ICU constant names in user-visible error messages.
mysqlnd
Fix persistent free of non-persistent connect_attr key .
opcache
Fixed tracing JIT crash when a VM interrupt is handled during an observed user function call.
Fixed bug GH-22004 (Assertion failure at ext/opcache/jit/zend_jit_trace.c).
openssl
Fix compatibility issues with OpenSSL 4.0.
spl
Fix SplFixedArray::setSize leak when destructor grows during clear.
Fixed bug GH-21933 (use after free of self-freeing MultipleIterator children).
standard
Fixed bug GH-21689 (version_compare() incorrectly handles versions ending with a dot).
Fixed ip2long() leading zeros handling inconsistency on AIX.
PHP 8.4.21
Released 07 May, 2026
core
Fixed bug GH-19983 (GC assertion failure with fibers, generators and destructors).
Fixed bug GH-21478 (Forward property operations to real instance for initialized lazy proxies).
Fixed bug GH-21605 (Missing addref for Countable::count()).
Fixed bug GH-21699 (Assertion failure in shutdown_executor when resolving self::/parent::/static:: callables if the error handler throws).
Fixed cpuset leak in pcntl_setcpuaffinity on out-of-range CPU ID on NetBSD/Solaris platforms.
Fixed pcntl_signal() signal table registering the callback first OS-wise before the internal list.
Fixed pcntl_signal_dispatch() stale pointer and exception handling.
pcre
Fixed preg_match memory leak with invalid regexes.
Fixed pcre2_code leak when pcre2_pattern_info() fails after a successful pcre2_compile(), and match_sets/match_data/marks leaks in php_pcre_match_impl().
pdo_pgsql
Fixed bug GH-21055 (connection attribute status typo for GSS negotiation).
pgsql
Fixed bug GH-21162 (pg_connect() memory leak on error).
sockets
Fixed bug GH-21161 (socket_set_option() crash with array 'addr' entry as null).
Fixed possible addr length overflow with socket_connect() and AF_UNIX family sockets.
windows
Fixed compilation with clang (missing intrin.h include).
PHP 8.4.18
Released 12 Feb, 2026
core
Fixed bug GH-20837 (NULL dereference when calling ob_start() in shutdown function triggered by bailout in php_output_lock_error()).
Fix OSS-Fuzz #471533782 (Infinite loop in GC destructor fiber).
Fixed bug GH-18639 (Internal class aliases can break preloading + JIT).
Fixed bug GH-18899 (JIT function crash when emitting undefined variable warning and opline is not set yet).
Fixed bug GH-14082 (Segmentation fault on unknown address 0x600000000018 in ext/opcache/jit/zend_jit.c).
Fixed bug GH-18898 (SEGV zend_jit_op_array_hot with property hooks and preloading).
openssl
Fixed bug #80770 (It is not possible to get client peer certificate with stream_socket_server).
pcntl
Fixed bug GH-18958 (Fatal error during shutdown after pcntl_rfork() or pcntl_forkx() with zend-max-execution-timers).
phar
Fix stream double free in phar.
Fix phar crash and file corruption with SplFileObject.
soap
Fixed bug GH-18990, bug #81029, bug #47314 (SOAP HTTP socket not closing on object destruction).
Fix memory leak when URL parsing fails in redirect.
spl
Fixed bug GH-19094 (Attaching class with no Iterator implementation to MultipleIterator causes crash).
standard
Fix misleading errors in printf().
Fix RCN violations in array functions.
Fixed GH-18976 pack() overflow with h/H format and INT_MAX repeater value.
streams
Fixed GH-13264 (fgets() and stream_get_line() do not return false on filter fatal error).
zip
Fix leak when path is too long in ZipArchive::extractTo().
PHP 8.4.10
Released 03 Jul, 2025
bcmath
Fixed bug GH-18641 (Accessing a BcMath\Number property by ref crashes).
core
Fixed bugs GH-17711 and GH-18022 (Infinite recursion on deprecated attribute evaluation) and GH-18464 (Recursion protection for deprecation constants not released on bailout).
Fixed GH-18695 (zend_ast_export() - float number is not preserved).
Fix handling of references in zval_try_get_long().
Do not delete main chunk in zend_gc.
Fix compile issues with zend_alloc and some non-default options.
curl
Fix memory leak when setting a list via curl_setopt fails.
date
Fix leaks with multiple calls to DatePeriod iterator current().
dom
Fixed bug GH-18744 (classList works not correctly if copy HTMLElement by clone keyword).
Fix GH-14978 (The xmlreader extension phpize build).
Throw Error exception when encountering recursion during comparison, rather than fatal error.
Added missing cstddef include for C++ builds.
Updated build system scripts config.guess to 2024-07-27 and config.sub to 2024-05-27.
Fixed bug GH-15240 (Infinite recursion in trait hook).
Fixed bug GH-15140 (Missing variance check for abstract set with asymmetric type).
Fixed bug GH-15181 (Disabled output handler is flushed again).
Passing E_USER_ERROR to trigger_error() is now deprecated.
Fixed bug GH-15292 (Dynamic AVX detection is broken for MSVC).
Using "_" as a class name is now deprecated.
Exiting a namespace now clears seen symbols.
The exit (and die) language constructs now behave more like a function. They can be passed liked callables, are affected by the strict_types declare statement, and now perform the usual type coercions instead of casting any non-integer value to a string. As such, passing invalid types to exit/die may now result in a TypeError being thrown.
Fixed bug GH-15438 (Hooks on constructor promoted properties without visibility are ignored).
Fixed bug GH-15419 (Missing readonly+hook incompatibility check for readonly classes).
The mysqli_ping() function and mysqli::ping() method are now deprecated, as the reconnect feature was removed in PHP 8.2.
The mysqli_kill() function and mysqli::kill() method are now deprecated. If this functionality is needed a SQL "KILL" command can be used instead.
The mysqli_refresh() function and mysqli::refresh() method are now deprecated. If this functionality is needed a SQL "FLUSH" command can be used instead.
Passing explicitly the $mode parameter to mysqli_store_result() has been deprecated. As the MYSQLI_STORE_RESULT_COPY_DATA constant was only used in conjunction with this function it has also been deprecated.
Fixed bug #44383 (PHP DateTime not converted to xsd:datetime).
Fixed bug GH-11941 (soap with session persistence will silently fail when "session" built as a shared object).
Passing an int to SoapServer::addFunction() is now deprecated. If all PHP functions need to be provided flatten the array returned by get_defined_functions().
The SOAP_FUNCTIONS_ALL constant is now deprecated.
Fixed bug #61525 (SOAP functions require at least one space after HTTP header colon).
Changed return type of long2ip to string from string|false.
Fix GH-12143 (Extend the maximum precision round can handle by one digit).
Added the http_get_last_response_headers() and http_clear_last_response_headers() that allows retrieving the same content as the magic $http_response_header variable.
Add php_base64_encode_ex() API.
Implemented "Raising zero to the power of negative number" RFC.
Added array_find(), array_find_key(), array_all(), and array_any().
Change highlight_string() and print_r() return type to string|true.
Fix references in request_parse_body() options array.
Add RoundingMode enum.
Unserializing the uppercase 'S' tag is now deprecated.
Enables crc32 auxiliary detection on OpenBSD.
Passing a non-empty string for the $escape parameter of:
fputcsv()
fgetcsv()
str_getcsv() is now deprecated.
The str_getcsv() function now throws ValueErrors when the $separator and $enclosure arguments are not one byte long, or if the $escape is not one byte long or the empty string. This aligns the behaviour to be identical to that of fputcsv() and fgetcsv().
php_uname() now throws ValueErrors on invalid inputs.
The "allowed_classes" option for unserialize() now throws TypeErrors and ValueErrors if it is not an array of class names.
Implemented GH-15685 (improve proc_open error reporting on Windows).
Add support for backed enums in http_build_query().
Fixed bug GH-15982 (Assertion failure with array_find when references are involved).
Fixed parameter names of fpow() to be identical to pow().
streams
Implemented GH-15155 (Stream context is lost when custom stream wrapper is being filtered).
tidy
Failures in the constructor now throw exceptions rather than emitting warnings and having a broken object.
Add tidyNode::getNextSibling() and tidyNode::getPreviousSibling().
windows
Update the icon of the Windows executables, e.g. php.exe.
