PHP 8.2.1 Release Announcement

The PHP development team announces the immediate availability of PHP 8.2.1. This is a security release.

All PHP 8.2 users are encouraged to upgrade to this version.

For source downloads of PHP 8.2.1 please visit our downloads page, Windows source and binaries can be found on windows.php.net/download/. The list of changes is recorded in the ChangeLog.

Source Code

• PHP 8.2.1 (tar.gz)
  sha256: 6d7b1b8feb14fd1c65a2bc9d0f72c75589a61a946566cf9c3bf9536a5530b635
• PHP 8.2.1 (tar.bz2)
  sha256: 75d6f8f365993ec0d1d9c6281d4557e6feec5a26194a468b8b01459d177efb29
• PHP 8.2.1 (tar.xz)
  sha256: 650d3bd7a056cabf07f6a0f6f1dd8ba45cd369574bbeaa36de7d1ece212c17af

Change Log

• core
  • Fixed bug GH-9905 (constant() behaves inconsistent when class is undefined).
  • Fixed bug GH-9918 (License information for xxHash is not included in README.REDIST.BINS file).
  • Fixed bug GH-9890 (OpenSSL legacy providers not available on Windows).
  • Fixed bug GH-9650 (Can't initialize heap: [0x000001e7]).
  • Fixed potentially undefined behavior in Windows ftok(3) emulation.
  • Fixed GH-9769 (Misleading error message for unpacking of objects).
• apache
  • Fixed bug GH-9949 (Partial content on incomplete POST request).
• fpm
  • Fixed bug GH-9959 (Solaris port event mechanism is still broken after bug #66694).
  • Fixed bug #68207 (Setting fastcgi.error_header can result in a WARNING).
  • Fixed bug #80669 (FPM numeric user fails to set groups).
  • Fixed bug GH-8517 (Random crash of FPM master process in fpm_stdio_child_said).
• imap
  • Fixed bug GH-10051 (IMAP: there's no way to check if a IMAP\Connection is still open).
• mbstring
  • Fixed bug GH-9535 (The behavior of mb_strcut in mbstring has been changed in PHP8.1).
• opcache
  • Fixed bug GH-9968 (Segmentation Fault during OPCache Preload).
• openssl
  • Fixed bug GH-9997 (OpenSSL engine clean up segfault).
  • Fixed bug GH-9064 (PHP fails to build if openssl was built with --no-ec).
  • Fixed bug GH-10000 (OpenSSL test failures when OpenSSL compiled with no-dsa).
• pcntl
  • Fixed bug GH-9298 (Signal handler called after rshutdown leads to crash).
• pdo_firebird
  • Fixed bug GH-9971 (Incorrect NUMERIC value returned from PDO_Firebird).
• pdo/sqlite
  • Fixed bug #81740 (PDO::quote() may return unquoted string). (CVE-2022-31631)
• session
  • Fixed GH-9932 (session name silently fails with . and [).
• spl
  • Fixed GH-9883 (SplFileObject::__toString() reads next line).
  • Fixed GH-10011 (Trampoline autoloader will get reregistered and cannot be unregistered).
• sqlite3
  • Fixed bug #81742 (open_basedir bypass in SQLite3 by using file URI).
• tsrm
  • Fixed Windows shmget() wrt. IPC_PRIVATE.