PHP 8.2.24 Release Announcement

The PHP development team announces the immediate availability of PHP 8.2.24. This is a security release.

All PHP 8.2 users are encouraged to upgrade to this version.

For source downloads of PHP 8.2.24 please visit our downloads page, Windows source and binaries can be found on windows.php.net/download/. The list of changes is recorded in the ChangeLog.

Source Code

• PHP 8.2.24 (tar.gz)
  sha256: 5d26441969279a594e404bb9f2e17b6f74bb10606fe05911e739137673ae6c4c
• PHP 8.2.24 (tar.bz2)
  sha256: 4cc76ec644eee97d17c92bfe8d0e84714fedf299a538b7dfadc0639dd0dc432f
• PHP 8.2.24 (tar.xz)
  sha256: 80a5225746a9eb484475b312d4c626c63a88a037d8e56d214f30205e1ba1411a

Change Log

• cgi
  • Fixed bug GHSA-p99j-rfp4-xqvq (Bypass of CVE-2024-4577, Parameter Injection Vulnerability). (CVE-2024-8926)
  • Fixed bug GHSA-94p6-54jq-9mwp (cgi.force_redirect configuration is bypassable due to the environment variable collision). (CVE-2024-8927)
• core
  • Fixed bug GH-15408 (MSan false-positve on zend_max_execution_timer).
  • Fixed bug GH-15515 (Configure error grep illegal option q).
  • Fixed bug GH-15514 (Configure error: genif.sh: syntax error).
  • Fixed bug GH-15565 (--disable-ipv6 during compilation produces error EAI_SYSTEM not found).
  • Fixed bug GH-15587 (CRC32 API build error on arm 32-bit).
  • Fixed bug GH-15330 (Do not scan generator frames more than once).
  • Fixed uninitialized lineno in constant AST of internal enums.
• curl
  • FIxed bug GH-15547 (curl_multi_select overflow on timeout argument).
• dom
  • Fixed bug GH-15551 (Segmentation fault (access null pointer) in ext/dom/xml_common.h).
• fileinfo
  • Fixed bug GH-15752 (Incorrect error message for finfo_file with an empty filename argument).
• fpm
  • Fixed bug GHSA-865w-9rf3-2wh5 (Logs from childrens may be altered). (CVE-2024-9026)
• mysqlnd
  • Fixed bug GH-15432 (Heap corruption when querying a vector).
• opcache
  • Fixed bug GH-15661 (Access null pointer in Zend/Optimizer/zend_inference.c).
  • Fixed bug GH-15658 (Segmentation fault in Zend/zend_vm_execute.h).
• sapi
  • Fixed bug GHSA-9pqp-7h25-4f32 (Erroneous parsing of multipart form data). (CVE-2024-8925)
• soap
  • Fixed bug #73182 (PHP SOAPClient does not support stream context HTTP headers in array form).
• standard
  • Fixed bug GH-15552 (Signed integer overflow in ext/standard/scanf.c).
• streams
  • Fixed bug GH-15628 (php_stream_memory_get_buffer() not zero-terminated).