PHP 8.5.3 Release Announcement

The PHP development team announces the immediate availability of PHP 8.5.3. This is a bug fix release.

All PHP 8.5 users are encouraged to upgrade to this version.

For source downloads of PHP 8.5.3 please visit our downloads page, Windows source and binaries can also be found there. The list of changes is recorded in the ChangeLog.

Source Code

• PHP 8.5.3 (tar.gz)
  sha256: 402654d99b4beda602d4daec4f1cd39aafdacf5923e3e947da87392826660146
• PHP 8.5.3 (tar.bz2)
  sha256: fc5ecabc183ceb64d9fca3dcd387bd29b2b67448326af998fde003124916823b
• PHP 8.5.3 (tar.xz)
  sha256: ce65725b8af07356b69a6046d21487040b11f2acfde786de38b2bfb712c36eb9

Change Log

• core
  • Fixed bug GH-20806 (preserve_none feature compatiblity with LTO).
  • Fixed bug GH-20767 (build failure with musttail/preserve_none feature on macOs).
  • Fixed bug GH-20837 (NULL dereference when calling ob_start() in shutdown function triggered by bailout in php_output_lock_error()).
  • Fix OSS-Fuzz #471533782 (Infinite loop in GC destructor fiber).
  • Fix OSS-Fuzz #472563272 (Borked block_pass JMP[N]Z optimization).
  • Fixed bug GH-20914 (Internal enums can be cloned and compared).
  • Fix OSS-Fuzz #474613951 (Leaked parent property default value).
  • Fixed bug GH-20895 (ReflectionProperty does not return the PHPDoc of a property if it contains an attribute with a Closure).
  • Fixed bug GH-20766 (Use-after-free in FE_FREE with GC interaction).
  • Fix OSS-Fuzz #471486164 (Broken by-ref assignment to uninitialized hooked backing value).
  • Fix OSS-Fuzz #438780145 (Nested finally with repeated return type check may uaf).
  • Fixed bug GH-20905 (Lazy proxy bailing __clone assertion).
  • Fixed bug GH-20479 (Hooked object properties overflow).
• date
  • Update timelib to 2022.16.
• dom
  • Fixed GH-21041 (Dom\HTMLDocument corrupts closing tags within scripts).
• mbstring
  • Fixed bug GH-20833 (mb_str_pad() divide by zero if padding string is invalid in the encoding).
  • Fixed bug GH-20836 (Stack overflow in mb_convert_variables with recursive array references).
• opcache
  • Fixed bug GH-20818 (Segfault in Tracing JIT with object reference).
• openssl
  • Fix memory leaks when sk_X509_new_null() fails.
  • Fix crash when in openssl_x509_parse() when i2s_ASN1_INTEGER() fails.
  • Fix crash in openssl_x509_parse() when X509_NAME_oneline() fails.
• phar
  • Fixed bug GH-20882 (buildFromIterator breaks with missing base directory).
• pgsql
  • Fixed INSERT/UPDATE queries building with PQescapeIdentifier() and possible UB.
• readline
  • Fixed bug GH-18139 (Memory leak when overriding some settings via readline_info()).
• spl
  • Fixed bug GH-20856 (heap-use-after-free in SplDoublyLinkedList iterator when modifying during iteration).
• standard
  • Fixed bug #74357 (lchown fails to change ownership of symlink with ZTS)
  • Fixed bug GH-20843 (var_dump() crash with nested objects)