Skip to content

Commit 6f3f21b

Browse files
ericmannericmann
committed
Announce PHP 8.4.24
1 parent a5c7ef0 commit 6f3f21b

7 files changed

Lines changed: 197 additions & 10 deletions

File tree

‎ChangeLog-8.php‎

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1236,6 +1236,118 @@
12361236

12371237
<a id="PHP_8_4"></a>
12381238

1239+
<section class="version" id="8.4.24"><!-- {{{ 8.4.24 -->
1240+
<h3>Version 8.4.24</h3>
1241+
<b><?php release_date('30-Jul-2026'); ?></b>
1242+
<ul><li>BCMath:
1243+
<ul>
1244+
<li>Fixed <?php githubsecurityl('php/php-src', 'x692-q9x7-8c3f'); ?> (Out-of-bounds write in bccomp()). (CVE-2026-17544)</li>
1245+
</ul></li>
1246+
<li>Calendar:
1247+
<ul>
1248+
<li>Fixed bug <?php githubissuel('php/php-src', 22602); ?> (gregoriantojd() and juliantojd() integer overflow with INT_MAX year).</li>
1249+
</ul></li>
1250+
<li>Date:
1251+
<ul>
1252+
<li>Update timelib to 2022.17.</li>
1253+
<li>Fixed bug <?php githubissuel('php/php-src', 19803); ?> (Parsing a string with a single white space does create an error).</li>
1254+
<li>Fixed Unix timestamps in February of the year 0 are misparsed with @-notation.</li>
1255+
<li>Fixed bug <?php githubissuel('php/php-src', 11310); ?> (__debugInfo does nothing on userland classes extending Date classes).</li>
1256+
</ul></li>
1257+
<li>DBA:
1258+
<ul>
1259+
<li>Fixed OOB read on malformed length field in dba flatfile handler.</li>
1260+
</ul></li>
1261+
<li>DOM:
1262+
<ul>
1263+
<li>Fixed bug <?php githubissuel('php/php-src', 22570); ?> (Stack overflow when serializing a deeply nested Dom\XMLDocument).</li>
1264+
</ul></li>
1265+
<li>Exif:
1266+
<ul>
1267+
<li>Fixed bug <?php githubissuel('php/php-src', 11020); ?> (exif_read_data() emits a spurious "Illegal IFD size" warning when an IFD is not followed by a next-IFD offset).</li>
1268+
</ul></li>
1269+
<li>GD:
1270+
<ul>
1271+
<li>Upgrade libgd. (CVE-2026-9672)</li>
1272+
</ul></li>
1273+
<li>Hash:
1274+
<ul>
1275+
<li>Fixed bug <?php githubissuel('php/php-src', 18173); ?> (ext/hash relies on implementation-defined malloc alignment).</li>
1276+
</ul></li>
1277+
<li>Intl:
1278+
<ul>
1279+
<li>Fixed Locale::lookup() and locale_lookup() to return NULL instead of the fallback locale when a language tag cannot be canonicalized.</li>
1280+
<li>Fixed memory leaks when calling Collator::__construct() or Spoofchecker::__construct() twice.</li>
1281+
<li>Fixed IntlChar methods leaving stale global error state after successful calls.</li>
1282+
</ul></li>
1283+
<li>ODBC:
1284+
<ul>
1285+
<li>Fixed bug <?php githubissuel('php/php-src', 22668); ?> (Heap buffer over-read when a column value exceeds the driver-reported display size).</li>
1286+
</ul></li>
1287+
<li>OpenSSL:
1288+
<ul>
1289+
<li>Fixed timeout for supplemental read at end of a blocking stream in SSL stream wrapper.</li>
1290+
</ul></li>
1291+
<li>PDO_ODBC:
1292+
<ul>
1293+
<li>Fixed bug <?php githubissuel('php/php-src', 20726); ?> (Crash with ODBC connection pooling when the DSN carries no credentials).</li>
1294+
<li>Fixed bug <?php githubissuel('php/php-src', 22667); ?> (Heap buffer over-read when a column value exceeds the driver-reported display size).</li>
1295+
<li>Fixed bug <?php githubissuel('php/php-src', 22666); ?> (Heap buffer overflow when an output parameter value is longer than the declared maxlen).</li>
1296+
<li>Fixed bug <?php githubissuel('php/php-src', 22665); ?> (Out-of-bounds write when the ODBC driver reports a diagnostic message length beyond the error buffer).</li>
1297+
</ul></li>
1298+
<li>PGSQL:
1299+
<ul>
1300+
<li>Fixed <?php githubsecurityl('php/php-src', '7qpv-r5mr-78m4'); ?> (SQL injection via E'...' backslash breakout). (CVE-2026-17543)</li>
1301+
</ul></li>
1302+
<li>Phar:
1303+
<ul>
1304+
<li>Fixed inconsistent handling of the magic ".phar" directory. Paths such as "/.phar" remain protected, while non-magic paths that merely start with ".phar" are handled consistently across file and directory creation, copying, ArrayAccess, stream lookup, directory iteration and extraction.</li>
1305+
<li>Fixed <?php githubsecurityl('php/php-src', 'vc5h-9ppw-p5f3'); ?> (Crash via recursive symlinks). (CVE-2026-7260)</li>
1306+
</ul></li>
1307+
<li>PHPDBG:
1308+
<ul>
1309+
<li>Fixed bug <?php githubissuel('php/php-src', 17387); ?> (Trivial crash in phpdbg lexer).</li>
1310+
<li>Fixed fleaked lowercased lookup keys in phpdbg_resolve_opline_break.</li>
1311+
<li>Fixed off-by-one in phpdbg_safe_class_lookup() causing class lookups to always fail during phpdbg's signal-safe interruption path.</li>
1312+
</ul></li>
1313+
<li>Reflection:
1314+
<ul>
1315+
<li>Fixed bug <?php githubissuel('php/php-src', 22324); ?> (Ignore leading namespace separator in ReflectionParameter::__construct()).</li>
1316+
<li>Fixed bug <?php githubissuel('php/php-src', 22441); ?> (ReflectionClass::hasProperty() and getProperty() ignore dynamic properties shadowing a private parent property).</li>
1317+
<li>Fixed bug <?php githubissuel('php/php-src', 22658); ?> (ReflectionConstant::__toString() with a string value with null bytes truncates output).</li>
1318+
<li>Fixed bug <?php githubissuel('php/php-src', 22681); ?> (Reflection*::__toString() truncates on null bytes).</li>
1319+
</ul></li>
1320+
<li>Session:
1321+
<ul>
1322+
<li>Fixed bug <?php githubissuel('php/php-src', 21314); ?> (Different session garbage collector behavior between PHP 8.3 and PHP 8.5).</li>
1323+
</ul></li>
1324+
<li>SPL:
1325+
<ul>
1326+
<li>Fix class_parents for classes with leading slash in non-autoload mode.</li>
1327+
<li>Ignore leading back-slash in class_parents(), class_implements(), and class_uses().</li>
1328+
<li>Fixed bug <?php githubissuel('php/php-src', 16217); ?> (SplFileObject::fputcsv() on an uninitialized object segfaults).</li>
1329+
</ul></li>
1330+
<li>Standard:
1331+
<ul>
1332+
<li>Fixed bug <?php githubissuel('php/php-src', 22360); ?> (convert.base64-encode corruption on incremental flush).</li>
1333+
<li>Fixed bug <?php githubissuel('php/php-src', 22395); ?> (base_convert() outputs at most 64 characters).</li>
1334+
<li>Fixed integer overflow in getimagesize() and getimagesizefromstring() when parsing an IFF chunk with a size of INT_MAX.</li>
1335+
<li>Fixed bug <?php githubissuel('php/php-src', 22678); ?> (Use-after-free in array_multisort() when the comparator mutates the array being sorted).</li>
1336+
</ul></li>
1337+
<li>Streams:
1338+
<ul>
1339+
<li>Fixed bug <?php githubissuel('php/php-src', 22617); ?> (persistent stream keys truncated at null bytes, causing distinct abstract unix domain sockets to share a resource).</li>
1340+
</ul></li>
1341+
<li>Zip:
1342+
<ul>
1343+
<li>Fixed bug <?php githubissuel('php/php-src', 22649); ?> (ZipArchive::setCommentName() and setCommentIndex() could crash after overwriting an entry and resetting its inherited unchanged comment).</li>
1344+
<li>Fixed bug <?php githubissuel('php/php-src', 21705); ?> (ZipArchive::getFromIndex() ignores ZipArchive::FL_UNCHANGED for deleted entries).</li>
1345+
</ul></li>
1346+
</ul>
1347+
<!-- }}} --></section>
1348+
1349+
1350+
12391351
<section class="version" id="8.4.23"><!-- {{{ 8.4.23 -->
12401352
<h3>Version 8.4.23</h3>
12411353
<b><?php release_date('03-Jul-2026'); ?></b>

‎archive/archive.xml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
<uri>http://php.net/contact</uri>
1010
<email>php-webmaster@lists.php.net</email>
1111
</author>
12+
<xi:include href="entries/2026-07-30-5.xml"/>
1213
<xi:include href="entries/2026-07-30-4.xml"/>
1314
<xi:include href="entries/2026-07-30-3.xml"/>
1415
<xi:include href="entries/2026-07-30-2.xml"/>

‎archive/entries/2026-07-30-5.xml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
<?xml version="1.0" encoding="utf-8"?>
2+
<entry xmlns="http://www.w3.org/2005/Atom">
3+
<title>PHP 8.4.24 Released!</title>
4+
<id>https://www.php.net/archive/2026.php#2026-07-30-5</id>
5+
<published>2026-07-30T14:55:16+00:00</published>
6+
<updated>2026-07-30T14:55:16+00:00</updated>
7+
<link href="https://www.php.net/index.php#2026-07-30-5" rel="alternate" type="text/html"/>
8+
<link href="https://www.php.net/archive/2026.php#2026-07-30-5" rel="via" type="text/html"/>
9+
<category term="releases" label="New PHP release"/>
10+
<category term="frontpage" label="PHP.net frontpage news"/>
11+
<content type="xhtml">
12+
<div xmlns="http://www.w3.org/1999/xhtml"><p>The PHP development team announces the immediate availability of PHP 8.4.24. This is a security release.</p>
13+
14+
<p>All PHP 8.4 users are encouraged to upgrade to this version.</p>
15+
16+
<p>For source downloads of PHP 8.4.24 please visit our <a href="https://www.php.net/downloads.php">downloads page</a>,
17+
Windows source and binaries can also be found <a href="https://www.php.net/downloads.php?os=windows&amp;version=8.4">there</a>.
18+
The list of changes is recorded in the <a href="https://www.php.net/ChangeLog-8.php#8.4.24">ChangeLog</a>.
19+
</p> </div>
20+
</content>
21+
</entry>

‎include/release-qa.php‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -75,12 +75,12 @@
7575
'active' => true,
7676
'release' => [
7777
'type' => 'RC',
78-
'number' => 1,
79-
'sha256_bz2' => '69884d0668993a12b161882576295708de46a2f6b56374a1b161c94afe652d7e',
80-
'sha256_gz' => '0cc5b8c97adbd854222695f3e45667d3b2dd3b9fa1d0f4c9cb0c965a0e291d48',
81-
'sha256_xz' => '39fcc5625ca453232cc46601029ed48b09efe9ea5c76575f365027fbd7b72e8b',
78+
'number' => 0,
79+
'sha256_bz2' => '',
80+
'sha256_gz' => '',
81+
'sha256_xz' => '',
8282
'date' => '16 July 2026',
83-
'baseurl' => 'https://downloads.php.net/~saki/',
83+
'baseurl' => 'https://downloads.php.net/',
8484
],
8585
],
8686

‎include/releases.inc‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,43 @@
22
$OLDRELEASES = array (
33
8 =>
44
array (
5+
'8.4.23' =>
6+
array (
7+
'announcement' =>
8+
array (
9+
'English' => '/releases/8_4_23.php',
10+
),
11+
'tags' =>
12+
array (
13+
0 => 'security',
14+
),
15+
'date' => '02 Jul 2026',
16+
'source' =>
17+
array (
18+
0 =>
19+
array (
20+
'filename' => 'php-8.4.23.tar.gz',
21+
'name' => 'PHP 8.4.23 (tar.gz)',
22+
'sha256' => 'f43b69572cabfb91c023356f3ce197c782d8a255bc084c1a6af58c0e86cf7573',
23+
'date' => '02 Jul 2026',
24+
),
25+
1 =>
26+
array (
27+
'filename' => 'php-8.4.23.tar.bz2',
28+
'name' => 'PHP 8.4.23 (tar.bz2)',
29+
'sha256' => 'c142c063b10cff68d072766e3ffbfb3654a089b938668b0830356437ee95e0fa',
30+
'date' => '02 Jul 2026',
31+
),
32+
2 =>
33+
array (
34+
'filename' => 'php-8.4.23.tar.xz',
35+
'name' => 'PHP 8.4.23 (tar.xz)',
36+
'sha256' => '1ab9f52008414e43bb2427ffa288eff2a4de39e1a830f957e800ba368d887a72',
37+
'date' => '02 Jul 2026',
38+
),
39+
),
40+
'museum' => false,
41+
),
542
'8.3.32' =>
643
array (
744
'announcement' =>

‎include/version.inc‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -34,13 +34,13 @@ $RELEASES = (function () {
3434

3535
/* PHP 8.4 Release */
3636
$data['8.4'] = [
37-
'version' => '8.4.23',
38-
'date' => '02 Jul 2026',
37+
'version' => '8.4.24',
38+
'date' => '30 Jul 2026',
3939
'tags' => ['security'], // Set to ['security'] for security releases.
4040
'sha256' => [
41-
'tar.gz' => 'f43b69572cabfb91c023356f3ce197c782d8a255bc084c1a6af58c0e86cf7573',
42-
'tar.bz2' => 'c142c063b10cff68d072766e3ffbfb3654a089b938668b0830356437ee95e0fa',
43-
'tar.xz' => '1ab9f52008414e43bb2427ffa288eff2a4de39e1a830f957e800ba368d887a72',
41+
'tar.gz' => 'd5fe6a1d7633e70645dc757461eeb7b764ff6a04d0487f076dd56f1f9d8059db',
42+
'tar.bz2' => '286890447588510df110ede9e9ce09f1eb4f9856630b47fdc40ece70e20373cf',
43+
'tar.xz' => 'e127be09a8506f4327c5cfa78a614b00d210714484ec215ce0011b4a03c00731',
4444
]
4545
];
4646

‎releases/8_4_24.php‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
<?php
2+
$_SERVER['BASE_PAGE'] = 'releases/8_4_24.php';
3+
include_once __DIR__ . '/../include/prepend.inc';
4+
site_header('PHP 8.4.24 Release Announcement', ['cache' => true, 'cache_control' => 30 * 60]);
5+
?>
6+
<h1>PHP 8.4.24 Release Announcement</h1>
7+
8+
<p>The PHP development team announces the immediate availability of PHP 8.4.24. This is a security release.</p>
9+
10+
<p>All PHP 8.4 users are encouraged to upgrade to this version.</p>
11+
12+
<p>For source downloads of PHP 8.4.24 please visit our <a href="https://www.php.net/downloads.php">downloads page</a>,
13+
Windows source and binaries can also be found <a href="https://www.php.net/downloads.php?os=windows&amp;version=8.4">there</a>.
14+
The list of changes is recorded in the <a href="https://www.php.net/ChangeLog-8.php#8.4.24">ChangeLog</a>.
15+
</p>
16+
<?php site_footer();

0 commit comments

Comments
 (0)