PHP 8.4.25 and 8.5.10 release candidates drop with serious stack-overflow hardening
The PHP project shipped new release candidates for both active branches on August 11, 2026, and the patch sets are clearly focused on stopping recursive functions from eating the entire stack. PHP 8.4.25 RC1 landed under Calvin Buckley, while Daniel Scherzer tagged PHP 8.5.10 RC1.
Both hit around five thousand line changes across roughly two hundred files, which tells you this is not a quick hotfix. This is a coordinated cleanup of memory safety bugs and recursion crashes that have been quietly waiting in the core array and DOM functions. System admins who have ever watched a web server choke on a single deeply nested JSON blob know exactly how badly this plays out in production. A recursive array_walk_recursive() call does not care if the incoming data has fifty levels of nesting. It just keeps pushing frames until the process manager kills the worker, and the whole request chain stalls. These new candidates finally cap that recursion depth across a handful of the most abused functions, which turns a hard crash into a predictable error.
The PHP 8.4.25 and 8.5.10 release candidates fix recursion crashes at the source
The hardening wave targets array_walk_recursive(), array_replace_recursive(), compact(), count() with COUNT_RECURSIVE, and even the DOM comparison methods like DOMNode::normalize(). Each one now tracks how deep it has already gone and bails out before the C stack overflows. DOM operations used to silently loop on malformed documents, and PHP is closing that door permanently.
This pattern did not appear out of nowhere. The fuzzing pipeline has been feeding crafted inputs into the core functions for months, and the call stacks just kept growing. Adding an explicit recursion-depth check converts a DoS-inducing crash into a controlled error. Developers can finally stop treating deeply nested user uploads like a minefield.
Memory safety gets the same treatment
Use-after-free bugs do not need recursion to be nasty. The new candidates fix a UAF in implode() that triggers when a string converter destroys its own argument mid-loop, plus similar issues in XSL, user stream filters, and the sockets extension. Sessions handled by mod_mm also stop corrupting the heap manager when reentrant callbacks fire. All of that stuff tends to show up months after a security advisory drops, so getting the fixes in the RC window means testers get eyes on the patches before the final build locks down.
The sockets extension cleanup is mostly routine, but the XSL and stream filter fixes actually matter when someone runs a PDF or stylesheet generator that relies on external input. UAF bugs in those areas usually leave subtle memory corruption that only surfaces after hours of uptime. The RC patch set catches the window before the heap manager gets confused.
JIT and Opcache get quiet attention
The tracing JIT has been chasing a register preservation bug in the deoptimizer, and the RC includes the fix that keeps parent registers intact during code emission. This matters because JIT correctness bugs rarely crash PHP outright. They usually emit wrong bytecode that silently corrupts calculations or hangs in a hot loop. Opcache regression tests also pass cleanly now, which keeps production caches from tripping over themselves during rolling restarts.
Anyone who has fought with JIT debug output knows how much of a headache register corruption can be. The deoptimizer fix removes one of the more obscure sources of wrong code emission, which means production workloads that rely on the JIT will actually stay predictable across upgrades.
Other cleanup that probably will not make the headlines
PDO_PGSQL stops infinite looping during COPY cleanup, PCRE bans the \C token when paired with UTF-8 strings, and the Reflection extension finally stops truncating exception messages at null bytes. MBString gets a position-calc fix for negative offsets in non-UTF-8 encodings, and Sysvshm stops writing past segment boundaries when an existing shared memory block is opened with a larger requested size. None of these are flashlights, but each one quietly removes a class of bugs that shows up in production audit logs.
The PCRE change is worth a second look. Banning \C with UTF-8 strings prevents a well-known class of regex engine panics that have popped up in community projects for years. The Reflection null-byte truncation fix also stops weird debug output that has tripped up framework testers multiple times.
What was already patched in the prior stable releases
PHP 8.4.24 and 8.5.9 dropped on August 1 and quietly closed several CVE-class holes, including an out-of-bounds write in BCMath, a backslash breakout in PGSQL, and a signed integer overflow in the standard extension. Those fixes form the baseline for the new RCs. The stack overflow hardening is not technically a new CVE right now, but the fuzzing pipeline has clearly found enough deep-nesting vectors to warrant a broader pattern.
The support windows still give plenty of runway. PHP 8.4 runs until August 2027 for active support and August 2029 for security patches. PHP 8.5 has a longer runway, with support stretching into 2028 and security fixes likely through 2030. Release candidates usually sit at the release queue for a few days to a week before going stable, provided the test matrix does not find a regression. If a production system runs on 8.4.23 or 8.5.8, the gap to stable is small enough that testing on a staging box and rolling out during the next maintenance window makes sense. The patches are up on GitHub now, and the NEWS files spell out every commit. Run the suite, check the build logs, and let the RCs do their job. When stable drops, grab the package and move on to whatever else needs fixing.
php-8.5.10RC1
Tag for php-8.5.10RC1
php-8.4.25RC1
Tag for php-8.4.25RC1
