Ondřej Surý has published PHP 8.5.10 and 8.4.25 to deb.sury.org, delivering immediate security patches for Debian and Ubuntu that address four uriparser vulnerabilities and a memory safety flaw in the GD library. The August 28 build specifically targets URI parsing logic in PHP 8.5's new URI extension, making the update essential for applications that validate authorization tokens or sanitize user-supplied URLs. PHP 8.4 continues its security-only lifecycle through December 2026, with this release capping the roadmap via patches for PDO memory leaks, OpenSSL timeout tweaks, and XSL use-after-free conditions. Developers running mixed stacks can pull the coordinated packages today through a standard apt upgrade, bypassing the months-long wait for official distribution repositories to sync with upstream releases.
PHP 8.5.10 and 8.4.25 ship via sury.org with critical uriparser and GD fixes
Debian and Ubuntu users can pull the new releases today, just in time to patch several memory safety and URI parsing vulnerabilities.
The long-anticipated PHP 8.5.10 and PHP 8.4.25 updates are live on deb.sury.org. Ondřej Surý rolled out the new packages, and they're already sitting in the repository for Debian and Ubuntu. If you're running either version on your stack, it's time to apt upgrade.
PHP 8.5 entered active development back in November 2025, and PHP 8.4 has been riding the security-fix bus since December 2025. Both got the same treatment this round, packaged in a single coordinated build. That usually means the upstream releases aligned pretty closely, which is good news if you run mixed PHP versions across multiple servers. The build numbers, 8.5.10-1+0~20260828.25 and 8.4.25-1+0~20260828.55, reflect that simultaneous packaging.
Patching the URI parser and image handler
The headline here is the uriparser vulnerabilities. Four separate CVEs land in this patch, all tied to the URI parser that now powers PHP 8.5's brand new URI extension. CVE-2026-44927 and 44928 deal with pointer truncation and false URI equality checks, while CVE-2026-42371 and 2025-67899 cover numeric truncation and unbounded recursion. If your app sanitizes URLs or validates authorization tokens against a URI path, leaving this patch on the shelf is a bad look. The GD library gets its own fix too (CVE-2026-9672), addressing a memory safety flaw in how the image processing extension handles certain inputs.
PHP 8.4 has its own list of maintenance fixes, though it reads more like a standard security sweep. DOM quirks, PDO memory leaks, OpenSSL timeout tweaks, and a couple of use-after-free patches in XSL and PDO_PGSQL make the changelog. Attackers love those memory corruption vectors, and patching them now prevents headaches later. The date extension caught a Unix timestamp misparse for February in year 0, which sounds like an edge case until your legacy cron jobs start failing.
Why PHP 8.5 adoption matters now
PHP 8.5 keeps picking up momentum. The pipe operator |>, the Clone With syntax, and array_first() alongside array_last() are drawing attention from developers who've been waiting years for native parity with what other languages do out of the box. Persistent cURL share handles and fatal errors that now dump a backtrace by default round out the list. It's arguably competing with more modern runtime paradigms now, even if the learning curve for older PHP codebases is occasionally steep.
Head here to add the repository to your system. The install script pulls a signed README and sets up the GPG key in one shot. Keep in mind that switching between builds is just a symlink away, and upgrading to 8.4 or 8.5 is straightforward if your current stack plays nice.
