PHP 8.5.10 and 8.4.25 Ship with Stack Overflow Fixes and CVE Patches
PHP 8.5.10 and 8.4.25 hit the download mirrors August 27, 2026. They were supposed to land August 25. Maintainers Daniel Scherzer and Calvin Buckley tagged the commits one day past the announced target. Just a small delay. In release engineering, a one-day slip usually means a build check ran long or a last-minute revert slipped in. The tarballs are there now. You can grab them from php.net.
Both releases are cumulative maintenance updates. They bundle all prior fixes from the 8.5 and 8.4 series, plus new patches introduced in this cycle. PHP 8.5 remains the active branch with full support. PHP 8.4 is now in security-fix-only mode. You should update immediately if you're still running 8.4.x. Several CVEs are addressed that you don't want sitting in your environment.
Stack Overflow Hardening
The biggest theme across both branches is stack exhaustion protection. Deeply nested data structures were causing interpreter crashes. The fix is now in. Both releases patch array_walk_recursive(), array_replace_recursive(), and compact() against stack overflow when handling deeply nested arrays. DOM normalization also gets the same treatment. If your application processes user-uploaded XML or JSON with arbitrary depth, this patch matters.
The 8.5 branch also addresses a const expression FCC crash under preloading. This was a specific edge case in the engine. Lazizbek Ergashev and others patched the stack overflow in zend_hash_compare for deeply nested arrays. You'll see the fixes attributed to multiple contributors. The community is actively hunting these crashes. Next, the JIT branch gets attention.
JIT and Engine Fixes in 8.5
PHP 8.5 gets targeted Opcache JIT hardening. David Carlier fixed DT_TEXTREL in JIT-generated TLS access on x86_64. This was a code generation issue. Arnaud Linck patched register management during deoptimization. Zhao Hao fixed function JIT emitting wrong code for property hook getters. If you're using Opcache with property hooks or preloading, this update is essential.
The 8.5 branch also fixes a crash in PCRE when using \C with UTF-8 patterns. The fix forbids this combination entirely. It was an unsafe usage pattern that crashed the parser. Use \C with UTF-8, you'll get an error. That's the new behavior. Head here to the PHP changelog for the full list of PCRE adjustments.
Distinct Fixes in 8.4.25
The 8.4 branch has its own set of new patches. David Carlier fixed GH-22447, a use-after-free in DOM attribute handling when setting an attribute node that collides by local name. Sysvshm gets an out-of-bounds write fix for shm_attach(). If you open an existing segment with a size larger than the segment actually is, you previously wrote past the boundary. ZipArchive's addGlob() and addPattern() were ignoring default options when no options array was given. That's now corrected.
Why You Should Update Now
Several CVEs are addressed across both branches. CVE-2026-17544 fixes an out-of-bounds write in bccomp(). CVE-2026-17543 patches SQL injection via backslash breakout in pgsql. These were present in prior releases and are fixed now. GD, Phar, and OpenSSL also have fixes bundled.
Update PHP 8.4 to 8.4.25 immediately. The pgsql and bccomp CVEs are serious. PHP 8.5 users should grab 8.5.10 for JIT stability and stack overflow protection. Applications processing deeply nested data structures benefit most from the new hardening. Keep your PHP version updated.
Release php-8.4.25
Tag for php-8.4.25
Release php-8.5.10
Tag for php-8.5.10
