PHP 8.5.9, 8.4.24, 8.3.33 & 8.2.33 Security Release!

Details: Last Updated: August 09, 2026

Security release!

BCMath:
- Fixed GHSA-x692-q9x7-8c3f (Out-of-bounds write in bccomp()). (CVE-2026-17544)

GD:
- Upgrade libgd. (CVE-2026-9672)

PGSQL:
- Fixed GHSA-7qpv-r5mr-78m4 (SQL injection via E'...' backslash breakout). (CVE-2026-17543)

Phar:
- Fixed inconsistent handling of the magic ".phar" directory. Paths such as "/.phar" remain protected, while non-magic paths that merely start with ".phar" are handled consistently across file and directory creation, copying, ArrayAccess, stream lookup, directory iteration and extraction.
- Fixed GHSA-vc5h-9ppw-p5f3 (Crash via recursive symlinks). (CVE-2026-7260)

8.5.9 - https://www.php.net/ChangeLog-8.php#8.5.9
8.4.24 - https://www.php.net/ChangeLog-8.php#8.4.24
8.3.33 - https://www.php.net/ChangeLog-8.php#8.3.33
8.2.33 - https://www.php.net/ChangeLog-8.php#8.2.33

Release URL: https://github.com/Bearsampp/module-php/releases/tag/2026.8.6

Our Supporters

AM Graphix

Tassos gr

Sorry, this website uses features that your browser doesn't support. Upgrade to a newer version of Firefox, Chrome, Safari, or Edge and you'll be all set.