Skip to content
RFC Tracker: Follow the proposals shaping the next version of PHP.
PHP News
Search

PHP version support

PHP 8.4 end of life and support status

Active support until December 31, 2026.

Key dates

Released
November 21, 2024
Active support ends
December 31, 2026
Security support ends (end of life)
December 31, 2028
Latest release
8.4.25, August 27, 2026

Security fixes in PHP 8.4

29 security advisories fixed on this branch, newest first, with the release that fixed each one. Covers the advisories php-src has published on GitHub, which started in February 2023.

  • medium CVE-2026-7260 Fixed in 8.4.24, Jul 30, 2026

    Stack overflow in phar with circular symlinks

  • high CVE-2026-17544 Fixed in 8.4.24, Jul 30, 2026

    Out-of-bounds write in bccomp() via crafted operand and scale

  • high CVE-2026-17543 Fixed in 8.4.24, Jul 30, 2026

    SQL injection in ext-pgsql via E'...' backslash breakout

  • medium CVE-2026-14355 Fixed in 8.4.23, Jul 2, 2026

    ext/openssl: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD

  • high CVE-2026-12184 Fixed in 8.4.21, Jul 2, 2026

    Failure to setup TLS with a remote server can result in a remote DoS

  • medium CVE-2026-7262 Fixed in 8.4.21, May 7, 2026

    NULL pointer dereference in SOAP apache:Map decoder with missing <value>

  • medium CVE-2026-7261 Fixed in 8.4.21, May 7, 2026

    SoapServer session-persisted object use-after-free via SOAP header fault

  • low CVE-2026-7259 Fixed in 8.4.21, May 7, 2026

    Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()

  • medium CVE-2026-6735 Fixed in 8.4.21, May 7, 2026

    XSS within PHP-FPM status endpoint

  • high CVE-2026-6722 Fixed in 8.4.21, May 7, 2026

    Use-After-Free in SOAP using Apache map with Remote Code Execution

  • medium CVE-2026-7258 Fixed in 8.4.21, May 7, 2026

    Out-of-bounds read in urldecode()

  • medium CVE-2026-6104 Fixed in 8.4.21, May 7, 2026

    Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding

  • high CVE-2025-14179 Fixed in 8.4.21, May 7, 2026

    SQL injection in pdo_firebird via NUL bytes in quoted strings

  • low CVE-2026-7568 Fixed in 8.4.21, May 7, 2026

    Signed integer overflow in metaphone()

  • high CVE-2026-7263 Fixed in 8.4.21, May 7, 2026

    DoS attack via DOMNode::C14N()

  • low GHSA-www2-q4fc-65wf Fixed in 8.4.16, Dec 18, 2025

    Null byte termination in dns_get_record()

  • medium CVE-2025-14180 Fixed in 8.4.16, Dec 18, 2025

    NULL Pointer Dereference in PDO quoting

  • medium CVE-2025-14178 Fixed in 8.4.16, Dec 18, 2025

    Heap buffer overflow in array_merge()

  • medium CVE-2025-14177 Fixed in 8.4.16, Dec 18, 2025

    Information Leak of Memory in getimagesize

  • medium CVE-2025-1735 Fixed in 8.4.10, Jul 3, 2025

    pgsql extension does not check for errors during escaping

  • medium CVE-2025-6491 Fixed in 8.4.10, Jul 3, 2025

    NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix

  • low CVE-2025-1220 Fixed in 8.4.10, Jul 3, 2025

    Null byte termination in hostnames

  • medium CVE-2024-11235 Fixed in 8.4.5, Mar 13, 2025

    Reference counting in php_request_shutdown causes Use-After-Free

  • low GHSA-wg4p-4hqh-c3g9 Fixed in 8.4.5, Mar 13, 2025

    Possible out of bounds read when XML_OPTION_SKIP_TAGSTART used

  • medium CVE-2025-1219 Fixed in 8.4.5, Mar 13, 2025

    libxml streams use wrong `content-type` header when requesting a redirected resource

  • medium CVE-2025-1736 Fixed in 8.4.5, Mar 13, 2025

    Stream HTTP wrapper header check might omit basic auth header

  • medium CVE-2025-1861 Fixed in 8.4.5, Mar 13, 2025

    Stream HTTP wrapper truncate redirect location to 1024 bytes

  • medium CVE-2025-1734 Fixed in 8.4.5, Mar 13, 2025

    Streams HTTP wrapper does not fail for headers with invalid name and no colon

  • medium CVE-2025-1217 Fixed in 8.4.5, Mar 13, 2025

    Header parser of `http` stream wrapper does not handle folded headers