Skip to content
🚀 PHP 8.6 is coming — check out what's new
PHP News
Search

PHP version support

PHP 8.5 end of life and support status

Active support until December 31, 2027.

Key dates

Released
November 20, 2025
Active support ends
December 31, 2027
Security support ends (end of life)
December 31, 2029
Latest release
8.5.10, August 27, 2026

Security fixes in PHP 8.5

19 security advisories fixed on this branch, newest first, with the release that fixed each one. Covers the advisories php-src has published on GitHub, which started in February 2023.

  • medium CVE-2026-7260 Fixed in 8.5.9, Jul 30, 2026

    Stack overflow in phar with circular symlinks

  • high CVE-2026-17544 Fixed in 8.5.9, Jul 30, 2026

    Out-of-bounds write in bccomp() via crafted operand and scale

  • high CVE-2026-17543 Fixed in 8.5.9, Jul 30, 2026

    SQL injection in ext-pgsql via E'...' backslash breakout

  • medium CVE-2026-14355 Fixed in 8.5.8, Jul 2, 2026

    ext/openssl: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD

  • high CVE-2026-12184 Fixed in 8.5.6, Jul 2, 2026

    Failure to setup TLS with a remote server can result in a remote DoS

  • medium CVE-2026-7262 Fixed in 8.5.6, May 7, 2026

    NULL pointer dereference in SOAP apache:Map decoder with missing <value>

  • medium CVE-2026-7261 Fixed in 8.5.6, May 7, 2026

    SoapServer session-persisted object use-after-free via SOAP header fault

  • low CVE-2026-7259 Fixed in 8.5.6, May 7, 2026

    Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()

  • medium CVE-2026-6735 Fixed in 8.5.6, May 7, 2026

    XSS within PHP-FPM status endpoint

  • high CVE-2026-6722 Fixed in 8.5.6, May 7, 2026

    Use-After-Free in SOAP using Apache map with Remote Code Execution

  • medium CVE-2026-7258 Fixed in 8.5.6, May 7, 2026

    Out-of-bounds read in urldecode()

  • medium CVE-2026-6104 Fixed in 8.5.6, May 7, 2026

    Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding

  • high CVE-2025-14179 Fixed in 8.5.6, May 7, 2026

    SQL injection in pdo_firebird via NUL bytes in quoted strings

  • low CVE-2026-7568 Fixed in 8.5.6, May 7, 2026

    Signed integer overflow in metaphone()

  • high CVE-2026-7263 Fixed in 8.5.6, May 7, 2026

    DoS attack via DOMNode::C14N()

  • low GHSA-www2-q4fc-65wf Fixed in 8.5.1, Dec 18, 2025

    Null byte termination in dns_get_record()

  • medium CVE-2025-14180 Fixed in 8.5.1, Dec 18, 2025

    NULL Pointer Dereference in PDO quoting

  • medium CVE-2025-14178 Fixed in 8.5.1, Dec 18, 2025

    Heap buffer overflow in array_merge()

  • medium CVE-2025-14177 Fixed in 8.5.1, Dec 18, 2025

    Information Leak of Memory in getimagesize

PHP 8.5 on PHP News