PHP 8.5 end of life and support status
Active support until December 31, 2027.
Key dates
- Released
- November 20, 2025
- Active support ends
- December 31, 2027
- Security support ends (end of life)
- December 31, 2029
- Latest release
- 8.5.11, September 24, 2026
Security fixes in PHP 8.5
31 security advisories fixed on this branch, newest first, with the release that fixed each one. Covers the advisories php-src has published on GitHub, which started in February 2023.
-
Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header
-
OOB read / info leak in convert.* stream filters when line-break-chars contains NUL
-
IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison (memcmp 12 bytes)
-
TLS Hostname Verification Falls Back to CN After SAN Mismatch
-
Heap-buffer-overflow in php_openssl_matches_wildcard_name on crafted server cert wildcard CN
-
Various packet overreads in mysqlnd_writeprotocol.c
-
Cross-origin credential leak in HTTP stream wrapper redirects
-
SOAP: Unbounded Recursion in Server-Side cleanup_xml_node
-
Integer overflow to buffer overflow in soap HTTP parsing
-
Phar TAR phar_tar_number() Integer Overflow - Archive Entry Injection
-
PHP on Windows: Reserved Device Names Are Not Rejected Before File/Stream I/O which can cause DoS
-
ext/filter: encode 0xFF in FILTER_SANITIZE_ENCODED
-
Stack overflow in phar with circular symlinks
-
Out-of-bounds write in bccomp() via crafted operand and scale
-
SQL injection in ext-pgsql via E'...' backslash breakout
-
ext/openssl: Memory corruption (zend_mm_heap corrupted) in openssl_encrypt with AES-WRAP-PAD
-
Failure to setup TLS with a remote server can result in a remote DoS
-
NULL pointer dereference in SOAP apache:Map decoder with missing <value>
-
SoapServer session-persisted object use-after-free via SOAP header fault
-
Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()
-
XSS within PHP-FPM status endpoint
-
Use-After-Free in SOAP using Apache map with Remote Code Execution
-
Out-of-bounds read in urldecode()
-
Global buffer over-read in mb_convert_encoding() with attacker-supplied encoding
-
SQL injection in pdo_firebird via NUL bytes in quoted strings
-
Signed integer overflow in metaphone()
-
DoS attack via DOMNode::C14N()
-
Null byte termination in dns_get_record()
-
NULL Pointer Dereference in PDO quoting
-
Heap buffer overflow in array_merge()
-
Information Leak of Memory in getimagesize
What's in PHP 8.5
All PHP 8.5 RFCs →Show all 25 accepted RFCs
- #[\DelayedTargetValidation] attribute
- #[\Deprecated] for traits
- Add get_error_handler(), get_exception_handler() functions
- Add locale for case insensitive grapheme functions
- Add RFC3986 and WHATWG URL compliant API
- array_first() and array_last()
- Asymmetric Visibility for Static Properties
- Attributes on Constants
- Change Directory class to behave like a resource object
- Clone with v2
- Cookies Having Independent Partitioned State (CHIPS)
- Deprecations for PHP 8.5
- Error backtraces v2
- Extend #[\Override] to target properties
- FILTER_THROW_ON_FAILURE
- Final Property Promotion
- First Class Callables in constant expressions
- Grapheme cluster for levenshtein, grapheme_levenshtein function
- Make OPcache a non-optional part of PHP
- Marking return values as important (#[\NoDiscard])
- Persistent curl share handle improvement
- Pipe operator
- Soft-Deprecate __sleep() and __wakeup()
- Support Closures in constant expressions
- Warnings for PHP 8.5
