Author: Daniel Scherzer (DanielEScherzer)
Date: 2026-10-21T05:59:20-07:00
Commit:
https://github.com/php/web-php/commit/c69ad6253d2bf4e68b1f0216186c64b8a76491a9
Raw diff:
https://github.com/php/web-php/commit/c69ad6253d2bf4e68b1f0216186c64b8a76491a9.diff
Announce PHP 8.4.27
Changed paths:
A public/archive/entries/2026-10-21-3.xml
A public/releases/8_4_27.php
M include/release-qa.php
M include/releases.inc
M include/version.inc
M public/ChangeLog-8.php
M public/archive/archive.xml
Diff:
diff --git a/include/release-qa.php b/include/release-qa.php
index 851e112561..2391233499 100644
--- a/include/release-qa.php
+++ b/include/release-qa.php
@@ -75,10 +75,10 @@
'active' => true,
'release' => [
'type' => 'RC',
- 'number' => 1,
- 'sha256_bz2' =>
'50e9b8f99df25f9290030dd0a273ff5aeeee324593da5f34c2435f5b24caa4df',
- 'sha256_gz' =>
'877bffdf6a65e61b9375e6bdabc1be30fd444887e7c2ca9916573a637a623540',
- 'sha256_xz' =>
'40b5d8682e1789e54347714ba8c0d71817c2b8b377120c3f6c43b749dd39b74e',
+ 'number' => 0,
+ 'sha256_bz2' => '',
+ 'sha256_gz' => '',
+ 'sha256_xz' => '',
'date' => '08 October 2026',
'baseurl' => 'https://downloads.php.net/~calvinb/',
],
diff --git a/include/releases.inc b/include/releases.inc
index 4bc7dc6726..d90f5ec14e 100644
--- a/include/releases.inc
+++ b/include/releases.inc
@@ -2,6 +2,43 @@
$OLDRELEASES = array (
8 =>
array (
+ '8.4.26' =>
+ array (
+ 'announcement' =>
+ array (
+ 'English' => '/releases/8_4_26.php',
+ ),
+ 'tags' =>
+ array (
+ 0 => 'security',
+ ),
+ 'date' => '24 Sep 2026',
+ 'source' =>
+ array (
+ 0 =>
+ array (
+ 'filename' => 'php-8.4.26.tar.gz',
+ 'name' => 'PHP 8.4.26 (tar.gz)',
+ 'sha256' =>
'c248abaebc4bb777b80968f0760da0da8e989836e896c9ff637b6775d7d37662',
+ 'date' => '24 Sep 2026',
+ ),
+ 1 =>
+ array (
+ 'filename' => 'php-8.4.26.tar.bz2',
+ 'name' => 'PHP 8.4.26 (tar.bz2)',
+ 'sha256' =>
'4209694d7b0f63c45a3773e07cdc2bbfc71249265a5d951b1ff53e1147edc5ca',
+ 'date' => '24 Sep 2026',
+ ),
+ 2 =>
+ array (
+ 'filename' => 'php-8.4.26.tar.xz',
+ 'name' => 'PHP 8.4.26 (tar.xz)',
+ 'sha256' =>
'32a2de53862ad44ed4a5005244ce4f1b50c271e74dced215449a4443b40569f1',
+ 'date' => '24 Sep 2026',
+ ),
+ ),
+ 'museum' => false,
+ ),
'8.3.35' =>
array (
'announcement' =>
diff --git a/include/version.inc b/include/version.inc
index fd22b25c4c..d2f0473ced 100644
--- a/include/version.inc
+++ b/include/version.inc
@@ -34,13 +34,13 @@ $RELEASES = (function () {
/* PHP 8.4 Release */
$data['8.4'] = [
- 'version' => '8.4.26',
- 'date' => '24 Sep 2026',
+ 'version' => '8.4.27',
+ 'date' => '21 Oct 2026',
'tags' => ['security'], // Set to ['security'] for security releases.
'sha256' => [
- 'tar.gz' =>
'c248abaebc4bb777b80968f0760da0da8e989836e896c9ff637b6775d7d37662',
- 'tar.bz2' =>
'4209694d7b0f63c45a3773e07cdc2bbfc71249265a5d951b1ff53e1147edc5ca',
- 'tar.xz' =>
'32a2de53862ad44ed4a5005244ce4f1b50c271e74dced215449a4443b40569f1',
+ 'tar.gz' =>
'5bafed9994c1a49796b25b5f61c22c9183bfe046b6acc7b363842d03c77f972f',
+ 'tar.bz2' =>
'b2530a877c722f4b08c9e174a30cb08bac2b7e1903ee6e9e315f0aa9f5f82c24',
+ 'tar.xz' =>
'dcf93923b0e38e0d5252b25b796520b5a47761a08b3488b6d0b5d1115764d3f0',
]
];
diff --git a/public/ChangeLog-8.php b/public/ChangeLog-8.php
index c07c4afce4..0ab515e8f7 100644
--- a/public/ChangeLog-8.php
+++ b/public/ChangeLog-8.php
@@ -1466,6 +1466,193 @@
<a id="PHP_8_4"></a>
+<section class="version" id="8.4.27"><!-- {{{ 8.4.27 -->
+<h3>Version 8.4.27</h3>
+<b><?php release_date('22-Oct-2026'); ?></b>
+<ul><li>Core:
+<ul>
+ <li>Fixed <?php githubsecurityl('php/php-src', 'w8hw-w9fx-j79w'); ?>, <?php
githubsecurityl('php/php-src', '6wmf-4rv5-p3rp'); ?> (Avoid state corruption
via bailout).</li>
+ <li>Fix <?php githubissuel('php/php-src', 21999); ?>: GC inconsistency with
lazy object, var_dump(), and object comparison.</li>
+ <li>Fixed OSS-Fuzz #536440507 (Immutable class incorrect assertion).</li>
+ <li>Fixed AVX being reported as supported when the OS has not enabled AVX
state.</li>
+ <li>Fixed <?php githubissuel('php/php-src', 23980); ?> (ZEND_ASSERT
violation @ ZEND_INCLUDE_OR_EVAL).</li>
+ <li>Fixed bug <?php githubissuel('php/php-src', 23896); ?> (Assertion
failure in zend_call_function() after a throwing deprecation).</li>
+ <li>Fixed use-after-free when a dl()-loaded extension declares a frameless
function and a later request calls it.</li>
+ <li>Fixed System V shared memory emulation for Windows attaching segments
past the end of their mapping.</li>
+ <li>Fixed bug <?php githubissuel('php/php-src', 24050); ?> (GC frees an
object still held by a resurrected closure when (object) and use share an
array).</li>
+ <li>Fixed exception thrown by destructor during GC in a Fiber not being
rethrown into the frame that triggered the GC.</li>
+</ul></li>
+<li>BCMath:
+<ul>
+ <li>Fixed BcMath\Number results that truncate to zero keeping a negative
sign and comparing less than zero.</li>
+</ul></li>
+<li>BZ2:
+<ul>
+ <li>Fixed double close of the descriptor and use-after-free of the inner
stream when bzopen() is given a stream resource.</li>
+</ul></li>
+<li>CLI:
+<ul>
+ <li>Fix <?php githubissuel('php/php-src', 22567); ?> (Windows ZTS CLI SAPI
should refresh its TSRMLS cache during request activation).</li>
+ <li>Fixed bug <?php githubissuel('php/php-src', 23764); ?> (Built-in server
leaks a file descriptor on every HEAD request for a static file).</li>
+ <li>Fixed crash in the built-in server when a client is reset before being
accepted.</li>
+ <li>Fixed the built-in server truncating an error page and leaking its
unsent part after a partial socket write.</li>
+</ul></li>
+<li>DOM:
+<ul>
+ <li>Fixed use-after-free when re-constructing a DOMXPath whose php:function
registrations are freed while still reachable from the cycle collector.</li>
+ <li>Fixed bug <?php githubissuel('php/php-src', 23365); ?>
(DOMNode::insertBefore($n, $n) drops the node and leaves a self-referencing
sibling list).</li>
+ <li>Fixed Dom\HTMLDocument::getElementById() not finding ids of SVG and
MathML elements.</li>
+ <li>Fixed Dom\HTMLDocument giving attributes the namespace of their element
when a fragment is parsed with an xlink, xml or xmlns context element.</li>
+ <li>Fixed bug <?php githubissuel('php/php-src', 23729); ?>
(DOMXPath::__construct() use-after-free during an evaluation).</li>
+ <li>Fixed bug <?php githubissuel('php/php-src', 23897); ?> (php:function()
assertion failure after a failed registerPHPFunctions()).</li>
+ <li>Fixed DOMXPath and Dom\XPath losing the context node and in-scope
namespaces of an evaluation after a php:function() callback evaluated another
expression on the same object.</li>
+</ul></li>
+<li>FFI:
+<ul>
+ <li>Fixed crashes with FFI callbacks created from __call() trampolines and
array callables whose object is released.</li>
+</ul></li>
+<li>FTP:
+<ul>
+ <li>Fixed bug <?php githubissuel('php/php-src', 23619); ?> (cryptic error on
servers that don't support TLS session resumption on data connection).</li>
+</ul></li>
+<li>GD:
+<ul>
+ <li>Fixed undefined behavior with GD2 images with `INT_MAX`-sized
chunks.</li>
+ <li>Fixed undefined behavior with GIFs with problematic LZW compression
data.</li>
+</ul></li>
+<li>Intl:
+<ul>
+ <li>Fixed IntlDateFormatter::parse(), localtime() and parseToCalendar()
treating the offset as UTF-16 code units instead of bytes.</li>
+ <li>Fixed cloning IntlDateFormatter and MessageFormatter losing PHP-side
state such as dateType, timeType, calendar and the message pattern.</li>
+ <li>Fixed Collator attribute and strength methods not rejecting an
unconstructed Collator.</li>
+ <li>Fixed grapheme_strstr() and grapheme_stristr() returning incorrect
substrings when supplementary characters precede the match.</li>
+ <li>Fixed grapheme_strstr() and grapheme_strpos() missing canonically
equivalent matches, and grapheme searches reporting ICU errors for empty
haystacks.</li>
+ <li>Fixed grapheme_strrpos() and grapheme_strripos() skipping overlapping
matches when using a negative offset.</li>
+</ul></li>
+<li>Lexbor:
+<ul>
+ <li>Merge patches lexbor/lexbor@8a14bc0 and lexbor/lexbor@f67ce4b, fixing a
heap buffer overflow in :lexbor-contains() parsing and buffer overflows in
malformed decode replay.</li>
+</ul></li>
+<li>MBString:
+<ul>
+ <li>Fixed bug <?php githubissuel('php/php-src', 23106); ?> (mb_strpos()
reads past the end of a haystack ending in a truncated UTF-8 sequence).</li>
+ <li>Fixed mbstring functions emitting surrogates in UTF-8 output and
flagging it as valid UTF-8.</li>
+</ul></li>
+<li>MySQLi:
+<ul>
+ <li>Fix <?php githubissuel('php/php-src', 22854); ?>: Fixed failed assertion
when accessing mysqli property after failed reconnection.</li>
+</ul></li>
+<li>MySQLnd:
+<ul>
+ <li>Fixed field_count not resetting on OK packet.</li>
+ <li>Fixed memory leak when closing a prepared statement after its connection
was killed.</li>
+</ul></li>
+<li>Opcache:
+<ul>
+ <li>Fixed OSS-Fuzz #546798343 (Heap-buffer-overflow in optimizer with FCCs
and inlining).</li>
+ <li>Fixed bug <?php githubissuel('php/php-src', 23693); ?> (Tracing JIT
produces wrong results for a guard on a loop-invariant addition).</li>
+ <li>Fixed OSS-Fuzz #5674034779193344 (Read of uninitialized memory in
is_cacheable_stream_path()).</li>
+ <li>Fix zend_analyze_calls() call_stack buffer overrun.</li>
+ <li>Fixed bug <?php githubissuel('php/php-src', 23637); ?> (PHP-FPM worker
SIGSEGV: run_time_cache map_ptr offset beyond CG(map_ptr_last) when a class is
reached through the CE cache).</li>
+ <li>Fix multiple incorrect DCE due to unsound escape analysis.</li>
+ <li>Fixed bug <?php githubissuel('php/php-src', 24063); ?> (OPcache
optimizer folds `$cond ? -0.0 : 0.0` into a single `-0.0` constant).</li>
+ <li>Fixed crash when a file cache is reused with a different set of
extensions declaring frameless functions.</li>
+ <li>Fixed bug <?php githubissuel('php/php-src', 23991); ?> (JIT generates
invalid IR for multiple recursive calls).</li>
+ <li>Fix SCCP evaluation of isset()/empty() on dimension of non-escaping
object.</li>
+</ul></li>
+<li>OpenSSL:
+<ul>
+ <li>Fixed stream_socket_enable_crypto() leaving the socket non-blocking
after a handshake timeout.</li>
+ <li>Fixed feof() on a TLS stream staying false after a close_notify on
Windows.</li>
+</ul></li>
+<li>PCNTL:
+<ul>
+ <li>Fixed pcntl_signal_dispatch() dropping the queued signals when it runs
while an exception is pending.</li>
+ <li>Fixed pcntl_signal_dispatch() dropping the signals queued behind a
handler that throws.</li>
+ <li>Fixed pcntl_setcpuaffinity() error message advertising the cpu count as
the inclusive upper bound.</li>
+ <li>Fixed pcntl_setqos_class() requiring its optional $qos_class
argument.</li>
+ <li>Fixed bug <?php githubissuel('php/php-src', 23986); ?> (/proc/self paths
resolve to the parent process after pcntl_fork()).</li>
+</ul></li>
+<li>PDO:
+<ul>
+ <li>Fixed PDOStatement::getColumnMeta() reading out of bounds for an invalid
column index.</li>
+ <li>Fixed PDOStatement::bindColumn() registering a binding for a column name
that is not in the result set.</li>
+ <li>Fixed PDOStatement::execute() leaving the previous result available
after a failed execution.</li>
+ <li>Fixed a use-after-free when bindValue()/execute()/closeCursor() is
called from a bound parameter's __toString() during execute().</li>
+ <li>Fixed bug <?php githubissuel('php/php-src', 23962); ?> (Destroying a
persistent PDO instance rolls back a transaction still in use by another
instance).</li>
+ <li>Fixed PDO::setAttribute() installing a PDO::ATTR_STATEMENT_CLASS class
whose constructor arguments it rejects.</li>
+ <li>Fixed PDO::ATTR_STATEMENT_CLASS constructor_args type errors reporting
"array given" regardless of the value passed.</li>
+ <li>Fixed PDOStatement::bindParam() and bindColumn() leaking the driver
options value.</li>
+ <li>Fixed PDOStatement not reporting its bound parameters and columns to the
cycle collector.</li>
+ <li>Fixed PDOStatement::setFetchMode() not applying changes atomically.</li>
+</ul></li>
+<li>PDO_DBLIB:
+<ul>
+ <li>Fixed bug <?php githubissuel('php/php-src', 23741); ?> (segfault after a
failed query inside a PDO transaction). Errors raised by beginTransaction(),
commit(), rollBack() and lastInsertId() are now reported instead of being
dropped.</li>
+</ul></li>
+<li>PDO_Firebird:
+<ul>
+ <li>Fixed bug <?php githubissuel('php/php-src', 23758); ?> (PDO_Firebird
returns null for non-null empty BLOBs).</li>
+</ul></li>
+<li>Readline:
+<ul>
+ <li>Fixed a heap over-read in the interactive shell prompt when cli.prompt
is set to an empty string.</li>
+</ul></li>
+<li>Session:
+<ul>
+ <li>Fixed session_start() continuing after a failed create_sid() when
session.use_strict_mode rejects the supplied ID.</li>
+ <li>Fixed exceptions from user-defined create_sid() handlers being replaced
by return-value validation errors.</li>
+</ul></li>
+<li>SimpleXML:
+<ul>
+ <li>Fixed reconstructing a SimpleXMLElement freeing a child element that
another variable still references.</li>
+</ul></li>
+<li>SOAP:
+<ul>
+ <li>Fixed bug <?php githubissuel('php/php-src', 22895); ?> (Heap
use-after-free while encoding a Traversable with an illegal key).</li>
+ <li>Fixed memory leak when load_wsdl_ex() failed to load.</li>
+</ul></li>
+<li>Sockets:
+<ul>
+ <li>Fixed socket_select() silently truncating sets larger than FD_SETSIZE on
Windows.</li>
+</ul></li>
+<li>SPL:
+<ul>
+ <li>Fixed SplFixedArray::setSize() doing nothing on subclasses whose
constructor does not call parent::__construct().</li>
+ <li>Fixed memory leak when __construct(), __wakeup() or __unserialize() is
called from an element destructor during setSize(0).</li>
+</ul></li>
+<li>SQLite:
+<ul>
+ <li>Fixed a crash when SQLite3::close() is called from a userland
callback.</li>
+</ul></li>
+<li>Standard:
+<ul>
+ <li>Fixed sha1_file() returning a digest for incomplete data after a stream
read failure.</li>
+ <li>Fixed iptcembed() corrupting JPEG headers when called recursively from
an output handler.</li>
+ <li>Fixed proc_open() leaking descriptor zero when descriptor setup
fails.</li>
+ <li>Fixed three Windows-only proc_open() defects: an uninitialized
PROCESS_INFORMATION, an indeterminate comspec pointer after a failed lookup,
and an unchecked CreateFileA() failure.</li>
+ <li>Fix persistent stream context lifetime during shutdown (Levi
Morrison)</li>
+ <li>Fix wordwrap() ignoring an existing break at the end of the string
(Nicolas Grekas)</li>
+ <li>Fixed convert.quoted-printable-decode decoding lowercase hex digits to
the wrong byte.</li>
+</ul></li>
+<li>Tidy:
+<ul>
+ <li>Fixed a use-after-free when a tidyNode is used after its document is
reparsed.</li>
+</ul></li>
+<li>XSL:
+<ul>
+ <li>Fixed bug <?php githubissuel('php/php-src', 23730); ?> (use-after-free
when XSLTProcessor::importStylesheet() is called during a transformation).</li>
+</ul></li>
+<li>Zip:
+<ul>
+ <li>Fixed ZipArchive::extractTo() ignoring files given in a non-list
array.</li>
+ <li>Fixed bug <?php githubissuel('php/php-src', 23747); ?>
(ZipArchive::close() use-after-free from a progress or cancel callback).</li>
+</ul></li>
+</ul>
+<!-- }}} --></section>
+
+
+
<section class="version" id="8.4.26"><!-- {{{ 8.4.26 -->
<h3>Version 8.4.26</h3>
<b><?php release_date('24-Sep-2026'); ?></b>
diff --git a/public/archive/archive.xml b/public/archive/archive.xml
index 91b2d5523e..8a81945105 100644
--- a/public/archive/archive.xml
+++ b/public/archive/archive.xml
@@ -9,6 +9,7 @@
<uri>http://php.net/contact</uri>
<email>[email protected]</email>
</author>
+ <xi:include href="entries/2026-10-21-3.xml"/>
<xi:include href="entries/2026-10-21-2.xml"/>
<xi:include href="entries/2026-10-21-1.xml"/>
<xi:include href="entries/2026-10-20-1.xml"/>
diff --git a/public/archive/entries/2026-10-21-3.xml
b/public/archive/entries/2026-10-21-3.xml
new file mode 100644
index 0000000000..c4b83a5f41
--- /dev/null
+++ b/public/archive/entries/2026-10-21-3.xml
@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="utf-8"?>
+<entry xmlns="http://www.w3.org/2005/Atom";>
+ <title>PHP 8.4.27 Released!</title>
+ <id>https://www.php.net/archive/2026.php#2026-10-21-3</id>
+ <published>2026-10-21T00:20:54+00:00</published>
+ <updated>2026-10-21T00:20:54+00:00</updated>
+ <link href="https://www.php.net/index.php#2026-10-21-3"; rel="alternate"
type="text/html"/>
+ <link href="https://www.php.net/archive/2026.php#2026-10-21-3"; rel="via"
type="text/html"/>
+ <category term="releases" label="New PHP release"/>
+ <category term="frontpage" label="PHP.net frontpage news"/>
+ <content type="xhtml">
+ <div xmlns="http://www.w3.org/1999/xhtml";>
+<p>
+ The PHP development team announces the immediate availability of PHP 8.4.27.
+ <strong>
+ This is a security release fixing two critical vulnerabilities
+ (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote
+ code execution. All PHP 8.4 users are strongly encouraged to update
immediately.
+ </strong>
+</p>
+
+<p>
+ There are no complete mitigations, updating is the only safe choice. See the
+ <a href="https://www.php.net/archive/2026.php#2026-10-21-5";>security
advisory</a> for details.
+</p>
+
+<p>For source downloads of PHP 8.4.27 please visit our <a
href="https://www.php.net/downloads.php";>downloads page</a>,
+Windows source and binaries can also be found <a
href="https://www.php.net/downloads.php?os=windows&version=8.4";>there</a>.
+The list of changes is recorded in the <a
href="https://www.php.net/ChangeLog-8.php#8.4.27";>ChangeLog</a>.
+</p> </div>
+ </content>
+</entry>
diff --git a/public/releases/8_4_27.php b/public/releases/8_4_27.php
new file mode 100644
index 0000000000..620b0691f0
--- /dev/null
+++ b/public/releases/8_4_27.php
@@ -0,0 +1,16 @@
+<?php
+$_SERVER['BASE_PAGE'] = 'releases/8_4_27.php';
+require_once __DIR__ . '/../../include/prepend.inc';
+site_header('PHP 8.4.27 Release Announcement', ['cache' => true,
'cache_control' => 30 * 60]);
+?>
+<h1>PHP 8.4.27 Release Announcement</h1>
+
+<p>The PHP development team announces the immediate availability of PHP
8.4.27. This is a security release.</p>
+
+<p>All PHP 8.4 users are encouraged to upgrade to this version.</p>
+
+<p>For source downloads of PHP 8.4.27 please visit our <a
href="https://www.php.net/downloads.php";>downloads page</a>,
+Windows source and binaries can also be found <a
href="https://www.php.net/downloads.php?os=windows&version=8.4";>there</a>.
+The list of changes is recorded in the <a
href="https://www.php.net/ChangeLog-8.php#8.4.27";>ChangeLog</a>.
+</p>
+<?php site_footer();
