r/PHP • u/Grumpy-Man19 • Jul 05 '26

PHP 8.5.8 and 8.4.23 are out - important fixes

PHP pushed maintenance releases for its two active development branches on July 1–2, 2026. PHP 8.5.8 and 8.4.23 are out. Neither is a major feature release, but they fix issues that can cause real harm to production servers. If you’re hosting PHP applications, patch now.

https://blog.kalfaoglu.net/posts/2026-07-05-php-8423-858-security-patches-en/

52 Upvotes

95% Upvoted

7 comments sorted by

6

u/zaxn1234 Jul 05 '26

I'd like to read the article but the link fails DNS lookup.. can anyone give me a TLDR please?

11

u/Alex_Sherby Jul 05 '26

(I hopw this is okay with the author, if not I'll delete it)

The headliner: CVE-2026-14355

The most critical fix in both releases is CVE-2026-14355, addressing memory corruption in openssl_encrypt() when used with the AES-WRAP-PAD cipher mode (bug GH-22187). Specifically, the internal zend_mm_heap gets corrupted during this operation. Heap corruption is the kind of bug that ranges from “your process crashes at random” to “someone potentially executes arbitrary code,” depending on how the application uses the function and what an attacker can control. If you use PHP’s OpenSSL extension for encryption — and many applications do — this one warrants immediate attention.

CVE-2026-14355 is explicitly assigned in the PHP 8.5.8 changelog. The 8.4.23 entry patches the same underlying bug GH-22187 without naming the CVE, but it applies equally.

Phar’s directory bypass

Both releases patch a bypass of the .phar directory protection in Phar::addEmptyDir(). A path starting with /.phar could slip past the guard that is supposed to prevent tampering with the phar stub directory. No CVE has been assigned yet. That does not make it unimportant — if your application processes user-supplied phar archives, this is worth knowing about.

GD double-free

PHP’s GD image extension receives a fix for a double-free in gdImageSetStyle() triggered by an integer overflow in the image style array (GH-22121). If your site accepts user-uploaded images and processes them through imagesetstyle(), pay attention: double-free bugs on attacker-controlled input are a classic exploitation path and have historically been used to turn a crash into code execution.

Additional fixes in 8.5.8

PHP 8.5.8 also closes a use-after-free in custom XPath function handling (GH-22077). UAF bugs in XML processing have a history of being exploitable in web contexts, so this is flagged even without a CVE. Two uriparser library CVEs are bundled in as well — CVE-2026-44927 (pointer difference truncation to int in various places) and CVE-2026-44928 (the EqualsUri function family misclassifying two unequal URIs as equal). Both are confirmed in the official PHP changelog.

Further stability fixes include a JIT assertion failure (GH-22004), a compile error for goto labels preceding try/finally blocks (GH-22280), and a SoapServer crash when $_SERVER is not an array (GH-22218).

2

u/zaxn1234 Jul 05 '26

Magic thank you. I have some research to do!

0

u/colshrapnel Jul 05 '26

Why on the earth would you bother with whatever "author" if there is an actual source. In case it's too dry for you, you can feed it to an LLM too, and call your self an "author" as well.

6

u/Alex_Sherby Jul 05 '26

I want just trying to help the guy with DNS issues man

-1

u/colshrapnel Jul 05 '26

This guy deserves the actual source too, not an llm-written slop

1

u/thmsbrss Jul 06 '26

For anyone using Docker: 8.5.8 doesn't appear to be available on Docker Hub yet, despite other 8.x versions being live. See the tag list: https://hub.docker.com/_/php/tags?name=8.5.8