PHP Group php php 8.3 Update Version 8.3.31
Your rating
Rate update installation process
Risk factor
No ratings yet. Be the first to rate this update.
AI enhanced content
Update Summary
PHP 8.3.31 delivers eight security fixes across FPM, MBString, PDO_Firebird, SOAP, and Standard, plus Windows Brotli and Zstandard support and OpenSSL 4.0 compatibility improvements.
Update Details
Security
- FPM: Fixed XSS in the status endpoint (GHSA-7qg2-v9fj-4mwv, CVE-2026-6735).
- MBString: Fixed a null pointer dereference in php_mb_check_encoding() through mb_ereg_search_init() (GHSA-wm6j-2649-pv75, CVE-2026-7259).
- PDO_Firebird: Fixed SQL injection through NUL bytes in quoted strings (GHSA-w476-322c-wpvm, CVE-2025-14179).
- SOAP: Fixed a stale SOAP_GLOBAL(ref_map) pointer with Apache Map (GHSA-85c2-q967-79q5, CVE-2026-6722).
- SOAP: Fixed a use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION (GHSA-m33r-qmcv-p97q, CVE-2026-7261).
- SOAP: Fixed an incorrect NULL check for Apache map values (GHSA-hmxp-6pc4-f3vv, CVE-2026-7262).
- Standard: Fixed signed integer overflow in a character-array offset (GHSA-96wq-48vp-hh57, CVE-2026-7568).
- Standard: Consistently pass unsigned char values to ctype.h functions (GHSA-m8rr-4c36-8gq4, CVE-2026-7258).
Bug Fixes
- OpenSSL: Fixed compatibility issues with OpenSSL 4.0.
New Features
- Curl: Added Brotli and Zstandard support on Windows.
Product Information
Vendor: PHP Group
Product: php
Product type: Software
Variant: php 8.3
Version: 8.3.31
Vendor information published: May 7, 2026
Original release notes: View on vendor site
Published on updatealert.io: Oct 27, 2026
Description: A popular general-purpose scripting language that is especially suited to web development. Fast, flexible and pragmatic, PHP powers everything from your blog to the most popular websites in the world.