PHP Group php php 8.5 Update Version 8.5.2

PHP 8.5.2 addresses multiple memory-safety issues, parser failures, crashes, leaks, and compatibility problems across core and extensions.

• Fixed a use-after-free in php_output_handler_free caused by re-entrant ob_start() during error deactivation (GH-20352).
• Fixed a null pointer dereference when cloning malformed DOM namespace objects (GH-20722).
• Fixed an integer underflow during EXIF HEIF parsing when pos.size < 2 (GH-20631).
• Fixed a heap buffer overflow in iptcembed (GH-20582).
• Fixed an out-of-bounds gzseek() condition that caused an assertion failure.
• Fixed a segmentation fault in Uri\WhatWg\Url::withHost() for file: URLs (GH-20668).

• Fixed an assertion failure when dumping function signatures with dynamic class-constant lookup default arguments (OSS-Fuzz #465488618).
• Fixed an assertion failure in normalize_value() when parsing malformed INI input with parse_ini_string() (GH-20695).
• Fixed an uncatchable exception thrown from a generator (GH-20714).
• Fixed out-of-range float-to-integer casting behavior for strings (GH-20745).
• Fixed Dom\XMLDocument::C14N() behavior compared with DOMDocument::C14N() (GH-20444).
• Fixed a memory leak in umsg_format_helper().
• Fixed a memory leak in ldap_set_options().
• Fixed mb_decode_mimeheader() handling of separators (GH-20674).
• Fixed invalid process ID handling in pcntl_getcpuaffinity() on Solaris.
• Fixed undefined behavior in Phar::loadPhar() when reading fails (GH-20732).
• Fixed SplFileInfo::openFile() in write mode.
• Fixed Phar::extractTo() creating empty files (bug #74154).
• Fixed MM session module support.
• Fixed SQLite3Result::fetchArray() returning null instead of array|false (GH-20699).
• Fixed error checking for proc_open() commands.
• Fixed a memory leak in mail() when the header key is numeric.
• Fixed an assertion failure when getUnicodeHost() returns an empty string (GH-20771).

• Builds are supported on systems using legacy OpenSSL 1.1.0.
• The MM session module is supported in this release.
• Solaris users should note corrected invalid-process-ID handling in pcntl_getcpuaffinity().

Product Information

Vendor: PHP Group

Product: php

Product type: Software

Variant: php 8.5

Version: 8.5.2

Vendor information published: Jan 15, 2026

Original release notes: View on vendor site

Published on updatealert.io: Oct 28, 2026

Description: A popular general-purpose scripting language that is especially suited to web development. Fast, flexible and pragmatic, PHP powers everything from your blog to the most popular websites in the world.