PHP Group php php 8.5 Update Version 8.5.6

PHP 8.5.6 addresses multiple security vulnerabilities across DOM, FPM, MBString, PDO_Firebird, SOAP, Standard, Streams, and URI handling. It also adds Brotli and Zstandard support for Windows builds and updates Lexbor.

• DOM: Fixed GHSA-4jhr-8w89-j733 and GH-21566, where Dom\XMLDocument::C14N() emitted duplicate namespace declarations after setAttributeNS() (CVE-2026-7263).
• FPM: Fixed GHSA-7qg2-v9fj-4mwv, an XSS vulnerability in the status endpoint (CVE-2026-6735).
• MBString: Fixed GHSA-wm6j-2649-pv75, a null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() (CVE-2026-7259).
• MBString: Fixed GHSA-74r9-qxhc-fx53, an out-of-bounds access in mbfl_name2encoding_ex() (CVE-2026-6104).
• PDO_Firebird: Fixed GHSA-w476-322c-wpvm, SQL injection through NUL bytes in quoted strings (CVE-2025-14179).
• SOAP: Fixed GHSA-85c2-q967-79q5, a stale SOAP_GLOBAL(ref_map) pointer with Apache Map (CVE-2026-6722).
• SOAP: Fixed GHSA-m33r-qmcv-p97q, a use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION (CVE-2026-7261).
• SOAP: Fixed GHSA-hmxp-6pc4-f3vv, a broken Apache map value NULL check (CVE-2026-7262).
• Standard: Fixed GHSA-96wq-48vp-hh57, signed integer overflow of a character-array offset (CVE-2026-7568).
• Standard: Fixed GHSA-m8rr-4c36-8gq4, ensuring unsigned characters are passed consistently to ctype.h functions (CVE-2026-7258).
• Streams: Fixed a segmentation fault in file_get_contents() with an HTTPS URL and configured proxy (CVE-2026-12184).
• URI: Fixed numeric truncation in uriparser text-range comparison when using uriparser versions before 1.0.1 (CVE-2026-42371).

• Core: Fixed garbage-collection assertion failures involving fibers, generators, and destructors, plus reference-counting errors affecting ZEND_EXT_STMT, Countable::count(), and __unset.
• Core: Fixed forwarding of property operations to initialized lazy-proxy instances and shutdown assertion failures when resolving self::, parent::, or static:: callables.
• Core: Fixed a segmentation fault caused by trait class-constant name conflicts with enum cases and corrected a Windows/Clang ZEND_API mismatch.
• CLI: Prevented --rf method lookups from triggering Reflection extension deprecation warnings.
• Iconv: Fixed a memory leak when bailing out.
• Opcache: Fixed JIT register-allocation assertions, incorrect JMPNZ smart branches, conditional optimization regressions, and faulty returns from zend_try blocks.
• OpenSSL: Fixed memory leaks in openssl_pbkdf2() and additional edge-case leaks and crashes.
• PDO_PGSQL: Fixed exceptions with ATTR_PREFETCH=0 on empty result sets.
• Phar: Restored the is_link handler, fixed a NULL dereference in Phar::webPhar() when SCRIPT_NAME is absent, corrected stream-flush return propagation, and fixed multiple memory leaks.
• Random: Prevented Random\Engine\Xoshiro256StarStar::__unserialize() from accepting an all-zero state.
• Session: Fixed a memory leak when the session garbage-collection callback returns a reference-counted value.
• SPL: Fixed a recursive-iterator use-after-free issue and concurrent iteration/deletion problems in SplObjectStorage.
• SQLite3: Corrected the free-list comparator pointer type.

• Curl: Added Brotli and Zstandard support on Windows.
• Lexbor: Updated the embedded Lexbor library to version 2.7.0.

• The Brotli and Zstandard Curl support applies specifically to Windows builds.

Product Information

Vendor: PHP Group

Product: php

Product type: Software

Variant: php 8.5

Version: 8.5.6

Vendor information published: May 7, 2026

Original release notes: View on vendor site

Published on updatealert.io: Oct 28, 2026

Description: A popular general-purpose scripting language that is especially suited to web development. Fast, flexible and pragmatic, PHP powers everything from your blog to the most popular websites in the world.