PHP Group php php 8.5 Update Version 8.5.8
Your rating
Rate update installation process
Risk factor
No ratings yet. Be the first to rate this update.
AI enhanced content
Update Summary
PHP 8.5.8 addresses memory corruption, allocation, and validation issues, including CVE-2026-14355 in OpenSSL encryption.
Update Details
Security
- Fixed memory corruption in openssl_encrypt() with AES-WRAP-PAD (CVE-2026-14355).
- Fixed a bypass of Phar magic ".phar" directory protection in Phar::addEmptyDir().
- Fixed a double-free vulnerability in gdImageSetStyle() after an overflow-triggered early return.
- Fixed oversized allocation and signed-overflow issues in bcround() and BcMath\Number::round().
- Fixed unsafe Opcache inheritance-cache replay during reentrant autoloading.
Bug Fixes
- Fixed incorrect compile errors for goto statements targeting labels before try/finally blocks.
- Fixed an assertion when an error handler throws during NaN-to-boolean or NaN-to-string coercion.
- Corrected DatePeriod ISO 8601 recurrence validation.
- Corrected EXIF handling for single and double tag values.
- Fixed Intl transliteration argument positions for invalid start and end arguments.
- Synchronized IntlTimeZone error state for invalid display types.
- Fixed an Opcache tailcall vm_interrupt issue and corrupted variable types involving typed by-value returns with reference wrappers.
- Preserved class-name case in ReflectionClass::getProperty() errors and autoloading.
- Prevented SoapServer::handle() crashes when $_SERVER is not an array and corrected raw-input handling.
- Corrected SQLite column retrieval error checks.
- Fixed URI validation error handling so errors from previous wither calls are cleared.
- Fixed Zip error-related memory leaks.
- Fixed Zlib memory leaks when deflate initialization fails with a dictionary and in inflate_add().
- Merged Lexbor patch c3a6847.
Hints
- On Windows, LEXBOR_STATIC was added to CFLAGS_URI so ext/uri links correctly when statically linked into PHP.
Product Information
Vendor: PHP Group
Product: php
Product type: Software
Variant: php 8.5
Version: 8.5.8
Vendor information published: Jul 2, 2026
Original release notes: View on vendor site
Published on updatealert.io: Oct 28, 2026
Description: A popular general-purpose scripting language that is especially suited to web development. Fast, flexible and pragmatic, PHP powers everything from your blog to the most popular websites in the world.