PHP Group php php 8.5 Update Version 8.5.9

PHP 8.5.9 addresses multiple memory-safety issues, SQL injection, recursive-symlink crashes, and numerous runtime, date, reflection, JIT, database, and archive bugs. Security fixes include CVE-2026-17544, CVE-2026-17543, CVE-2026-7260, and CVE-2026-9672.

• BCMath fixes an out-of-bounds write in bccomp() (GHSA-x692-q9x7-8c3f, CVE-2026-17544).
• DBA fixes an out-of-bounds read caused by malformed length fields in the flatfile handler.
• GD upgrades libgd to address CVE-2026-9672.
• ODBC and PDO_ODBC fix heap buffer over-reads when column values exceed driver-reported display sizes.
• PDO_ODBC fixes a heap buffer overflow involving oversized output parameter values.
• PDO_ODBC fixes an out-of-bounds write when an ODBC driver reports an excessive diagnostic message length.
• PGSQL fixes SQL injection through E-string backslash breakout (GHSA-7qpv-r5mr-78m4, CVE-2026-17543).
• Phar fixes a crash caused by recursive symbolic links (GHSA-vc5h-9ppw-p5f3, CVE-2026-7260).
• Standard fixes a use-after-free in array_multisort() when a comparator mutates the sorted array.

• Fixes AST pretty-printing for strings containing NUL bytes and missing return detection in global register checks.
• Fixes integer overflow in Calendar Julian day conversion for INT_MAX years.
• Updates timelib to 2022.17 and corrects date parsing, year-zero Unix timestamps, whitespace errors, and __debugInfo() for userland Date subclasses.
• Fixes DOM stack overflow when serializing deeply nested XML documents and incorrect random-access results from getElementsByClassName().
• Fixes an erroneous Exif IFD warning when no next-IFD offset follows an IFD.
• Fixes Hash reliance on implementation-defined malloc alignment.
• Fixes multiple Opcache tracing JIT failures, including incorrect observer dispatch, SIGSEGVs, and infinite recursion in preloaded trait property hooks.
• Fixes OpenSSL blocking stream supplemental-read timeouts.
• Fixes Intl locale lookup fallback behavior, constructor memory leaks, and stale global error state.
• Fixes PHPDBG crashes, lookup failures, leaked lowercased keys, and signal-safe class lookup errors.
• Fixes Reflection namespace handling, dynamic-property shadowing, NUL-byte truncation, and NAN conversion warnings.
• Fixes session garbage-collection differences between PHP 8.3 and PHP 8.5.
• Fixes SPL class lookup behavior with leading backslashes and prevents SplFileObject::fputcsv() crashes on uninitialized objects.
• Fixes base_convert() output truncation beyond 64 characters.
• Fixes URI WHATWG URL host, path percent-encoding, and validation behavior.
• Fixes ZipArchive crashes after entry replacement and incorrect FL_UNCHANGED handling for deleted entries.

• Unmodified readonly properties are locked against modification after clone-with.

Product Information

Vendor: PHP Group

Product: php

Product type: Software

Variant: php 8.5

Version: 8.5.9

Vendor information published: Jul 30, 2026

Original release notes: View on vendor site

Published on updatealert.io: Oct 28, 2026

Description: A popular general-purpose scripting language that is especially suited to web development. Fast, flexible and pragmatic, PHP powers everything from your blog to the most popular websites in the world.