Everything

php

PHP 8.3.31

The latest release of PHP 8.3 is 8.3.33 which includes important security patches.

Source Code

PHP 8.3.31 (tar.gz)
- sha256: 4e7baaf0a690e954a20e7ced3dd633ce8cb8094e2b6b612a55e703ecbbdcbf4f
PHP 8.3.31 (tar.bz2)
- sha256: e6986b1fd37eb25402127fe4a7278a3e03b7f9025bb7a4bd292a271bdf930fb9
PHP 8.3.31 (tar.xz)
- sha256: 66410cee07f4b2baeb0843140bb2a2b52ef930b5cf9b3d6e6d158b33aae8fa37

curl
- Add support for brotli and zstd on Windows.
  
  Shivam Mathur
fpm
- Fixed GHSA-7qg2-v9fj-4mwv (XSS within status endpoint). (CVE-2026-6735)
  
  Jakub Zelenka
mbstring
- Fixed GHSA-wm6j-2649-pv75 (Null pointer dereference in php_mb_check_encoding() via mb_ereg_search_init()). (CVE-2026-7259)
  
  vi3tL0u1s
openssl
- Fix compatibility issues with OpenSSL 4.0.
  
  jordikroon
  
  Remi
pdo_firebird
- Fixed GHSA-w476-322c-wpvm (SQL injection via NUL bytes in quoted strings). (CVE-2025-14179)
  
  SakiTakamachi
soap
- Fixed GHSA-85c2-q967-79q5 (Stale SOAP_GLOBAL(ref_map) pointer with Apache Map). (CVE-2026-6722)
  
  ilutov
- Fixed GHSA-m33r-qmcv-p97q (Use-after-free after header parsing failure with SOAP_PERSISTENCE_SESSION). (CVE-2026-7261)
  
  ilutov
- Fixed GHSA-hmxp-6pc4-f3vv (Broken Apache map value NULL check). (CVE-2026-7262)
  
  ilutov
standard
- Fixed GHSA-96wq-48vp-hh57 (Signed integer overflow of char array offset). (CVE-2026-7568)
  
  TimWolla
- Fixed GHSA-m8rr-4c36-8gq4 (Consistently pass unsigned char to ctype.h functions). (CVE-2026-7258)
  
  ilutov

Represents a security release