PHP released versions 8.3.33 and 8.4.24, both focused on critical security fixes without introducing new features. These updates address significant vulnerabilities, including a critical SQL injection in PostgreSQL extensions, memory corruption in the BCMath extension, and a denial-of-service crash potential in the Phar extension. Developers are urged to upgrade immediately to mitigate risks of remote code execution, especially since PHP 8.3 is nearing the end of its security support. The updates also include over twenty bug fixes in PHP 8.4, ensuring overall platform stability
PHP 8.3.33 and 8.4.24 Released: Critical Security Fixes for PGSQL SQLi and BCMath Memory Corruption
PHP released PHP 8.3.33 on July 28 and PHP 8.4.24 on July 29, delivering critical security patches with zero new features. The updates resolve multiple CVEs, most notably a critical PostgreSQL SQL injection in the PGSQL and PDO_PGSQL extensions and an out-of-bounds memory write in PHP 8.4's BCMath extension. Additional high-severity fixes address a denial-of-service crash via recursive symbolic links in the Phar extension and upstream graphic processing vulnerabilities in libgd. With PHP 8.3 entering its final months of security support before December 2026, developers should verify GPG signatures and upgrade immediately to block potential remote code execution.
