The PHP project has released release candidates for PHP 8.4.25 and 8.5.10, focusing on significant security enhancements, particularly in preventing stack overflows in recursive functions and addressing critical vulnerabilities. The patches, which involve around five thousand line changes across numerous files, aim to improve memory safety and stabilize core functions, thereby reducing the risk of crashes during deep recursion. Additional fixes target use-after-free bugs and other memory corruption issues in various core extensions, ensuring that they are addressed before the final build is released. With ongoing support for both versions extending into the late 2020s, system administrators are encouraged to test these release candidates in staging environments before rolling them out in production

PHP 8.4.25 and 8.5.10 Release Candidates Ship With Stack Hardening

The PHP project released PHP 8.4.25 RC1 and PHP 8.5.10 RC1 for testing, introducing substantial security hardening across both active branches. The patch sets focus heavily on preventing stack overflows in recursive functions like array_walk_recursive() and DOM operations, while also resolving critical use-after-free vulnerabilities in core extensions. Additional fixes address JIT deoptimizer register corruption, session heap corruption in mod_mm, and various edge cases in PDO_PGSQL, PCRE, and Reflection that previously caused silent memory issues.

PHP 8.4.25 and 8.5.10 Release Candidates Ship With Stack Hardening @ Linux Compatible