https://fosstodon.org/@php/114790127424938370 trumpets:
📣 Announcing the immediate availability of: - PHP 8.1.33 - PHP 8.2.29 - PHP 8.3.23 - PHP 8.4.10 ‼️ These address the following security issues: - Checking errors during escaping in PGSQL - NULL Pointer Dereference in SOAP - Null byte termination in hostnames 📝 https://www.php.net/ChangeLog-8.php 🎁 https://www.php.net/downloads :windows8: https://windows.php.net/download/
The ChangeLog link includes further details: * Fixed GHSA-hrwm-9436-5mv3 (pgsql extension does not check for errors during escaping). (CVE-2025-1735) https://github.com/php/php-src/security/advisories/GHSA-hrwm-9436-5mv3 * Fixed GHSA-453j-q27h-5p8x (NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix). (CVE-2025-6491) https://github.com/php/php-src/security/advisories/GHSA-453j-q27h-5p8x * Fixed GHSA-3cr5-j632-f35r (Null byte termination in hostnames). (CVE-2025-1220) https://github.com/php/php-src/security/advisories/GHSA-3cr5-j632-f35r -- -Alan Coopersmith- alan.coopersm...@oracle.com Oracle Solaris Engineering - https://blogs.oracle.com/solaris
