Issues

• Surfacing security issues with OpenBSD as part of the CI with hardened memory allocator

  FeatureStatus: Needs Triage
  php/php-src#24669 · Filter by author loganaden opened on Oct 25, 2026
  1

  

• zend_set_local_var() overwrites existing compiled variable (CV) zval without calling zval_ptr_dtor()

  BugStatus: Needs Triage
  php/php-src#24668 · Filter by author yasu20200121web-prog opened on Oct 25, 2026

• Typo in zend_hash_iterator_pos_ex() checks !HT_ITERATORS_OVERFLOW(ht) instead of !HT_ITERATORS_OVERFLOW(iter->ht)

  BugStatus: Needs Triage
  php/php-src#24667 · Filter by author yasu20200121web-prog opened on Oct 25, 2026

• FPM: pools with different disable_functions sharing one opcache run scripts wrongly (var_export() calls var_dump(), SIGSEGV in the restricted pool) on 8.4/8.5/8.6

  php/php-src#24661 · Filter by author Enfiladeguide opened on Oct 24, 2026
  1

• Log Security-Relevant Request Rejections and Mitigated Exploit Attempts

  FeatureStatus: Needs Triage
  php/php-src#24657 · Filter by author hackerfactor opened on Oct 24, 2026
  1

• Change session.upload_progress.enabled from default-on to default-off

  FeatureStatus: Verified
  php/php-src#24648 · Filter by author Sainan opened on Oct 24, 2026

• ext/dba: tcadb backend path allows injecting Tokyo Cabinet connection-string parameters (e.g. bnum) via unescaped '#'

  php/php-src#24640 · Filter by author kunwaratulhax0r opened on Oct 24, 2026

• Child constructor is checked against only one interface constructor, depending on the order of implements

  BugStatus: Needs Triage
  php/php-src#24637 · Filter by author zeynallow opened on Oct 24, 2026
  1

• Tracing JIT reads a stale stack slot at a side exit

  BugStatus: Needs Triage
  php/php-src#24634 · Filter by author dixyes opened on Oct 24, 2026
  1

• Delayed OOM raised during compilation is dropped when compilation fails

  php/php-src#24631 · Filter by author pentolope opened on Oct 24, 2026

• Vendor Build Version field needed, visible in phpinfo()

  php/php-src#24627 · Filter by author JDBushQuacken opened on Oct 23, 2026

• Tracing JIT: a bool read from three object properties is stale right after read()/write()/unread() warm their own traces (opcache.jit=1254)

  BugCategory: JITExtension: opcacheStatus: Verified
  php/php-src#24622 · Filter by author frodeborli opened on Oct 23, 2026
  3

  

• fsockopen()/stream_socket_client() accept TCP ports above 65535, which wrap to another port

  php/php-src#24616 · Filter by author Marti2203 opened on Oct 23, 2026

• ArrayObject backing storage cycle causes unbounded recursion in spl_array_get_hash_table_ptr()

  php/php-src#24615 · Filter by author Marti2203 opened on Oct 23, 2026

• mysqlnd: OK packets without info message rejected on x32 builds since GHSA-r6x9-5r99-36j7 (size_t truncation)

  BugStatus: Needs Triage
  php/php-src#24609 · Filter by author themofleur opened on Oct 23, 2026
  1

• mbstring.http_input is ignored in subsequent requests after changing default_charset

  BugStatus: Needs Triage
  php/php-src#24606 · Filter by author OddOnes opened on Oct 23, 2026

• var_export(), print_r() and unserialize() segfault on deep nesting — the stack-limit guard from #22871 is incomplete

  BugStatus: Needs Triage
  php/php-src#24605 · Filter by author Volkopat opened on Oct 23, 2026
  

• Crash in FILTER_VALIDATE_INT when __toString() mutates the referenced options array

  BugStatus: Needs Triage
  php/php-src#24579 · Filter by author Meecoy opened on Oct 22, 2026

• Function JIT: wrong result (null) from a string-scanning loop with strcspn() after a comment-start byte

  BugCategory: JITExtension: opcacheStatus: Verified
  php/php-src#24578 · Filter by author samad-aghaei opened on Oct 22, 2026
  2

• OPcache: CE-cache flag on a shared interned class name becomes visible before its map_ptr offset; FPM child SIGSEGV on a cold cache

  php/php-src#24577 · Filter by author mago0 opened on Oct 22, 2026

• Session upload progress filename sanitization

  BugStatus: Needs Triage
  php/php-src#24574 · Filter by author sykeops opened on Oct 22, 2026

• Allocation-failure call sites still on zend_error_noreturn(E_ERROR) on master (zend_strtod.c "Balloc() failed", zend_multiply.h) — the EOL-7.4 minimal mitigation hardened these, master did not

  php/php-src#24563 · Filter by author srayuth089 opened on Oct 22, 2026
  2

• Case-insensitive substr_compare, ksort, krsort are still locale-dependent

  BugExtension: standardStatus: Verified
  php/php-src#24552 · Filter by author sirreal opened on Oct 22, 2026
  1

• PHP Built-in Server Chunked Encoding Integer Overflow

  BugStatus: Needs Triage
  php/php-src#24536 · Filter by author bountyyfi opened on Oct 22, 2026

• Segfault in zend_try_early_bind when a parent class autoloads its cached child during linking (opcache)

  php/php-src#24534 · Filter by author wimwinterberg opened on Oct 22, 2026