All pull requests

Pull requests

• Mitigate CVE-2026-109619 in session handling

  Extension: session
  #24775·SleepTheGod opened Oct 27, 2026·

  ·
  2

• ext/standard: Decode base64 four characters at a time in the character loop

  Extension: standard
  #24774·ArtUkrainskiy opened Oct 27, 2026Contributor·

  ·

• Fix urlencoded POST registering max_input_vars + 1 variables

  #24773·Marti2203 opened Oct 27, 2026Contributor·

  ·

• Fix GH-24769: mb_ereg_replace() over-read on truncated trailing character

  Extension: mbstring
  #24772·lazerg opened Oct 27, 2026Contributor·

  ·

• Fix CVE-2026-109619 and improve session error handling

  Extension: session
  #24771·SleepTheGod opened Oct 27, 2026·

  ·

• Implement null byte checks for hostnames and addresses

  #24770·SleepTheGod opened Oct 27, 2026·

  ·
  2

• Fix GH-24661: FPM pools with different disable_functions share cached scripts

  Extension: opcacheSAPI: fpm
  #24766·Enfiladeguide opened Oct 26, 2026·

  ·

• JIT: Discard veneers if generation failed

  Extension: opcache
  #24765·ndossche opened Oct 26, 2026Member·

  ·
  1

• Fix #24763: Clear libxml entity loader before destroying FCC

  Extension: libxml
  #24764·thediex opened Oct 26, 2026·

  ·
  2

• OPcache: preserve constant and reusable expression assignment values

  Extension: opcache
  #24762·aasul opened Oct 26, 2026Contributor·

  ·
  1

• opcache: Call orig_post_shutdown_cb()

  Extension: opcache
  #24761·ndossche opened Oct 26, 2026Member·

  ·

• curl: Fix UAF on clone due to callback data pointer mismatch

  Extension: curl
  #24760·ndossche opened Oct 26, 2026Member·

  ·
  2

• Disable IFUNC for dlopened SAPIs

  ABI breakCategory: Build SystemCategory: Engine
  #24759·kairosci opened Oct 26, 2026Contributor·

  ·
  1

• Fix repeated error suppression across error types

  ABI break
  #24757·kairosci opened Oct 26, 2026Contributor·

  ·
  1

• streams: Keep user wrappers alive across URL operations

  #24754·iliaal opened Oct 26, 2026Member·

  ·

• Fix GH-24752: php_ini_loaded_file.phpt fails under make test

  Extension: standard
  #24753·lazerg opened Oct 26, 2026Contributor·

  ·
  2

• Fix GH-24674: Share the unserialize context only with Serializable

  ABI breakExtension: sessionExtension: standard
  #24751·iliaal opened Oct 26, 2026Member·

  ·
  1

• Fix GH-24748: socket_set_option() crash with declared object properties

  Extension: sockets
  #24749·lazerg opened Oct 26, 2026Contributor·

  ·
  4

• Accept an empty packed hints array in socket_addrinfo_lookup()

  Extension: sockets
  #24747·lacatoire opened Oct 26, 2026Member·

  ·

• Fix GH-24743: var_export() ignores exception from nested object export

  Extension: standard
  #24746·lazerg opened Oct 26, 2026Contributor·

  ·

• Fix GH-24740: Unbounded size of .phar/.metadata* entry in TAR phar

  Extension: phar
  #24742·lazerg opened Oct 26, 2026Contributor·

  ·
  1

  1

• Assert that destroyed hash tables are not in GC buffer

  Category: EngineExtension: standard
  #24739·arnaud-lb opened Oct 26, 2026Member·

  ·

• Fix GH-24735: Resolve repeated local times consistently

  ABI breakExtension: date
  #24738·kairosci opened Oct 26, 2026Contributor·

  ·

• Fix GH-24736: php_odbc_connstr_is_quoted() accepts missing closing brace

  Extension: odbc
  #24737·lazerg opened Oct 26, 2026Contributor·

  ·

• Fix GH-24731: Assertion failure on bailout in header_register_callback()

  #24734·lazerg opened Oct 26, 2026Contributor·

  ·
  4