Issues

• ext/phar: Phar::webPhar() 301 redirect keeps PATH_INFO on the CGI SAPIs when a rewrite callback routes to the index

  php/php-src#25112 · Filter by author dhrupo opened on Oct 31, 2026

• json_encode() serializes an uninitialized backed property with a setter hook as null

  php/php-src#25108 · Filter by author JoaoMarcos44 opened on Oct 31, 2026

• array_unshift() skips unvisited values in foreach by reference when the array has holes

  php/php-src#25107 · Filter by author JoaoMarcos44 opened on Oct 31, 2026

• PDO SQLite returns a phantom null row when an unread statement is re-executed with no results

  php/php-src#25106 · Filter by author JoaoMarcos44 opened on Oct 31, 2026

• ext/curl: build_mime_structure_from_hash(): hash iterator dangling after __toString-triggered rehash

  BugStatus: Needs Triage
  php/php-src#25096 · Filter by author cxxz16 opened on Oct 31, 2026

• ext/soap: get_doc_function(): missing NULL check when request Body has fewer elements than declared WSDL parameters

  BugStatus: Needs Triage
  php/php-src#25094 · Filter by author cxxz16 opened on Oct 31, 2026

• ext/phar: out-of-bounds read/write in Phar::webPhar() 301 redirect (full path length used instead of basename)

  BugStatus: Needs Triage
  php/php-src#25093 · Filter by author cxxz16 opened on Oct 31, 2026

• ext/phar: double free in Phar::copy() on tar symlink entries

  BugStatus: Needs Triage
  php/php-src#25092 · Filter by author cxxz16 opened on Oct 31, 2026

• ext/phar: use-after-free in phar_wrapper_rename() when source and destination are identical

  BugStatus: Needs Triage
  php/php-src#25091 · Filter by author cxxz16 opened on Oct 31, 2026

• ext/phar: use-after-free / double free in phar_wrapper_rename() via shared metadata string

  BugStatus: Needs Triage
  php/php-src#25090 · Filter by author cxxz16 opened on Oct 31, 2026

• ext/phar: heap buffer over-read via crafted alias size in zip-based phar (info leak via Phar::getAlias)

  BugStatus: Needs Triage
  php/php-src#25089 · Filter by author cxxz16 opened on Oct 31, 2026

• [ext/openssl] SNI server contexts do not inherit ciphers or ALPN policy

  php/php-src#25088 · Filter by author yetingli opened on Oct 31, 2026

• Io\Poll kqueue backend leaks memory on every Watcher::modifyEvents() call

  BugStatus: Needs Triage
  php/php-src#25086 · Filter by author kelunik opened on Oct 31, 2026

• php-fpm workers' log get silenced with config catch_workers_output = yes and error_log = syslog

  BugStatus: Needs Triage
  php/php-src#25077 · Filter by author n0099 opened on Oct 31, 2026
  1

• Opcache DFA: $x = $x - 1 on a null ?int is rewritten to PRE_DEC, giving NULL (verifier failure in checking build)

  php/php-src#25061 · Filter by author waroad opened on Oct 30, 2026

• Nested unserialize() can expose an outer object while its __unserialize() data is still being parsed

  php/php-src#25056 · Filter by author bukka opened on Oct 30, 2026

• Phar truncates entries of 4 GiB or more without error/warning

  BugStatus: Needs Triage
  php/php-src#25053 · Filter by author haampie opened on Oct 30, 2026

• finfo detects TrueType fonts as application/octet-stream since libmagic 5.48

  php/php-src#25051 · Filter by author dhrupo opened on Oct 30, 2026 · PHP 8.6
  5

  

• Function JIT: "ENTRY 2 (block 15 start 68) - live var 66" for a namespaced method that passes a recursive self:: call to an unqualified function

  BugCategory: JITStatus: Verified
  php/php-src#25037 · Filter by author rhift opened on Oct 29, 2026
  

• mb_strpos()/mb_strrpos(): the out-of-bounds read fixed in 8.4.27 (GH-23106) is still present in PHP-8.3 and PHP-8.2

  BugStatus: Needs Triage
  php/php-src#25025 · Filter by author aygydiewr221 opened on Oct 29, 2026

• mb_ereg_replace(): the out-of-bounds read fixed in 8.4.26 is still present in PHP-8.3 and PHP-8.2

  BugStatus: Needs Triage
  php/php-src#25024 · Filter by author aygydiewr221 opened on Oct 29, 2026

• Windows CLI: get_ps_title() passes bytes to GetConsoleTitleW() instead of characters, overflowing the 260-wchar_t buffer

  php/php-src#25009 · Filter by author apoc opened on Oct 28, 2026

• com_event_sink() / com_print_typeinfo($o, null, true) crash with NULL typelib for objects exposing IProvideClassInfo2

  BugExtension: com_dotnetStatus: Verified
  php/php-src#25008 · Filter by author apoc opened on Oct 28, 2026
  

• Parsing bugs in tar extraction (PharData)

  BugStatus: Needs Triage
  php/php-src#25003 · Filter by author haampie opened on Oct 28, 2026

• ext/session files handler: GC deletes a session file another request still holds locked

  php/php-src#25001 · Filter by author AsahiSoftWareEngineer opened on Oct 28, 2026