https://www.php.net/archive/2026.php#2026-07-30-5 announces the releases
of PHP 8.5.9, 8.4.24, 8.3.33, and 8.2.33, all of which are labeled
"This is a security release."
The changelogs for all four releases include:
* GD:
Upgrade libgd. (CVE-2026-9672)
* PGSQL:
Fixed https://github.com/php/php-src/security/advisories/GHSA-7qpv-r5mr-78m4
(SQL injection via E'...' backslash breakout). (CVE-2026-17543)
* Phar:
Fixed https://github.com/php/php-src/security/advisories/GHSA-vc5h-9ppw-p5f3
(Crash via recursive symlinks). (CVE-2026-7260)
The changelogs for 8.4.24 & 8.5.9 also include:
* BCMath:
Fixed https://github.com/php/php-src/security/advisories/GHSA-x692-q9x7-8c3f
(Out-of-bounds write in bccomp()). (CVE-2026-17544)
