Saturday, September 26, 2026

PHP · Releases

PHP 8.2.34 released with security fixes

php.net Releases · September 24, 2026

The PHP project has released PHP 8.2.34: 12 fixes across 8 components of the 8.2 branch.

The PHP project has released PHP 8.2.34, a maintenance update for the 8.2 branch. The release delivers 12 bug fixes across 8 components — among them Filter, FPM, MySQLnd, OpenSSL, Phar, SOAP … — and keeps the branch current for production use.

This is a security release: it addresses CVE-2026-91768, CVE-2025-1218, CVE-2026-91769, CVE-2026-91767, CVE-2026-6103, CVE-2026-91765, CVE-2025-14181, CVE-2026-92842, CVE-2026-91766, CVE-2026-93682, CVE-2026-17545. Affected setups should upgrade promptly.

The complete official changelog follows below; every entry links to the corresponding upstream issue. Users on the 8.2 branch are advised to update at their convenience — builds, source archives and checksums are available on php.net.

Official changelog Security release

Filter

Fixed GHSA-ch8v-r6jh-4vvr (FILTER_SANITIZE_ENCODED does not encode 0xFF). (Ilia Alshanetsky)

FPM

Fixed GHSA-62xp-839h-2637 (IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison). (CVE-2026-91768) (Alexandre Daubois)

MySQLnd

Fixed GHSA-r6x9-5r99-36j7 (Various packet overreads in mysqlnd wire protocol). (CVE-2025-1218) (Jakub Zelenka, Nora Dossche)

OpenSSL

Fixed GHSA-vvx9-73fr-5jjx (TLS hostname verification falls back to CN after SAN mismatch). (CVE-2026-91769) (Jakub Zelenka)
Fixed GHSA-xr7j-rvgx-xq5p (Heap buffer overflow in php_openssl_matches_wildcard_name() on crafted server certificate wildcard CN). (CVE-2026-91767) (Jakub Zelenka)

Phar

Fixed GHSA-j3wh-g957-2m85 (Integer overflow in phar_tar_number() allowing TAR archive entry injection). (CVE-2026-6103) (Jakub Zelenka)

SOAP

Fixed GHSA-rgrp-mwpx-f6rm (Unbounded recursion in server-side cleanup_xml_node()). (CVE-2026-91765) (Alexandre Daubois)
Fixed GHSA-cj93-vc83-wgqv (Integer overflow to buffer overflow in SOAP HTTP parsing). (CVE-2025-14181) (Nora Dossche, Jakub Zelenka)

Standard

Fixed GHSA-88hq-2827-7pg6 (Out-of-bounds read in convert.* stream filters when line-break-chars contains NUL). (CVE-2026-92842) (geeknik)
Fixed GHSA-fpwc-w8rq-cr92 (Cross-origin credential leak in HTTP stream wrapper redirects). (CVE-2026-91766) (Alexandre Daubois, Jakub Zelenka)
Fixed GHSA-7875-c8px-7q5f (Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header). (CVE-2026-93682) (Ilia Alshanetsky, Jordi Kroon)

Windows

Fixed GHSA-9f67-6fw4-hpfp (Reserved device names are not rejected before file and stream I/O). (CVE-2026-17545) (Shivam Mathur, Jakub Zelenka)

Official downloads

php-8.2.34.tar.gz 24 Sep 2026

sha256: b42a58817acdf3e672d497a8f5314c1ee801b4ca94ebae41878bd29cf7764105
php-8.2.34.tar.bz2 24 Sep 2026

sha256: 0467d63a819016811d35fd14f734764813ab149750379790634294c723cd7562
php-8.2.34.tar.xz 24 Sep 2026

sha256: 5351330c54de240f54f7527c26ef292e239749e6fe11db0330acb5317e02bb39

Source: php.net · php-src NEWS file · NEWS · Official announcement · Downloads · PHP Releases

Read the original source ↗

Rate this article: 0

Comments

No comments yet — be the first.

Open the discussion

No account or password needed — just enter your e-mail and we’ll send you a one-time sign-in link. First time here? You’re set up automatically.

PHP 8.2.34 released with security fixes

Official changelog Security release

Filter

FPM

MySQLnd

OpenSSL

Phar

SOAP

Standard

Windows

Official downloads

Comments

Open the discussion

Check your inbox

+ · Keep reading

A WordPress Bug Needed Accomplices, and Your Stack Volunteered

PHP maintenance updates reach 8.4, 8.3 and 8.2

CVE-2026-87902 exploited after WordPress 7.1.2 release

CVE-2026-91766 links PHP redirects to credential exposure