Official changelog

Core

• Implemented partial function application RFC. (Arnaud)
• Fixed bug GH-22263 (reset typed property default on every unserialize failure path). (David Carlier)
• Fixed bug GH-18985 (Wrong line numbers for match with constant arms). (ilutov)
• Fixed bug GH-18847 (SEGV in zend_fetch_debug_backtrace() when the memory limit is reached while the tracing JIT enters a call frame). (Arnaud, iliaal)

DOM

• Fixed bug GH-22825 (DOMElement::setAttribute() fails silently when the DTD declares a default value for the attribute). (iliaal)

Embed

• Made php-cli functionality available in embed builds. (henderkes)

GMP

• Added gmp_prevprime(). (Weilin Du, David Carlier)
• Fixed GMP power and shift operators to reject GMP right operands outside the unsigned long range instead of silently truncating them. (Weilin Du)
• Fixed GMP integer string parsing to reject strings containing NUL bytes instead of silently truncating them. (Weilin Du)
• Fixed GMP error messages that referenced outdated parameter names. (Weilin Du)

Intl

• Fixed grammatical issues in Normalizer invalid form and IntlCalendar time zone offset error messages. (Weilin Du)
• Removed the dependency on the ICU IO library. (Weilin Du)

ODBC

• Fixed bug GH-22668 (Heap buffer over-read when a column value exceeds the driver-reported display size). (iliaal)

Opcache

• Re-enable JIT for ZTS builds on Apple Silicon. (realFlowControl)

PDO_ODBC

• Fixed bug GH-22667 (Heap buffer over-read when a column value exceeds the driver-reported display size). (iliaal)
• Fixed bug GH-22666 (Heap buffer overflow when an output parameter value is longer than the declared maxlen). (iliaal)
• Fixed bug GH-22665 (Out-of-bounds write when the ODBC driver reports a diagnostic message length beyond the error buffer). (iliaal)

Phar

• Fixed grammatical issues and outdated terminology in Phar error messages. (Weilin Du)

Reflection

• Fixed bug GH-22681 (Reflection*::__toString() truncates on null bytes). (DanielEScherzer)

SOAP

• Fixed header injection through the Content-Type context option, the soapaction and the cookie names and values. (David Carlier)

MBString

• Fixed bug GH-22779 (mb_strrpos() returns the wrong position for a negative offset in a non-UTF-8 encoding). (Eyüp Can Akman)

Sockets

• Fixed socket_set_option() validation error messages for UDP_SEGMENT and TCP_USER_TIMEOUT, and SO_LINGER options. (Weilin Du)
• Fixed various memory related issues in ext/sockets. (David Carlier)

Standard

• Fixed setlocale() to reject locale names containing NUL bytes instead of silently truncating them, and to reject arrays passed after the $locales argument or additional arguments passed after an array $locales argument. (Weilin Du)

Streams

• Added a new IO copy API used by php_stream_copy_to_stream_ex() that leverages platform primitives (sendfile, splice, copy_file_range, TransmitFile) for faster stream copying. (Jakub Zelenka, David Carlier)
• Fixed bug GH-22841 (php_stream_copy_to_stream_ex() drops progress notifications when using the copy fast path). (David Carlier)
• Fixed bug GH-15836 (Use-after-free when a user stream filter accesses $this->stream during the close flush). (iliaal)

Source: php.net · php-src NEWS file · NEWS · Official announcement · Downloads · PHP Releases