PHP 8.5.9 released with security fixes
PHP.NET RELEASES, July 30, 2026
The PHP project has released PHP 8.5.9: 50 fixes across 23 components of the 8.5 branch.
The PHP project has released PHP 8.5.9, a maintenance update for the 8.5 branch. The release delivers 50 bug fixes across 23 components — among them Core, BCMath, Calendar, Date, DBA, DOM … — and keeps the branch current for production use.
This is a security release: it addresses CVE-2026-17544, CVE-2026-9672, CVE-2026-17543, CVE-2026-7260. Affected setups should upgrade promptly.
The complete official changelog follows below; every entry links to the corresponding upstream issue. Users on the 8.5 branch are advised to update at their convenience — builds, source archives and checksums are available on php.net.
Readers’ Forum
No contributions yet — open the debate.
Open the discussion
No account or password needed — just enter your e-mail and we’ll send you a one-time sign-in link. First time here? You’re set up automatically.
Your rating will be applied automatically after you sign in.
Check your inbox
We’ve sent a sign-in link to …. Open it on this device — this tab will sign you in automatically.
Nothing arrived? Check your spam folder — and mark the mail as "Not spam" so it lands in your inbox next time.