PHP 8.4.26 RC1 and 8.5.11 RC1 Tagged: hash_pbkdf2 Fix and Hardening

PHP 8.5.11 RC1 and PHP 8.4.26 RC1 have been released for testing, delivering maintenance fixes including security hardening and memory safety improvements since the August 27 stable releases. The PHP 8.4 branch features a notable buffer overflow fix in hash_pbkdf2() that could allow heap corruption. PHP 8.5.11 addresses extensive use-after-free and double-free bugs across DOM, Phar, and Intl extensions, alongside Opcache race conditions and JIT crash resolutions. While no new CVEs are reported, users are urged to test these candidates promptly, with the 8.4 patch particularly important for key derivation safety as the branch winds down. PHP 8.5.11 RC1 and PHP 8.4.26 RC1 Tagged with Security Hardening and Bug Fixes Maintenance releases land with key fixes for hash_pbkdf2 and memory safety as PHP 8.4 approaches its December end-of-life. PHP 8.5.11 RC1 and PHP 8.4.26 RC1 hit the source repository today. Volker Dusch tagged the 8.5 release, while Saki Takamachi cut the 8.4 branch. The tags arrived within an hour of each other, signaling the usual coordinated push before stable releases. These are maintenance releases. You won't see new features here. The work focuses on bug fixes and security hardening. The PHP team has been busy cleaning up memory safety issues and correcting behavior across a wide range of extensions. PHP 8.4 gets a critical hash fix PHP 8.4 is in its final stretch. Support ends in December 2026, making this one of the last maintenance releases before end-of-life. The most significant fix lands in the Hash extension. Lazizbek Ergashev reported a buffer overflow in hash_pbkdf2() when called with large output lengths. This could allow heap corruption. The function is commonly used for key derivation, so this is the kind of issue that warrants an immediate upgrade. SNMP also received a fix. Calling SNMP::setSecurity() with a context engine ID over 32 bytes frees a non-malloced address. That is a use-after-free waiting to happen. Other notable additions to the 8.4 branch include a fix for imagebmp() performance, a crash when overriding opcache.interned_strings_buffer in FPM pools, and several corrections to ZipArchive that previously reported success on corrupted entries. Memory safety dominates the 8.5 branch PHP 8.5.11 RC1 focuses heavily on hardening. Ilia Alshanetsky contributed the majority of the security-relevant patches. His fixes address use-after-free bugs in DOM, Phar, and Intl, along with double-frees and memory leaks scattered across several extensions. The BCMath extension has an out-of-bounds read fix when the scale exceeds n_scale. Core encoding detection now prevents OOB reads during automatic UTF-16 and UTF-32 detection. Streams get a guard against OOB reads when following redirects with empty Location headers. FPM gains protection against UID/GID overflows. Opcache sees a race condition fix under ZTS and a resolution for JIT tracing crashes involving inheritance cache misses. Generators get corrected for edge cases with nested yield from calls. The LiteSpeed SAPI also returns a previously uninitialized value that is now properly handled. What this means for your stack Neither of these RCs appears to include new CVE-tagged fixes beyond what was already shipped in the July security release for 8.4 or the August stability release for 8.5. Instead, these are hardening patches. They address conditions like UAFs and buffer overflows that might not have been classified as CVEs at the time but remain exploitable under the right circumstances. If you are running PHP 8.5, test 8.5.11 RC1 as a drop-in replacement for 8.5.10. The fixes are mature enough that the stable release should follow quickly, likely within days. For PHP 8.4 users, the hash_pbkdf2() overflow is a compelling reason to apply this release as soon as it stabilizes. Head here to the PHP 8.5.11 RC1 release page and here to the PHP 8.4.26 RC1 release page.