PHP 8.4.26 RC1 and 8.5.11 RC1 Tagged: hash_pbkdf2 Fix and Hardening

PHP 8.4.26 RC1 and PHP 8.5.11 RC1 have been released for testing, offering maintenance fixes including security hardening and memory safety improvements. The PHP 8.4 branch addresses a significant buffer overflow fix in the hash_pbkdf2() function, while PHP 8.5.11 tackles various use-after-free and double-free issues across several extensions. These releases focus on bug fixes and security enhancements rather than new features, with an emphasis on memory safety as PHP 8.4 approaches its end-of-life in December 2026. Users are encouraged to test these candidates promptly, particularly the 8.4 patch, which is crucial for key derivation safety PHP 8.5.11 RC1 and PHP 8.4.26 RC1 have been released for testing, delivering maintenance fixes including security hardening and memory safety improvements since the August 27 stable releases. The PHP 8.4 branch features a notable buffer overflow fix in hash_pbkdf2() that could allow heap corruption. PHP 8.5.11 addresses extensive use-after-free and double-free bugs across DOM, Phar, and Intl extensions, alongside Opcache race conditions and JIT crash resolutions. While no new CVEs are reported, users are urged to test these candidates promptly, with the 8.4 patch particularly important for key derivation safety as the branch winds down. PHP 8.4.26 RC1 and 8.5.11 RC1 Tagged: hash_pbkdf2 Fix and Hardening @ Linux Compatible