[{"data":1,"prerenderedAt":486},["ShallowReactive",2],{"switcher-blog-pareja":3,"art-php-8-5-8-security-patches-en":6},{"en":4,"es":5},"\u002Fen\u002Fblog\u002Fphp-8-5-8-security-patches\u002F","\u002Fes\u002Fblog\u002Fphp-8-5-8-parches-seguridad\u002F",{"id":7,"title":8,"author":9,"body":10,"date":472,"description":473,"extension":474,"image":475,"meta":476,"navigation":295,"pareja":477,"path":478,"seo":479,"stem":480,"tags":481,"__hash__":485},"blogEn\u002Fen\u002Fblog\u002Fphp-8-5-8-security-patches.md","PHP 8.5.8 and 8.4.23: security patches and why it's time to update (without the panic)","Paco Cubel",{"type":11,"value":12,"toc":452},"minimark",[13,18,31,34,38,65,68,72,80,96,102,127,131,140,144,176,180,183,187,209,229,233,330,341,345,367,377,381,388,392,420,426,430,448],[14,15,17],"h2",{"id":16},"two-maintenance-releases-with-security-fine-print","Two maintenance releases, with security fine print",[19,20,21,22,26,27,30],"p",{},"Earlier this month PHP shipped ",[23,24,25],"strong",{},"8.5.8"," and ",[23,28,29],{},"8.4.23",", two of those \"maintenance\" releases that still carry security fixes worth a look. There's no headline CVE with a nickname here, and no exploit running loose on the internet, so no panic. But there are three fixes that, depending on what you run, range from \"not my problem\" to \"update this week\".",[19,32,33],{},"If you manage PHP servers — your own or your clients' — this is a five-minute read to figure out which group you're in.",[14,35,37],{"id":36},"in-one-sentence","In one sentence",[19,39,40,41,48,49,52,53,60,61,64],{},"Three things get closed: a ",[23,42,43,44],{},"memory corruption in ",[45,46,47],"code",{},"openssl_encrypt"," when using the ",[45,50,51],{},"AES-WRAP-PAD"," mode, a ",[23,54,55,56,59],{},"bypass of the magic ",[45,57,58],{},".phar"," directory protection",", and an ",[23,62,63],{},"inheritance cache flaw in Opcache"," that can leave unstable states under load. The first is the most serious by nature (memory corruption) but also the hardest to trigger; the other two hit more people, more quietly.",[19,66,67],{},"The good news: it's fixed by updating the package and reloading PHP-FPM. No machine reboot.",[14,69,71],{"id":70},"the-three-fixes-ordered-by-what-you-should-look-at-first","The three fixes, ordered by what you should look at first",[73,74,76,77,79],"h3",{"id":75},"_1-memory-corruption-in-openssl_encrypt-aes-wrap-pad","1. Memory corruption in ",[45,78,47],{}," (AES-WRAP-PAD)",[19,81,82,83,89,90,92,93,95],{},"This is the scariest for what it is — heap corruption — but with a very specific condition: ",[23,84,85,86,88],{},"it only triggers if you encrypt with the ",[45,87,51],{}," mode",". That's an uncommon mode (key wrapping, not everyday data encryption), so most applications never touch it. If you don't use ",[45,91,47],{}," with that algorithm, you're not affected; if you use it to wrap keys, it's your number one priority. Fixed in ",[23,94,29],{},".",[73,97,99,100,59],{"id":98},"_2-bypass-of-the-phar-directory-protection","2. Bypass of the ",[45,101,58],{},[19,103,104,105,107,108,111,112,115,116,119,120,122,123,126],{},"PHP specially protects the \"magic\" ",[45,106,58],{}," directory to prevent improper access inside Phar archives. This patch closes a ",[23,109,110],{},"bypass"," of that protection: paths starting with ",[45,113,114],{},"\u002F.phar"," are now handled correctly, while still respecting normal directories that happen to share that prefix. It matters if your application ",[23,117,118],{},"manipulates Phar files"," or loads code packaged in ",[45,121,58],{}," (some frameworks and distribution tools do). Fixed in ",[23,124,125],{},"both"," versions.",[73,128,130],{"id":129},"_3-opcache-inheritance-cache-inheritance-cache-replay","3. Opcache inheritance cache (inheritance cache replay)",[19,132,133,134,137,138,126],{},"The quietest one, but probably the one that touches the most people. Opcache caches class inheritance so it doesn't recompute it on every request; under ",[23,135,136],{},"reentrant autoloading"," in heavy workloads, that cache could \"replay\" unsafely and leave unstable states. It isn't an entry point for an attacker, it's more of a robustness bug that shows up in large apps with deep class hierarchies and high traffic. Fixed in ",[23,139,125],{},[14,141,143],{"id":142},"whos-affected","Who's affected",[145,146,147,154,170],"ul",{},[148,149,150,153],"li",{},[23,151,152],{},"Everyone, to some degree",": any PHP on the 8.5 and 8.4 branches earlier than these versions has all three flaws.",[148,155,156,159,160,162,163,165,166,169],{},[23,157,158],{},"High priority",": anyone using ",[45,161,47],{}," with ",[45,164,51],{}," (rare, but if that's you, run) and anyone working with ",[23,167,168],{},"Phar"," files.",[148,171,172,175],{},[23,173,174],{},"Everyone else",": mostly you get the Opcache robustness improvement. Not screaming-urgent, but it's a clean update with no excuse to put off for months.",[14,177,179],{"id":178},"what-to-do-today","What to do today",[19,181,182],{},"No fluff: check your version and update to the one for your branch.",[73,184,186],{"id":185},"_1-check-which-version-you-have","1. Check which version you have",[188,189,194],"pre",{"className":190,"code":191,"language":192,"meta":193,"style":193},"language-bash shiki shiki-themes github-dark-high-contrast","php -v\n","bash","",[45,195,196],{"__ignoreMap":193},[197,198,201,205],"span",{"class":199,"line":200},"line",1,[197,202,204],{"class":203},"s_sBn","php",[197,206,208],{"class":207},"sCcAr"," -v\n",[145,210,211,221],{},[148,212,213,214,217,218,95],{},"On the ",[23,215,216],{},"8.5"," branch, the target is ",[23,219,220],{},"8.5.8 or newer",[148,222,213,223,217,226,95],{},[23,224,225],{},"8.4",[23,227,228],{},"8.4.23 or newer",[73,230,232],{"id":231},"_2-update-and-reload-php-fpm-no-downtime","2. Update and reload PHP-FPM (no downtime)",[188,234,236],{"className":190,"code":235,"language":192,"meta":193,"style":193},"# Debian \u002F Ubuntu (Ondřej Surý's repository)\nsudo apt update && sudo apt install --only-upgrade php8.5 php8.5-fpm\nsudo systemctl reload php8.5-fpm\n\n# RHEL \u002F AlmaLinux \u002F Rocky (Remi repository)\nsudo dnf update php php-fpm\nsudo systemctl reload php-fpm\n",[45,237,238,244,277,290,297,303,319],{"__ignoreMap":193},[197,239,240],{"class":199,"line":200},[197,241,243],{"class":242},"sQrFR","# Debian \u002F Ubuntu (Ondřej Surý's repository)\n",[197,245,247,250,254,257,261,263,265,268,271,274],{"class":199,"line":246},2,[197,248,249],{"class":203},"sudo",[197,251,253],{"class":252},"sTRMh"," apt",[197,255,256],{"class":252}," update",[197,258,260],{"class":259},"sMAXC"," && ",[197,262,249],{"class":203},[197,264,253],{"class":252},[197,266,267],{"class":252}," install",[197,269,270],{"class":207}," --only-upgrade",[197,272,273],{"class":252}," php8.5",[197,275,276],{"class":252}," php8.5-fpm\n",[197,278,280,282,285,288],{"class":199,"line":279},3,[197,281,249],{"class":203},[197,283,284],{"class":252}," systemctl",[197,286,287],{"class":252}," reload",[197,289,276],{"class":252},[197,291,293],{"class":199,"line":292},4,[197,294,296],{"emptyLinePlaceholder":295},true,"\n",[197,298,300],{"class":199,"line":299},5,[197,301,302],{"class":242},"# RHEL \u002F AlmaLinux \u002F Rocky (Remi repository)\n",[197,304,306,308,311,313,316],{"class":199,"line":305},6,[197,307,249],{"class":203},[197,309,310],{"class":252}," dnf",[197,312,256],{"class":252},[197,314,315],{"class":252}," php",[197,317,318],{"class":252}," php-fpm\n",[197,320,322,324,326,328],{"class":199,"line":321},7,[197,323,249],{"class":203},[197,325,284],{"class":252},[197,327,287],{"class":252},[197,329,318],{"class":252},[19,331,332,333,336,337,340],{},"Reloading PHP-FPM swaps in the new binary without cutting in-flight requests. Adjust the version number (",[45,334,335],{},"php8.5"," \u002F ",[45,338,339],{},"php8.4",") to whatever you have installed.",[73,342,344],{"id":343},"_3-confirm-it-stuck","3. Confirm it stuck",[188,346,348],{"className":190,"code":347,"language":192,"meta":193,"style":193},"php -v\nphp-fpm8.5 -v   # or php-fpm -v depending on your distro\n",[45,349,350,356],{"__ignoreMap":193},[197,351,352,354],{"class":199,"line":200},[197,353,204],{"class":203},[197,355,208],{"class":207},[197,357,358,361,364],{"class":199,"line":246},[197,359,360],{"class":203},"php-fpm8.5",[197,362,363],{"class":207}," -v",[197,365,366],{"class":242},"   # or php-fpm -v depending on your distro\n",[368,369,370],"blockquote",{},[19,371,372,373,376],{},"As always with distributions: sometimes they backport the fix while keeping a different version number. ",[23,374,375],{},"Don't trust the number alone, check the package date"," or your distro's security changelog. Same old lesson: \"it's updated\" is something you verify, not something you remember.",[14,378,380],{"id":379},"what-we-do","What we do",[19,382,383,384,387],{},"As soon as PHP security releases land, we go through the servers we manage, prioritising the ones exposing internet-facing apps and, within those, the ones that match the specific flaw (here, anything touching Phar or OpenSSL encryption). For the rest, it goes into the normal update round. The point isn't to chase every point release, it's to ",[23,385,386],{},"keep the patch plan current"," so a release like this is a ten-minute chore rather than a to-do that drags on for half a year.",[14,389,391],{"id":390},"the-same-old-routine","The same old routine",[145,393,394,400,410,415],{},[148,395,396,399],{},[45,397,398],{},"php -v"," to know where you stand.",[148,401,402,405,406,409],{},[45,403,404],{},"apt","\u002F",[45,407,408],{},"dnf update"," of PHP and PHP-FPM.",[148,411,412,95],{},[45,413,414],{},"systemctl reload php*-fpm",[148,416,417,419],{},[45,418,398],{}," again to confirm.",[19,421,422,423,425],{},"If your PHP hasn't seen a patch in months, or you're not sure whether you use Phar or ",[45,424,47],{}," in some corner of your code, it's a good time to check. And if you'd rather we handle it, let's talk.",[14,427,429],{"id":428},"references","References",[145,431,432,441],{},[148,433,434],{},[435,436,440],"a",{"href":437,"rel":438},"https:\u002F\u002Fwww.linuxcompatible.org\u002Fstory\u002Fphp-releases-858-and-8423-with-security-patches\u002F",[439],"nofollow","PHP releases 8.5.8 and 8.4.23 with security patches — LinuxCompatible",[148,442,443],{},[435,444,447],{"href":445,"rel":446},"https:\u002F\u002Fwww.php.net\u002Fdownloads.php",[439],"PHP.net — Downloads and changelog",[449,450,451],"style",{},"html pre.shiki code .s_sBn, html code.shiki .s_sBn{--shiki-default:#FFB757}html pre.shiki code .sCcAr, html code.shiki .sCcAr{--shiki-default:#91CBFF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html pre.shiki code .sQrFR, html code.shiki .sQrFR{--shiki-default:#BDC4CC}html pre.shiki code .sTRMh, html code.shiki .sTRMh{--shiki-default:#ADDCFF}html pre.shiki code .sMAXC, html code.shiki .sMAXC{--shiki-default:#F0F3F6}",{"title":193,"searchDepth":246,"depth":246,"links":453},[454,455,456,463,464,469,470,471],{"id":16,"depth":246,"text":17},{"id":36,"depth":246,"text":37},{"id":70,"depth":246,"text":71,"children":457},[458,460,462],{"id":75,"depth":279,"text":459},"1. Memory corruption in openssl_encrypt (AES-WRAP-PAD)",{"id":98,"depth":279,"text":461},"2. Bypass of the .phar directory protection",{"id":129,"depth":279,"text":130},{"id":142,"depth":246,"text":143},{"id":178,"depth":246,"text":179,"children":465},[466,467,468],{"id":185,"depth":279,"text":186},{"id":231,"depth":279,"text":232},{"id":343,"depth":279,"text":344},{"id":379,"depth":246,"text":380},{"id":390,"depth":246,"text":391},{"id":428,"depth":246,"text":429},"2026-07-06","PHP ships two maintenance releases closing a memory corruption in openssl_encrypt, a bypass of the .phar directory protection and an inheritance cache flaw in Opcache. Here's which one actually matters, who it hits and how to update without dropping the service.","md","\u002Fog\u002Fog-default.png",{},"php-8-5-8-parches-seguridad","\u002Fen\u002Fblog\u002Fphp-8-5-8-security-patches",{"title":8,"description":473},"en\u002Fblog\u002Fphp-8-5-8-security-patches",[482,483,484],"PHP","Security","Servers","2BWqqZMjei-qeCrqiJ7j3CYEcZmKxZH5wXk8ojcEKUE",1784782834747]