PHP 30 July 2026 security releases

[Alan Coopersmith <alan.coopersmith () oracle com>]

https://www.php.net/archive/2026.php#2026-07-30-5 announces the releases
of PHP 8.5.9, 8.4.24, 8.3.33, and 8.2.33, all of which are labeled
"This is a security release."

The changelogs for all four releases include:

* GD:
    Upgrade libgd. (CVE-2026-9672)

* PGSQL:
    Fixed https://github.com/php/php-src/security/advisories/GHSA-7qpv-r5mr-78m4
    (SQL injection via E'...' backslash breakout). (CVE-2026-17543)

* Phar:
    Fixed https://github.com/php/php-src/security/advisories/GHSA-vc5h-9ppw-p5f3
    (Crash via recursive symlinks). (CVE-2026-7260)

The changelogs for 8.4.24 & 8.5.9 also include:

* BCMath:
    Fixed https://github.com/php/php-src/security/advisories/GHSA-x692-q9x7-8c3f
    (Out-of-bounds write in bccomp()). (CVE-2026-17544)