Issues

• [UI/UX] Documentation Pagination (Next/Prev Buttons) and Mobile Footer Alignment & Ergonomics

  FeatureStatus: Needs Triage
  php/php-src#25119 · Filter by author TheCoderGeekSquadLeader opened on Nov 1, 2026

• Dom\HTMLDocument::createFromString() crashes with SIGSEGV instead of a clean OOM fatal error when memory_limit is exhausted during lexbor→libxml2 conversion

  BugExtension: domStatus: Needs Triage
  php/php-src#25118 · Filter by author franciscosantamaria opened on Nov 1, 2026
  

• ext/phar: Phar::webPhar() 301 redirect keeps PATH_INFO on the CGI SAPIs when a rewrite callback routes to the index

  php/php-src#25112 · Filter by author dhrupo opened on Oct 31, 2026

• json_encode() serializes an uninitialized backed property with a setter hook as null

  php/php-src#25108 · Filter by author JoaoMarcos44 opened on Oct 31, 2026

• array_unshift() skips unvisited values in foreach by reference when the array has holes

  php/php-src#25107 · Filter by author JoaoMarcos44 opened on Oct 31, 2026

• PDO SQLite returns a phantom null row when an unread statement is re-executed with no results

  php/php-src#25106 · Filter by author JoaoMarcos44 opened on Oct 31, 2026

• ext/curl: build_mime_structure_from_hash(): hash iterator dangling after __toString-triggered rehash

  BugStatus: Needs Triage
  php/php-src#25096 · Filter by author cxxz16 opened on Oct 31, 2026

• ext/soap: get_doc_function(): missing NULL check when request Body has fewer elements than declared WSDL parameters

  BugStatus: Needs Triage
  php/php-src#25094 · Filter by author cxxz16 opened on Oct 31, 2026

• ext/phar: out-of-bounds read/write in Phar::webPhar() 301 redirect (full path length used instead of basename)

  BugStatus: Needs Triage
  php/php-src#25093 · Filter by author cxxz16 opened on Oct 31, 2026

• [ext/openssl] SNI server contexts do not inherit ciphers or ALPN policy

  php/php-src#25088 · Filter by author yetingli opened on Oct 31, 2026

• Io\Poll kqueue backend leaks memory on every Watcher::modifyEvents() call

  BugStatus: Needs Triage
  php/php-src#25086 · Filter by author kelunik opened on Oct 31, 2026

• php-fpm workers' log get silenced with config catch_workers_output = yes and error_log = syslog

  BugStatus: Needs Triage
  php/php-src#25077 · Filter by author n0099 opened on Oct 31, 2026
  1

• Nested unserialize() can expose an outer object while its __unserialize() data is still being parsed

  php/php-src#25056 · Filter by author bukka opened on Oct 30, 2026

• Phar truncates entries of 4 GiB or more without error/warning

  BugStatus: Needs Triage
  php/php-src#25053 · Filter by author haampie opened on Oct 30, 2026

• finfo detects TrueType fonts as application/octet-stream since libmagic 5.48

  php/php-src#25051 · Filter by author dhrupo opened on Oct 30, 2026 · PHP 8.6
  5

  

• Function JIT: "ENTRY 2 (block 15 start 68) - live var 66" for a namespaced method that passes a recursive self:: call to an unqualified function

  BugCategory: JITStatus: Verified
  php/php-src#25037 · Filter by author rhift opened on Oct 29, 2026
  

• mb_strpos()/mb_strrpos(): the out-of-bounds read fixed in 8.4.27 (GH-23106) is still present in PHP-8.3 and PHP-8.2

  BugStatus: Needs Triage
  php/php-src#25025 · Filter by author aygydiewr221 opened on Oct 29, 2026
  1

• mb_ereg_replace(): the out-of-bounds read fixed in 8.4.26 is still present in PHP-8.3 and PHP-8.2

  BugStatus: Needs Triage
  php/php-src#25024 · Filter by author aygydiewr221 opened on Oct 29, 2026

• Windows CLI: get_ps_title() passes bytes to GetConsoleTitleW() instead of characters, overflowing the 260-wchar_t buffer

  php/php-src#25009 · Filter by author apoc opened on Oct 28, 2026

• com_event_sink() / com_print_typeinfo($o, null, true) crash with NULL typelib for objects exposing IProvideClassInfo2

  BugExtension: com_dotnetStatus: Verified
  php/php-src#25008 · Filter by author apoc opened on Oct 28, 2026
  

• Parsing bugs in tar extraction (PharData)

  BugStatus: Needs Triage
  php/php-src#25003 · Filter by author haampie opened on Oct 28, 2026

• ext/session files handler: GC deletes a session file another request still holds locked

  php/php-src#25001 · Filter by author AsahiSoftWareEngineer opened on Oct 28, 2026

• pdo_sqlite: statement unusable after a failed execute() since 8.4.27 (SQLITE_MISUSE)

  BugExtension: pdo_sqliteStatus: Verified
  php/php-src#24990 · Filter by author francislavoie opened on Oct 28, 2026

• request_parse_body() reentrancy can double-free PG(rfc1867_protected_variables)

  php/php-src#24802 · Filter by author ke0xa6 opened on Oct 27, 2026
  1

• JIT: SIGFPE in ir_fold MUL_OV constant folding for $x = -1; $x *= PHP_INT_MIN in a hot loop

  php/php-src#24801 · Filter by author waroad opened on Oct 27, 2026
  1