PHP is an open source general-purpose server-side scripting language originally designed for Web development to produce dynamic Web pages. It is one of the first developed server-side scripting languages to be embedded into an HTML source document rather than calling an external file to process data. The code is interpreted by a Web server with a PHP processor module which generates the resulting Web page. It also has evolved to include a command-line interface capability and can be used in standalone graphical applications.

If you are new to PHP and want to get some idea of how it works, try the introductory tutorial.

After that, check out the online manual.

What's New

Core:

  • Fixed bug GH-21029 (zend_mm_heap corrupted on Aarch64, LTO builds).
  • Fixed bug GH-21059 (Segfault when preloading constant AST closure).
  • Fixed bug GH-21072 (Crash on (unset) cast in constant expression).
  • Fix deprecation now showing when accessing null key of an array with JIT.
  • Fixed bug GH-20657 (Assertion failure in zend_lazy_object_get_info triggered by setRawValueWithoutLazyInitialization() and newLazyGhost()).
  • Fixed bug GH-20504 (Assertion failure in zend_get_property_guard when accessing properties on Reflection LazyProxy via isset()).
  • Fixed OSS-Fuzz #478009707 (Borked assign-op/inc/dec on untyped hooked property backing value).
  • Fixed bug GH-21215 (Build fails with -std=).
  • Fixed bug GH-13674 (Build system installs libtool wrappers when using slibtool).

Curl:

  • Don't truncate length.

Date:

  • Fixed bug GH-20936 (DatePeriod::__set_state() cannot handle null start).
  • Fix timezone offset with seconds losing precision.

DOM:

  • Fixed bug GH-21077 (Accessing Dom\Node::baseURI can throw TypeError).
  • Fixed bug GH-21097 (Accessing Dom\Node properties can can throw TypeError).

LDAP:

  • Fixed bug GH-21262 (ldap_modify() too strict controls argument validation makes it impossible to unset attribute).

MBString:

  • Fixed bug GH-21223; mb_guess_encoding no longer crashes when passed huge list of candidate encodings (with 200,000+ entries).

Opcache:

  • Fixed bug GH-20718 ("Insufficient shared memory" when using JIT on Solaris).
  • Fixed bug GH-21227 (Borked SCCP of array containing partial object).

OpenSSL:

  • Fix a bunch of leaks and error propagation.

Windows:

  • Fixed compilation with clang (missing intrin.h include).

Previous Release Notes:

The PHP development team announces the immediate availability of PHP 8.5.0. This release marks the latest minor release of the PHP language.

PHP 8.5 comes with numerous improvements and new features such as:

  • New "URI" extension
  • New pipe operator (|>)
  • Clone With
  • New #[\NoDiscard] attribute
  • Support for closures, casts, and first class callables in constant expressions
  • And much much more...

Core:

  • Added the #[\NoDiscard] attribute to indicate that a function's return value is important and should be consumed.
  • Added the (void) cast to indicate that not using a value is intentional.
  • Added get_error_handler(), get_exception_handler() functions.
  • Added support for casts in constant expressions.
  • Added the pipe (|>) operator.
  • Added the #[\DelayedTargetValidation] attribute to delay target errors for internal attributes from compile time to runtime.
  • Added support for 'final' with constructor property promotion.
  • Added support for configuring the URI parser for the FTP/FTPS as well as the SSL/TLS stream wrappers as described in https://wiki.php.net/rfc/url_parsing_api#plugability.
  • Added PHP_BUILD_PROVIDER constant.
  • Added PHP_BUILD_DATE constant.
  • Added support for Closures and first class callables in constant expressions.
  • Add support for backtraces for fatal errors.
  • Add clone-with support to the clone() function.
  • Add RFC 3986 and WHATWG URL compliant APIs for URL parsing and manipulation (kocsismate, timwolla)
  • Fixed AST printing for immediately invoked Closure.
  • Properly handle __debugInfo() returning an array reference.
  • Properly handle reference return value from __toString().
  • Improved error message of UnhandledMatchError for zend.exception_string_param_max_len=0.
  • Fixed bug GH-15753 and GH-16198 (Bind traits before parent class).
  • Fixed bug GH-17951 (memory_limit is not always limited by max_memory_limit).
  • Fixed bug GH-20183 (Stale EG(opline_before_exception) pointer through eval).
  • Fixed bug GH-20113 (Missing new Foo(...) error in constant expressions).
  • Fixed bug GH-19844 (Don't bail when closing resources on shutdown).
  • Fixed bug GH-20177 (Accessing overridden private property in get_object_vars() triggers assertion error).
  • Fix OSS-Fuzz #447521098 (Fatal error during sccp shift eval).
  • Fixed bug GH-20002 (Broken build on *BSD with MSAN).
  • Fixed bug GH-19352 (Cross-compilation with musl C library).
  • Fixed bug GH-19765 (object_properties_load() bypasses readonly property checks).
  • Fixed hard_timeout with --enable-zend-max-execution-timers.
  • Fixed bug GH-19839 (Incorrect HASH_FLAG_HAS_EMPTY_IND flag on userland array).
  • Fixed bug GH-19823 (register_argc_argv deprecation emitted twice when using OPcache).
  • Fixed bug GH-19480 (error_log php.ini cannot be unset when open_basedir is configured).
  • Fixed bug GH-19719 (Allow empty statements before declare(strict_types)).
  • Fixed bug GH-19934 (CGI with auto_globals_jit=0 causes uouv).
  • Fixed bug GH-19613 (Stale array iterator pointer).
  • Fixed bug GH-19679 (zend_ssa_range_widening may fail to converge).
  • Fixed bug GH-19681 (PHP_EXPAND_PATH broken with bash 5.3.0).
  • Fixed bug GH-18850 (Repeated inclusion of file with __halt_compiler() triggers "Constant already defined" warning).
  • Fixed bug GH-19476 (pipe operator fails to correctly handle returning by reference).
  • Fixed bug GH-19081 (Wrong lineno in property error with constructor property promotion).
  • Fixed bug GH-17959 (Relax missing trait fatal error to error exception).
  • Fixed bug GH-18033 (NULL-ptr dereference when using register_tick_function in destructor).
  • Fixed bug GH-18026 (Improve "expecting token" error for ampersand).
  • The report_memleaks INI directive has been deprecated.
  • Fixed OSS-Fuzz #439125710 (Pipe cannot be used in write context).
  • Fixed bug GH-19548 (Shared memory violation on property inheritance).
  • Fixed bug GH-19544 (GC treats ZEND_WEAKREF_TAG_MAP references as WeakMap references).
  • Fixed bug GH-18373 (Don't substitute self/parent with anonymous class).
  • Fix support for non-userland stream notifiers.
  • Fixed bug GH-19305 (Operands may be being released during comparison).
  • Fixed bug GH-19306 (Generator can be resumed while fetching next value from delegated Generator).
  • Fixed bug GH-19326 (Calling Generator::throw() on a running generator with a non-Generator delegate crashes).
  • Fix OSS-Fuzz #427814452 (pipe compilation fails with assert).
  • Fixed bug GH-16665 (\array and \callable should not be usable in class_alias).
  • Use 'clock_gettime_nsec_np()' for high resolution timer on macOS if available.
  • Make 'clone()' a function.
  • Introduced the TAILCALL VM, enabled by default when compiling with Clang>=19 on x86_64 or aarch64.
  • Enacted the follow-up phase of the "Path to Saner Increment/Decrement operators" RFC, meaning that incrementing non-numeric strings is now deprecated. (Girgias).
  • Various closure binding issues are now deprecated.
  • Constant redeclaration has been deprecated.
  • Marks the stack as non-executable on Haiku.
  • Deriving $_SERVER['argc'] and $_SERVER['argv'] from the query string is now deprecated.
  • Using null as an array offset or when calling array_key_exists() is now deprecated.
  • The disable_classes INI directive has been removed.
  • The locally predefined variable $http_response_header is deprecated.
  • Non-canonical cast names (boolean), (integer), (double), and (binary) have been deprecated.
  • The $exclude_disabled parameter of the get_defined_functions() function has been deprecated, as it no longer has any effect since PHP 8.0.
  • Terminating case statements with a semicolon instead of a colon has been deprecated.
  • The backtick operator as an alias for shell_exec() has been deprecated.
  • Returning null from __debugInfo() has been deprecated.
  • Support #[\Override] on properties.
  • Destructing non-array values (other than NULL) using [] or list() now emits a warning.
  • Casting floats that are not representable as ints now emits a warning.
  • Casting NAN to other types now emits a warning.
  • Implement GH-15680 (Enhance zend_dump_op_array to properly represent non-printable characters in string literals).
  • Fixed bug GH-17442 (Engine UAF with reference assign and dtor).
  • Do not use RTLD_DEEPBIND if dlmopen is available.

BCMath:

  • Simplify 'bc_divide()' code.
  • If the result is 0, n_scale is set to 0.
  • If size of BC_VECTOR array is within 64 bytes, stack area is now used.
  • Fixed bug GH-20006 (Power of 0 of BcMath number causes UB).

Bz2:

  • Fixed bug GH-19810 (Broken bzopen() stream mode validation).

CLI:

  • Add --ini=diff to print INI settings changed from the builtin default.
  • Drop support for -z CLI/CGI flag.
  • Fixed GH-17956 - development server 404 page does not adapt to mobiles.
  • Fix useless "Failed to poll event" error logs due to EAGAIN in CLI server with PHP_CLI_SERVER_WORKERS.
  • Fixed bug GH-19461 (Improve error message on listening error with IPv6 address).

COM:

  • Fixed property access of PHP objects wrapped in variant.
  • Fixed method calls for PHP objects wrapped in variant.

Curl:

  • Added CURLFOLLOW_ALL, CURLFOLLOW_OBEYCODE and CURLFOLLOW_FIRSTONLY values for CURLOPT_FOLLOWLOCATION curl_easy_setopt option.
  • Added curl_multi_get_handles().
  • Added curl_share_init_persistent().
  • Added CURLINFO_USED_PROXY, CURLINFO_HTTPAUTH_USED, and CURLINFO_PROXYAUTH_USED support to curl_getinfo.
  • Add support for CURLINFO_CONN_ID in curl_getinfo() (thecaliskan)
  • Add support for CURLINFO_QUEUE_TIME_T in curl_getinfo() (thecaliskan)
  • Add support for CURLOPT_SSL_SIGNATURE_ALGORITHMS.
  • The curl_close() function has been deprecated.
  • The curl_share_close() function has been deprecated.
  • Fix cloning of CURLOPT_POSTFIELDS when using the clone operator instead of the curl_copy_handle() function to clone a CurlHandle.

Read the complete release notes here.