PHP security releases of December 2025: 8.5.1, 8.4.16, 8.3.29, 8.2.30 and the final 8.1.34

On 18 December 2025 the PHP project released PHP 8.5.1, 8.4.16, 8.3.29, 8.2.30 and 8.1.34 as security releases. It was the first security update for the new 8.5 branch, released a month earlier, and the last release of PHP 8.1, which reached end of life on 31 December 2025. The fixes cover a crash in PDO quoting, a heap overflow in array_merge(), a memory leak in getimagesize(), a null-byte issue in DNS functions and, in 8.5 only, a bundled URI library bug.

At a glance

What the vulnerabilities are

• CVE-2025-14180, PDO quoting crash (GHSA-8xr5-qppj-gvwj): with the PDO PostgreSQL driver and PDO::ATTR_EMULATE_PREPARES enabled, an invalid character sequence in a prepared-statement parameter can make PQescapeStringConn return NULL, which leads to a null pointer dereference and a crash. PHP's advisory rates it Medium (CVSS 4.0 6.3), while the CVE record PHP published scores it 8.2 (High).
• CVE-2025-14178, heap overflow in array_merge() (GHSA-h96m-rvf9-jgm2, Medium, CVSS 3.1 6.5): when the total number of elements in packed arrays exceeds 32-bit limits, an integer overflow in the size calculation can cause memory corruption or crashes. It needs very large arrays, so it mostly matters where users control array sizes.
• CVE-2025-14177, memory leak in getimagesize() (GHSA-3237-qqm7-mfv7, Medium, CVSS 4.0 6.3): when reading images in multi-chunk mode, for example through php://filter, uninitialised heap memory may end up in the APPn segments of the returned data, which can disclose sensitive memory.
• GHSA-www2-q4fc-65wf, null bytes in dns_get_record() (Low, no CVE): DNS functions did not reject names containing a null byte, the same class of problem as the earlier fsockopen() fix, with a possible server-side request forgery angle.
• CVE-2025-67899, uriparser recursion (8.5.1 only): the uriparser library used by PHP 8.5's URI extension allowed unbounded recursion with crafted input. Its CVE record (CNA MITRE) scores it CVSS 3.1 2.9 (Low).

None of these CVEs is in CISA's Known Exploited Vulnerabilities catalog (30 October 2026 edition).

Are you affected?

Upstream builds older than the versions above are affected on their branch. Check each runtime:

php -v
php -r 'echo PHP_VERSION, PHP_EOL;'
php -m | grep -i pdo_pgsql

Debian ships its own version numbers, so compare the installed package with the advisory. Debian 13 (trixie) received DSA-6088-1 on 21 December 2025 and Debian 12 (bookworm) received DSA-6154-1 on 2 March 2026:

# Debian 13 (trixie): fixed in 8.4.16-1~deb13u1 or later
apt policy php8.4-fpm php8.4-cli
# Debian 12 (bookworm): fixed in 8.2.30-1~deb12u1 or later
apt policy php8.2-fpm php8.2-cli

On Ubuntu, check Ubuntu Security Notices for your release.

How to update

On Debian or Ubuntu, run sudo apt update and sudo apt upgrade; you will receive the newest security build for your release, which contains these fixes and later ones. For source, Windows and container builds, move to the latest release of your branch from php.net/downloads. As of 31 October 2026 that means 8.5.12, 8.4.27, 8.3.36 or 8.2.35.

PHP 8.1 users: 8.1.34 was the last upstream release. No later 8.1 releases were made; for the October 2026 php2shell flaws the PHP security team published only minimal source backports for 8.1 and older. Plan an upgrade to 8.3 or newer.

Restart or reboot?

No reboot is needed. Restart PHP-FPM, Apache (if you use mod_php) and long-running PHP workers:

sudo systemctl restart php8.4-fpm   # or php8.2-fpm on bookworm
sudo systemctl restart apache2      # only with mod_php

Sources

• php.net/releases/8_5_1.php
• php.net/releases/8_1_34.php
• php.net/archive/2025.php
• php.net/archive/2026.php
• php.net/ChangeLog-8.php#8.5.1
• github.com/php/php-src/security/advisories/GHSA-8xr5-qppj-gvwj
• github.com/php/php-src/security/advisories/GHSA-www2-q4fc-65wf
• github.com/php/php-src/security/advisories/GHSA-h96m-rvf9-jgm2
• github.com/php/php-src/security/advisories/GHSA-3237-qqm7-mfv7
• cve.org/CVERecord?id=CVE-2025-14180
• cve.org/CVERecord?id=CVE-2025-14178
• cve.org/CVERecord?id=CVE-2025-14177
• cve.org/CVERecord?id=CVE-2025-67899
• security-tracker.debian.org/tracker/DSA-6088-1
• lists.debian.org/debian-security-announce/2025/msg00254.html
• security-tracker.debian.org/tracker/DSA-6154-1
• lists.debian.org/debian-security-announce/2026/msg00063.html
• packages.debian.org/source/trixie/php8.4
• php.net/supported-versions.php
• php.net/eol.php
• cisa.gov/known-exploited-vulnerabilities-catalog