PHP security releases of July 2025: 8.4.10, 8.3.23, 8.2.29 and 8.1.33

On 3 July 2025 the PHP project published PHP 8.4.10, 8.3.23, 8.2.29 and 8.1.33 as security releases. The round is small, three CVEs, but one of them touches how the PostgreSQL extensions escape strings, which matters to any application that builds SQL with those functions. Version 8.4.9 was skipped because, as the 8.4.10 announcement explains, it was tagged without the security patches.

At a glance

What the vulnerabilities are

CVE-2025-1735: pgsql escaping errors were ignored

The pgsql and pdo_pgsql escaping functions did not check whether the underlying libpq quoting call reported an error. PHP's advisory (GHSA-hrwm-9436-5mv3, Medium) says the missing check could result in SQL injection, and the missing error handling could lead to crashes through null pointer dereferences when the PostgreSQL server rejects a string as invalid. The advisory links the issue to PostgreSQL's own CVE-2025-1094 work. The CVE record scores it CVSS 3.1 5.9.

CVE-2025-6491: SOAP crash with a huge namespace prefix

Creating a SoapVar with a fully qualified name larger than 2 GB leaves a libxml2 node in an invalid state, and serialising it causes a null pointer dereference and a crash. The advisory (GHSA-453j-q27h-5p8x, Medium, CVSS 3.1 5.9) notes this applies with libxml2 versions older than 2.13. The impact is denial of service.

CVE-2025-1220: null bytes in hostnames

Functions such as fsockopen() did not reject hostnames that contain a null byte. Other functions, like parse_url(), may read such a hostname differently, so an application that validates a host with one function and connects with another could be steered to a different server. PHP rates this Low (GHSA-3cr5-j632-f35r, CVSS 3.1 3.7) and describes the risk as server-side request forgery.

None of the three CVEs appears in CISA's Known Exploited Vulnerabilities catalog (30 October 2026 edition).

Are you affected?

Upstream builds older than 8.4.10, 8.3.23, 8.2.29 or 8.1.33 are affected. Check every runtime you use:

php -v
php -m | grep -Ei 'pgsql|soap'   # are the affected extensions loaded?
php-fpm8.2 -v                    # Debian/Ubuntu naming; adjust the branch

For distribution packages, compare against the distribution's advisory rather than the upstream number. Debian 12 (bookworm) received the fixes in DSA-5967-1, php8.2 8.2.29-1~deb12u1:

dpkg -l 'php8.2*'
apt policy php8.2-pgsql php8.2-soap php8.2-common

Ubuntu users can look up their release on Ubuntu Security Notices.

How to update

• Debian and Ubuntu packages: sudo apt update, then sudo apt upgrade. This brings you to the newest security build for your release, which includes these fixes.
• Other repositories or hosting panels: update through the same channel you installed PHP from.
• Source and Windows builds: download the current release of your branch from php.net/downloads.
• Containers: rebuild on a fixed base image and redeploy.

Do not stop at the July 2025 versions. As of 31 October 2026 the current releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 stopped receiving upstream fixes after 8.1.34 (end of life 31 December 2025).

Restart or reboot?

No reboot is required, but PHP-FPM and Apache with mod_php keep the old code in memory until restarted:

sudo systemctl restart php8.2-fpm
sudo systemctl restart apache2   # if you use libapache2-mod-php8.2

Restart long-running PHP workers (queues, schedulers, WebSocket servers) as well.

Sources

• php.net/releases/8_4_10.php
• php.net/archive/2025.php
• php.net/ChangeLog-8.php#8.4.10
• github.com/php/php-src/security/advisories/GHSA-hrwm-9436-5mv3
• github.com/php/php-src/security/advisories/GHSA-453j-q27h-5p8x
• github.com/php/php-src/security/advisories/GHSA-3cr5-j632-f35r
• cve.org/CVERecord?id=CVE-2025-1735
• cve.org/CVERecord?id=CVE-2025-6491
• cve.org/CVERecord?id=CVE-2025-1220
• cve.org/CVERecord?id=CVE-2025-1094
• security-tracker.debian.org/tracker/DSA-5967-1
• lists.debian.org/debian-security-announce/2025/msg00131.html
• packages.debian.org/source/bookworm/php8.2
• php.net/supported-versions.php
• php.net/eol.php
• cisa.gov/known-exploited-vulnerabilities-catalog