HeroDevs
Visit NES for PHP 7 Home Page

NES for PHP 7 Release Notes: PHP 7.4

Comprehensive release notes and changelog for NES for PHP 7 Release Notes: PHP 7.4, including security patches, bug fixes, and feature updates across all supported versions.

PHP 7.4

7.4.4 (NES) - October 26, 2026

Packages: https://registry.nes.herodevs.com/bin/nes/php/v7.4.33-nes-7.4.4/ (see Installation)

Container Images: registry.nes.herodevs.com/nes/php-nes:7.4.33-nes-7.4.4-<variant>-<base> (see Container Images)

Windows: https://registry.nes.herodevs.com/bin/nes/php/v7.4.33-nes-7.4.4/php-v7.4.33-nes-7.4.4.windows.x64.ts.zip (Windows Server 2022, x64; see Windows)

Based on PHP 7.4.33.

This release patches the following CVEs:

Upgrade notes

  • Session upload progress is off by default: session.upload_progress.enabled now defaults to Off in the build and in the shipped php.ini files. This mitigates CVE-2026-115560, which needs session upload progress to be enabled and has no upstream fix yet; the fix will follow in a later release. Session upload progress has had no effect since release 7.4.1, so setting session.upload_progress.enabled to On does not bring it back.
  • Windows: this release adds a zip of PHP for Windows, the thread-safe x64 build (see the Windows line above for the file and the supported Windows version). It runs PHP from the command line, from IIS through FastCGI and from Apache (php7apache2_4.dll), and replaces the PHP 7.4 zip you use today: the extension build is the same (API20190902,TS,VC15). It needs Microsoft's Visual C++ Redistributable for Visual Studio 2015-2026 (x64), which the zip does not include. SHASUMS256.txt, signed with the release key, lists the zip; the programs are not Authenticode-signed. The Windows page has the download, verification and installation steps.
  • Windows: the zip carries the fixes for the Windows-only vulnerabilities CVE-2024-4577 and CVE-2024-8926 (php-cgi argument injection), CVE-2024-1874 and CVE-2024-5585 (proc_open() command injection) and CVE-2026-17545 (device names in paths). Every release's zip is tested against CVE-2024-4577, CVE-2024-8926 and CVE-2024-5585 before it ships, with the default code page and with the Japanese code page 932 that CVE-2024-4577 needs.
  • Windows: every library the zip bundles is past its known High and Critical CVEs (listed above). Among them: OpenSSL 3.5.9, where other PHP 7.4 zips have OpenSSL 1.1.1 (the legacy provider is in extras\ssl), cURL 8.23.0, libxml2 2.10.4, libxslt 1.1.43, SQLite 3.53.4, zlib 1.3.2, libzip 1.12.1, libssh2 1.11.1, libpq 14.24, OpenLDAP 2.7.0, Net-SNMP 5.9.4 and ICU 72.1. The enchant extension uses Enchant 2. The zip has a CycloneDX SBOM at extras\sbom.cdx.json.
  • RHEL 8 and 9: Argon2 password hashing (PASSWORD_ARGON2I, PASSWORD_ARGON2ID) comes from the php-sodium package, as on RHEL 10; PHP is not linked with libargon2. Install php-sodium if you hash passwords with Argon2.
  • This release also fixes these flaws, which have no CVE ids:
    • DOM: a use-after-free when a DOMXPath::registerPhpFunctions() callback returns a node of another document (GH-22554).
    • DOM: namespace nodes in XPath. Passing one to a PHP function read outside its structure and could crash, and a namespace node returned by DOMXPath::query() or DOMXPath::evaluate(), or passed to a PHP function, could outlive its parent element or that element's document. The namespace node DOMElement::getAttributeNode() or DOMElement::getAttributeNodeNS() returns for an xmlns attribute had the same use-after-free, and with two or more namespace declarations on the element its parentNode read past the declaration and could crash.
    • XSL: passing a namespace node to a php:function() callback read outside its structure and crashed. The callback now gets the namespace node in the transformed document, and its parentNode is a copy of the declaring element, as other node arguments are copies.
    • HTTP stream wrapper: on a redirect, the check for user-supplied headers no longer reads the byte before the header context option.
    • mysqlnd: a server's binary-protocol row too short for its NULL bitmap made the client read past the row. Such a row now fails with the warning "Malformed server packet. No packet space left for the NULL bitmap".
    • intl: Locale::getKeywords() returned a keyword value of exactly 100 bytes without its terminating NUL, and leaked memory when it failed.
    • SOAP: node names that PHP code supplies are limited to 50000 bytes, the longest name libxml2 reads back. An over-long SoapVar or SoapParam name, or a key of an array a server returns, is not used, and the node keeps its default name. An over-long __soapCall() function name, SoapHeader name, property name of an object without a WSDL type, or element name of an XSD_ANYXML array fails with a SoapFault ("SOAP-ERROR: Encoding: ... name is too long"). An XSD_ANYXML array with an integer key no longer crashes.
    • unserialize(): a use-after-free when a nested unserialize() call, made from the unserialize() method of a Serializable class (ArrayObject, ArrayIterator, SplDoublyLinkedList, SplQueue, SplStack, SplObjectStorage or a class of your own), replaces through a back-reference an object that is still being filled. A GMP object being unserialized is protected the same way.

7.4.3 (NES) - October 23, 2026

Packages: https://registry.nes.herodevs.com/bin/nes/php/v7.4.33-nes-7.4.3/ (see Installation)

Container Images: registry.nes.herodevs.com/nes/php-nes:7.4.33-nes-7.4.3-<variant>-<base> (see Container Images)

Based on PHP 7.4.33.

This release adds no new security patches; it includes every security patch from earlier releases.

Upgrade notes

  • This release adds Debian 13, Ubuntu 26.04 and RHEL 10 (with AlmaLinux 10 and Rocky Linux 10). Release 7.4.2 was not published: an upgrade from 7.4.1 needs no extra steps.
  • Debian 13: there is no php7.4-imap. Remove it (sudo apt-get remove php7.4-imap) before you upgrade; the imap_* functions are not available.
  • RHEL 10: php-imap, php-pdo-dblib, php-pdo-firebird, php-tidy, php-oci8 and php-litespeed are not available. Remove them before you run dnf module switch-to php:nes-7.4.
  • RHEL 10: php-dba has no db4 or gdbm handler. Move data kept in Berkeley DB or GDBM files to another handler (lmdb, tcadb, cdb, flatfile or inifile) before you switch.
  • RHEL 10: php-enchant uses Enchant 2, which keeps its user configuration in ~/.config/enchant.
  • RHEL 10: php-pspell needs aspell from CodeReady Linux Builder (crb on AlmaLinux and Rocky Linux).

7.4.1 (NES) - October 23, 2026

Packages: https://registry.nes.herodevs.com/bin/nes/php/v7.4.33-nes-7.4.1/ (see Installation)

Based on PHP 7.4.33.

This release patches the following CVEs:

  • CVE-2022-4900 A flaw in PHP's built-in web server (php -S) can cause a heap buffer overflow when PHP_CLI_SERVER_WORKERS is set to a very large value. - (Medium)
  • CVE-2022-31631 A flaw in PHP's PDO SQLite driver can make PDO::quote() return an unquoted or truncated string for inputs of 2 GiB or more, which can lead to SQL injection. - (Critical)
  • CVE-2023-0567 A flaw in PHP's crypt() and password_verify() can accept malformed Blowfish ($2y$) hashes, so any password matches such a hash. - (High)
  • CVE-2023-0568 A flaw in PHP's path resolution can write one byte past a stack buffer when a resolved path is exactly one byte shorter than the maximum path length. - (High)
  • CVE-2023-0662 A flaw in PHP's multipart/form-data parsing lets a single request with very many parts consume excessive CPU and fill the logs, causing a denial of service. The new max_multipart_body_parts setting limits the number of parts. - (High)
  • CVE-2023-3247 A flaw in PHP's SOAP client HTTP Digest authentication can send uninitialised stack memory to the server and uses a weak client nonce. - (Low)
  • CVE-2023-3823 A flaw in PHP's XML extensions can let another libxml2 user in the same process enable external entity loading, exposing PHP to XML external entity (XXE) attacks. - (High)
  • CVE-2023-3824 A flaw in PHP's phar extension can cause a stack buffer overflow when reading a directory of a crafted phar archive. - (Critical)
  • CVE-2024-1874 A flaw in PHP's proc_open() on Windows can let an attacker-controlled argument run arbitrary commands through cmd.exe. - (Critical)
  • CVE-2024-2756 An incomplete fix for CVE-2022-31629 lets crafted cookie names be turned into __Host- or __Secure- cookies, which can let a network or same-site attacker set cookies the application treats as secure. - (Medium)
  • CVE-2024-3096 A flaw in PHP's password_hash() hashes a bcrypt password that starts with a NUL byte as the empty string, so password_verify() accepts an empty password for it. - (Medium)
  • CVE-2024-4577 A flaw in PHP's CGI binary on Windows with some code pages can turn query string bytes into command-line options, allowing remote code execution. - (Critical)
  • CVE-2024-5458 A flaw in PHP's FILTER_VALIDATE_URL filter can accept URLs with invalid user information when the host is an IPv6 address. - (Medium)
  • CVE-2024-5585 An incomplete fix for CVE-2024-1874 lets proc_open() on Windows run a program name with trailing spaces or dots through cmd.exe without escaping. - (High)
  • CVE-2024-8925 A flaw in PHP's multipart/form-data parsing can mishandle long boundaries, letting an attacker who controls part of a request body hide or merge form fields. - (Low)
  • CVE-2024-8926 An incomplete fix for CVE-2024-4577 lets PHP's CGI binary on Windows with some code page configurations receive command-line options from the query string. - (High)
  • CVE-2024-8927 A flaw in PHP's CGI binary lets a client set HTTP_REDIRECT_STATUS with a request header and bypass cgi.force_redirect, which in some configurations allows arbitrary file inclusion. - (High)
  • CVE-2024-8929 A flaw in PHP's MySQL native driver lets a hostile MySQL server make the client read past its buffers and return heap memory, possibly other queries' data. - (Medium)
  • CVE-2024-8932 A flaw in PHP's ldap_escape() on 32-bit systems can write past its buffer for very long inputs. - (Critical)
  • CVE-2024-9026 A flaw in PHP-FPM worker output logging lets a script inject or remove a few characters of the next log message when catch_workers_output is on. - (Low)
  • CVE-2024-11233 A flaw in PHP's convert.quoted-printable-decode stream filter can read one byte past its input buffer, which can crash the process or disclose memory. - (Medium)
  • CVE-2024-11234 A flaw in PHP's HTTP stream wrapper can let user input add headers or whole requests when a request goes through an HTTP proxy with request_fulluri. - (Medium)
  • CVE-2024-11236 A flaw in PHP's PDO dblib and Firebird drivers on 32-bit systems can make PDO::quote() write past its buffer for very long strings. - (Critical)
  • CVE-2025-1217 A flaw in PHP's HTTP stream wrapper mishandles folded response headers, so an application can act on the wrong header value, such as the wrong Content-Type. - (Medium)
  • CVE-2025-1218 A flaw in PHP's MySQL native driver lets a malicious MySQL server make the client read past the end of a packet. - (Low)
  • CVE-2025-1219 A flaw in PHP's libxml stream handling can decode a document loaded over HTTP with the wrong character set when the URL redirects. - (Medium)
  • CVE-2025-1220 A flaw in PHP's fsockopen() and socket stream functions ignores everything after a NUL byte in a host name, which can bypass allow-lists and server-side request forgery checks. - (Low)
  • CVE-2025-1734 A flaw in PHP's HTTP stream wrapper accepts invalid response header lines, which can make applications accept invalid headers. - (Medium)
  • CVE-2025-1735 A flaw in PHP's PostgreSQL extensions ignores escaping errors, so malformed escaped strings can reach queries. - (Medium)
  • CVE-2025-1736 A flaw in PHP's HTTP stream wrapper can drop the Basic authentication header or other standard headers when user-supplied headers are separated by a bare line feed. - (Medium)
  • CVE-2025-1861 A flaw in PHP's HTTP stream wrapper truncates long redirect locations, so it can follow a different URL than the server sent. - (Medium)
  • CVE-2025-6491 A flaw in PHP's SOAP extension can crash the process with a NULL pointer dereference for a SoapVar whose qualified name has a namespace prefix over 2 GB. - (Medium)
  • CVE-2025-14178 A flaw in PHP's array_merge() can overflow a heap buffer when the merged arrays hold 2^32 elements or more, which can cause memory corruption. - (Medium)
  • CVE-2025-14181 A flaw in PHP's SOAP client lets a malicious SOAP server sending chunked data overflow the client's response buffer. - (Medium)
  • CVE-2026-6103 A flaw in PHP's phar extension can misparse a crafted tar archive, causing out-of-bounds reads. - (Medium)
  • CVE-2026-6722 A flaw in PHP's SOAP decoder can cause a use-after-free for an apache:Map with duplicate keys, which can lead to memory corruption. - (Critical)
  • CVE-2026-6735 A flaw in the PHP-FPM status page prints request URIs unescaped, allowing stored cross-site scripting against whoever views the full status page. - (High)
  • CVE-2026-7258 A flaw in many PHP functions, urldecode() among them, passes negative values to C character classification functions, which can cause out-of-bounds reads on some C libraries. - (Medium)
  • CVE-2026-7260 A flaw in PHP's phar extension follows tar symlinks without a limit, so an archive with a symlink cycle can crash the process. - (Medium)
  • CVE-2026-7261 A flaw in PHP's SOAP server with session persistence can cause a use-after-free when a header handler returns or throws a SoapFault. - (Medium)
  • CVE-2026-7262 A flaw in PHP's SOAP decoder can crash the process with a NULL pointer dereference for an apache:Map item without a value. - (Low)
  • CVE-2026-7568 A flaw in PHP's metaphone() can read before its buffer for strings of 2 GiB or more. - (Medium)
  • CVE-2026-14355 A flaw in PHP's openssl_encrypt() can overflow a heap buffer by up to 8 bytes with AES key wrap with padding. - (Medium)
  • CVE-2026-17543 A flaw in PHP's pg_convert() and the pg_insert(), pg_update(), pg_select() and pg_delete() helpers can quote values incorrectly when standard_conforming_strings is on, which can lead to SQL injection. - (High)
  • CVE-2026-17545 A flaw in PHP on Windows lets a file name such as CON or NUL open a device instead of a file, which can cause a denial of service. - (Medium)
  • CVE-2026-91765 A flaw in PHP's SOAP extension recurses without a limit on deeply nested XML, so an unauthenticated request can crash the process. - (High)
  • CVE-2026-91766 A flaw in PHP's HTTP stream wrapper sends Authorization, Cookie and Proxy-Authorization headers to any host a redirect names, leaking credentials. - (Medium)
  • CVE-2026-91767 A flaw in PHP's OpenSSL extension can read far past the peer name when matching a crafted wildcard certificate name. - (Medium)
  • CVE-2026-91768 A flaw in PHP's FastCGI client check compares only part of an IPv6 address, so other hosts in the same /96 prefix can send FastCGI requests to an allowed pool. - (Medium)
  • CVE-2026-91769 A flaw in PHP's OpenSSL extension falls back to a certificate's Common Name when no subjectAltName matches, so a certificate issued for another host can be accepted. - (Medium)
  • CVE-2026-92842 A flaw in PHP's convert.* stream filters can put heap memory into the filter output when the line-break-chars option contains a NUL byte. - (Medium)
  • CVE-2026-93682 A flaw in PHP's HTTP stream wrapper reads one byte past an empty redirect location, which can change the redirect target. - (Medium)
  • CVE-2026-109618 A flaw in PHP's out-of-memory handling can leave request memory half-initialised and corrupt the heap, which is rated as remote code execution. A script that runs out of memory_limit now ends its process. - (Critical)
  • CVE-2026-109619 A flaw in PHP's request cleanup can leave global state pointing at freed memory, so a later request in the same process can read it. - (Critical)
  • GHSA-4w77-75f9-2c8w A flaw in PHP's built-in web server can cause a heap use-after-free for a request without a Content-Type header. - (Low)
  • GHSA-ch8v-r6jh-4vvr A flaw in PHP's FILTER_SANITIZE_ENCODED filter leaves part of its table uninitialised, so whether byte 0xFF is encoded depends on stack contents. - (Low)
  • GHSA-wg4p-4hqh-c3g9 A flaw in PHP's xml_parse_into_struct() can read past the end of a tag name when XML_OPTION_SKIP_TAGSTART is larger than the name. - (Low)
  • GHSA-www2-q4fc-65wf A flaw in PHP's DNS and network lookup functions ignores everything after a NUL byte in a name, which can bypass checks on the name. - (Low)
  • CVE-2026-9672 A flaw in PHP's bundled GD library can read uninitialised stack memory into an image when decoding a crafted GIF, disclosing information.
  • CVE-2021-38115 A flaw in PHP's bundled GD library can read uninitialised memory when loading a truncated TGA image, which can cause a denial of service.
  • CVE-2021-40812 A flaw in PHP's bundled GD library ignores failed writes in the BMP and WebP writers, which can lead to an out-of-bounds read. - (Medium)
  • CVE-2022-1586 A flaw in PHP's bundled PCRE2 library can cause an out-of-bounds read in JIT-compiled caseless matching of Unicode property classes.
  • CVE-2022-1587 A flaw in PHP's bundled PCRE2 library can cause an out-of-bounds read in JIT-compiled recursive patterns.
  • CVE-2026-89156 A flaw in PHP's bundled PCRE2 library can read before a UTF subject when matching with \X. - (Low)
  • CVE-2026-103111 A flaw in PHP's bundled PCRE2 library can write outside the JIT stack for patterns with very many capturing groups and recursion. - (High)
  • GHSA-43gg-c3xx-7w7g A flaw in PHP's bundled PCRE2 library on ARM64 can read past the end of the subject in JIT-compiled matching, which can cause a denial of service. - (Low)
  • GHSA-m3wq-j48p-jxwh A flaw in the libzip library of the RHEL 8 packages lets a crafted zip archive with colliding entry names slow down opening it. - (Low)
  • CVE-2024-2408 The Marvin attack: RSA decryption with PKCS1 v1.5 padding in PHP's openssl_private_decrypt() can leak timing information that lets an attacker decrypt ciphertexts. NES for PHP 7 relies on the system OpenSSL's implicit rejection where the platform provides it; Debian 12's OpenSSL does not. - (Medium)

Upgrade notes

  • php -v and PHP_VERSION report 7.4.33-nes, so version_compare(PHP_VERSION, '7.4.33', '>=') is false. PHP_VERSION_ID stays 70433, and extensions built for PHP 7.4 load as before.
  • A script that runs out of memory_limit now ends its process: the fatal error goes to stderr (and to error_log when log_errors is on), and no shutdown function runs. php-fpm starts a new worker in its place. Raise memory_limit where a script needs more. This is the mitigation of CVE-2026-109618 and CVE-2026-109619.
  • Session upload progress is disabled: session.upload_progress.enabled has no effect.
  • The new max_multipart_body_parts setting (the fix of CVE-2023-0662) limits the parts of a multipart/form-data request body. Its default, -1, means max_input_vars plus max_file_uploads; raise it for forms with more fields and files.