NES for PHP 8 Release Notes: PHP 8.2

PHP 8.2

8.2.1 (NES) - November 10, 2026

Packages: https://registry.nes.herodevs.com/bin/nes/php/v8.2.35-nes-8.2.1/ (see Installation)

Based on PHP 8.2.35.

This release patches the following CVEs:

• CVE-2021-38115 The bundled libgd's TGA reader ignored a short read of the image identification field, leaving the buffer uninitialised (CVE-2021-38115), and its BMP and WebP writers ignored gdPutBuf's result, the BMP writer's error path freeing the caller's context instead of its own temporary one (CVE-2021-40812).
• GHSA-m3wq-j48p-jxwh libzip before 1.12 indexed an archive's entry names in a hash table with an unkeyed 32-bit DJB2 hash and chained colliding names, so an archive whose names all have one hash value (65534 names of 32 bytes are easy to make) makes zip_open take time quadratic in the number of entries: seconds of CPU per archive. - (Low)
• CVE-2024-2408 The Marvin attack: RSA decryption with PKCS#1 v1.5 padding (OPENSSL_PKCS1_PADDING, the default) leaks through timing whether the padding was valid, so an attacker who can submit many ciphertexts and time the answers can decrypt a ciphertext or forge a signature. - (Medium)

It also fixes 194 security issues without a CVE id (148 ported from later PHP versions, 39 found by NES and 7 in bundled libraries).

Upgrade notes

• This is the first release of NES for PHP 8.2, for RHEL 8 and its rebuilds (AlmaLinux 8, Rocky Linux 8, UBI 8), x86_64 and aarch64. There are no packages for other distributions, no container images and no Windows zip for PHP 8.2.
• php -v and PHP_VERSION report 8.2.35-nes, so version_compare(PHP_VERSION, '8.2.35', '>=') is false. PHP_VERSION_ID stays 80235, the module API stays 20220829, and extensions built for PHP 8.2 load as before.
• The packages keep Red Hat's names and layout (php, php-cli, php-fpm, php-mysqlnd and the rest) and are the php:nes-8.2 module stream. Every package's Release is 1.nes82.el8 (for example php-cli-8.2.35-1.nes82.el8.x86_64); no Epoch is raised, and php-pear keeps Red Hat's Epoch 1 (php-pear-1:1.10.18-1.nes82.el8). A host without PHP runs dnf module enable php:nes-8.2 and then dnf install; a host on Red Hat's php:8.2, or another php stream, runs dnf module switch-to php:nes-8.2, which moves the installed PHP packages to the NES builds (Red Hat's php-pecl-xdebug3 and php-pecl-rrd stay, below). With php:nes-8.2 enabled, dnf upgrade never takes Red Hat's builds back.
• The packages are those of Red Hat's php:8.2 stream, less php-pecl-xdebug3 and php-pecl-rrd, plus php-sodium, which needs libsodium from EPEL 8: enable EPEL before installing it. Red Hat's php:8.2 does not build imap, pdo_firebird, pdo_dblib, tidy or pspell, and neither does this stream. php recommends php-sodium, so on a host with php installed and EPEL enabled the switch also installs it.
• php-pecl-zip is PECL zip 1.22.8, the newest release of the 1.22 series (Red Hat's php:8.2 ships 1.22.3), for the memory-safety fixes of 1.22.5 to 1.22.8, with two further fixes of PHP's own zip extension added. It links the stream's own libzip 1.7.3 build, whose entry-name hashing is keyed so a crafted archive cannot make zip_open() take quadratic time (GHSA-m3wq-j48p-jxwh). Its ValueError messages say "must not be empty" where 1.22.3 said "cannot be empty", and reflection lists a #[\Deprecated] attribute on zip_open() and the other procedural zip_*() functions (PHP 8.2 cannot instantiate it; the functions behave as before).
• php-gd is built on PHP's bundled libgd, not on RHEL 8's gd 2.2.5, which keeps flaws in its TGA, XBM, BMP, WebP and GIF code and in imageaffine()'s matrix inversion. JPEG, PNG, WebP, FreeType and XPM are supported, as before; php-gd no longer requires the gd package.
• php-pecl-apcu, php-pecl-apcu-devel and apcu-panel are APCu 5.1.28 (Red Hat's is 5.1.23). php-pear is PEAR 1.10.18; with php-devel (and a compiler), pecl install works. php-pecl-xdebug3 and php-pecl-rrd are not part of the stream: Red Hat's builds stay installed across the switch and load into NES's PHP, but cannot be newly installed while php:nes-8.2 is enabled.
• php-common requires openssl-libs >= 1:1.1.1k-12, the RHEL 8 OpenSSL with implicit rejection for RSA PKCS#1 v1.5 decryption, which is the fix for the Marvin attack (CVE-2024-2408) on openssl_private_decrypt(). Update openssl-libs first on a host that has an older build (updated RHEL 8.9 hosts and later have it). The RHEL 8.6 and 8.8 Extended Update Support builds of the same version are not verified to carry the fix: there, use OPENSSL_PKCS1_OAEP_PADDING.
• Session upload progress is off: the shipped /etc/php.ini sets session.upload_progress.enabled = Off, its compiled default is Off, and setting it to On has no effect. This mitigates CVE-2026-115560, which needs session upload progress and has no upstream fix yet; the fix will follow in a later release.
• PHP-FPM keeps Red Hat's defaults: the www pool runs as apache, listens on /run/php-fpm/www.sock (which the apache and nginx users may use), with pm = dynamic and 50 children at most, and logs errors to /var/log/php-fpm/www-error.log. Your edited /etc/php-fpm.conf, /etc/php-fpm.d/*.conf and /etc/php.ini are kept across the switch.
• PHP uses the system time zone database (tzdata), as Red Hat's build does. On ubi-minimal 8, whose tzdata package has no /usr/share/zoneinfo, only UTC works until microdnf upgrade tzdata and microdnf reinstall tzdata are run.
• mysqlnd (mysqli and PDO MySQL) no longer sends a password in clear text with the mysql_clear_password authentication plugin over a connection that is neither TLS nor a Unix socket: a server, or anyone between PHP and the server, could ask for that plugin and read the password. Such a connection now fails with error 2059 ("Authentication plugin 'mysql_clear_password' cannot be loaded: ..."). Connect accounts that use the plugin (PAM or LDAP authentication) over TLS or a Unix socket; any TLS connection is accepted, so verify the server's certificate to keep the password from a man in the middle. To allow the plugin over plain TCP as before, set the environment variable LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN=1 for the PHP process, the switch libmysqlclient uses: under PHP-FPM, env[LIBMYSQL_ENABLE_CLEARTEXT_PLUGIN] = 1 in the pool configuration; for Apache's PHP module, the web server's own environment (SetEnv does not reach it).
• A server that switches a sha256_password login to a scramble shorter than 20 bytes, or to none, is now refused with error 2027 ("The server sent wrong length for scramble") instead of crashing the client.
• From NES's own php:nes-7.4 (or php:nes-7.2) stream: remove php-xmlrpc first (dnf remove php-xmlrpc; PHP 8 has no xmlrpc extension), then run dnf module switch-to php:nes-8.2. php-json is part of PHP 8 and goes with the switch.
• The way back: remove the NES repository, then run dnf module switch-to php:8.2, which returns every package to Red Hat's build. With php-sodium installed, which Red Hat does not build, add --allowerasing so the switch removes it.
• Security, by area: the 197 security fixes of this release (the CVEs above and the issues without a CVE id) and one mitigation on top of PHP 8.2.35 are:
  • 40 fixes made first on other NES for PHP lines whose flaw PHP 8.2 still has, 38 of them for flaws NES found: unserialize lifetimes, DOM and XSL namespace nodes, SOAP, intl, OpenSSL, mysqlnd authentication and wire protocol, the HTTP stream wrapper, getimagesize(), XSLTProcessor re-entry, DatePeriod and extract(), and tidy::cleanRepair() for builds from the source tarball (the RPMs build no tidy);
  • 144 memory-safety fixes that later PHP versions made and PHP 8.2 never received after it entered security-only support: the engine, allocator and opcache (25); DOM, XSL and SimpleXML (16); phar, zip, bz2, zlib and dba (25); PDO and the database drivers (11); the standard library, streams and the other core extensions (37); SPL, intl, the bundled libgd, date and the smaller extensions (22); PHP-FPM (5); and 3 more found later;
  • 1 memory-safety fix for a flaw NES found in PHP's stream layer, which no PHP version has fixed yet;
  • 12 library fixes: the bundled libgd's TGA, BMP, WebP and GIF fixes (CVE-2021-38115, CVE-2021-40812); php-gd built on that libgd in place of RHEL 8's gd 2.2.5; the built-in time zone database, updated to 2026f for builds from the source tarball; the OpenSSL requirement above; the stream's libzip; and PECL zip 1.22.8 (five fixes since 1.22.3, and two more added).
  
  Counted by origin, as above, the two fixes among the 40 that PHP made first and the two added PECL zip fixes are "ported from later PHP versions", and the library fixes with a CVE or advisory id are among the CVEs. 28 further findings were checked and do not apply to PHP 8.2.