The PHP Development Team would like to announce the availability of a new Windows build for PHP - PHP 5.2.9-2

This release focuses on fixing security flaws in the included OpenSSL library (CVE-2009-0590, CVE-2009-0591 and CVE-2009-0789). The security advisory is available here.

The OpenSSL library has been updated to 0.9.8k, which includes fixes for these flaws.

Note: Only the Windows binaries are affected. There are no changes to the PHP sources, therefore no source releases are necessary.

Updated 9th of April: Added the missing OCI8 DLL

Once again we are happy to announce our involvement with the Google Summer of Code project. Be sure to check our program at this years GSoC.

We invite everyone to look at the list of ideas for this years GSoC, and get involved. Students are welcome to propose their own ideas, and we will consider all applications that are received before the April 3rd deadline. So, thanks to everyone involved and we look forward to seeing many students join us on this great adventure!

The PHP development team is proud to announce the availability of the first release candidate of PHP 5.3.0 (PHP 5.3.0RC1). This release marks the final phase in a major improvement in the 5.X series, which includes a large number of new features, bug fixes and security enhancements.

The key features of the PHP 5.3 branch include:

• Support for namespaces
• Under the hood performance improvements
• Late static binding
• Lambda functions and closures
• Syntax additions: NOWDOC, limited GOTO, ternary short cut "?:" and __callStatic()
• Optional garbage collection for cyclic references
• Optional mysqlnd PHP native replacement for libmysql
• Improved windows support including VC6 and VC9 binaries
• More consistent float rounding
• Deprecation notices are now handle via E_DEPRECATED (part of E_ALL) instead of the E_STRICT error level
• Several enhancements to enable more flexiblity in php.ini (and ini parsing in general)
• New bundled extensions: ext/phar, ext/intl, ext/fileinfo, ext/sqlite3, ext/enchant
• Countless bug fixes and improvements to existing extensions in particular to: ext/openssl, ext/spl and ext/date

This release also drops several extensions and unifies usage of internal APIs. Users should be aware of the following known backwards compatibility breaks:

• Parameter parsing API unification will cause some functions to behave more or less strict when it comes to type juggling
• Removed the following extensions: ext/mhash (see ext/hash), ext/msql, ext/pspell (see ext/enchant), ext/sybase (see ext/sybase_ct)
• Moved the following extensions to PECL: ext/ming, ext/fbsql, ext/ncurses, ext/fdf
• Removed zend.ze1_compatibility_mode
• See the upgrading guide for other minor changes

All users of PHP, especially those using earlier PHP 5 releases are advised to test this release as the final release of PHP 5.3.0 will eventually obsolete the 5.2 branch of PHP.

For users upgrading from previous PHP 5 releases there is an upgrading guide available here, detailing the changes between those releases and PHP 5.3.0.

Please also note that we are aware of issues surrounding float/integer handling in some edge cases (some of which have been introduced in PHP 5.2.0), as well as a crash bug in NSAPI, that will be fixed in PHP 5.3.0RC2. These issues however do not prevent wide spread testing of PHP 5.3.0RC1 as users can now rely on the feature set and implementation decisions no longer being changed.

For a full list of changes in PHP 5.3.0, see the CVS NEWS file.

The PHP Development Team would like to announce the availability of a new Windows build of PHP - PHP 5.2.9-1

This release focuses on fixing a security flaw introduced by the cURL library (CVE-2009-0037). Please see the following for a full description: http://curl.haxx.se/docs/adv_20090303.html

Please note that the cURL related function is disabled when open_basedir or safe_mode enabled.

Note: Only the Windows packages are affected.

The PHP development team would like to announce the immediate availability of PHP 5.2.9. This release focuses on improving the stability of the PHP 5.2.x branch with over 50 bug fixes, several of which are security related. All users of PHP are encouraged to upgrade to this release.

Security Enhancements and Fixes in PHP 5.2.9:

• Fixed security issue in imagerotate(), background colour isn't validated correctly with a non truecolour image. Reported by Hamid Ebadi, APA Laboratory (Fixes CVE-2008-5498). (Scott)
• Fixed a crash on extract in zip when files or directories entry names contain a relative path. (Pierre)
• Fixed explode() behavior with empty string to respect negative limit. (Shire)
• Fixed a segfault when malformed string is passed to json_decode(). (Scott)

Further details about the PHP 5.2.9 can be found in the release announcement for 5.2.9 the full list of changes is available in the ChangeLog for PHP 5.