PHP 8.5.10

PHP 8.5.10 landed on August 27, 2026 as a maintenance release for the 8.5 branch, and while it is not a headline feature drop, it fixes things that will quietly save you from real pain. If you are still on an older patch, this one is worth the upgrade. Let's look at what actually changed before you click update.

Critical CVE Patches and Stack Overflow Hardening

The headline of this release is security. PHP 8.5.10 ships patches for several critical CVEs and hardening against stack overflow conditions triggered by deeply nested arrays and DOM documents. If your application parses untrusted or deeply nested input, these fixes close real attack paths rather than theoretical ones.

What Actually Changed in 8.5.10

Beyond the security work, this is a focused bug fix release. Notable fixes landed in the string functions and session handling:

• mb_strrpos() corrected — Fixed a case where mb_strrpos() returned the wrong position for a negative offset when the encoding was not UTF-8.
• Session garbage collection — Fixed inconsistent GC behavior between PHP 8.3 and PHP 8.5 so cleanup behaves predictably across versions.
• Stack overflow hardening — Recursion and nested-structure handling is more defensive against memory corruption.

The Skeptic's Verdict

Let's not get carried away. There are no new language features here, so do not expect a migrating user-visible change. What this release does is stop the bleeding: the CVE patches matter, and the mb_ and GC fixes affect real code. Test your string-heavy paths and anything dealing with deeply nested input before rolling out, but in most cases this is a low-risk, high-value update.

Download PHP 8.5.10 from the official downloads page or your package manager and run your test suite. If you rely on the affected functions, do not delay.