PHP

For a long time, PHP held the title of World's most used programming language. Only recently it lost it to the likes of C++ and Java, but PHP is still a language to take into account when needing to develop your future project.

Once the first choice of large scale projects like Google or Facebook, PHP has lost some of its appeal thanks to the rise and maturation of Ruby and Python, but it can still provide a high degree of performance and speed, much better than most other programming languages around.

PHP is very attractive to this day, mainly to its huge collection of libraries, tools and development SDKs, that make working with this language not only a pleasure, but actually really efficient and fast.

PHP needs a server to run from, and almost all Web hosting providers provide a PHP interpreter out of the box with their basic packages these days.

What is new in this release:

What is new in version 7.0.5 / 5.6.20 / 5.5.34:

• Huge pages disabled by default.
• Added ability to enable huge pages in Zend Memory Manager through the environment variable USE_ZEND_ALLOC_HUGE_PAGES=1.

What is new in version 7.0.4 / 5.6.19 / 5.5.33:

• Fixed bugs:
• Segfault when binding $this of internal instance method to null.
• Segfault for getClosure() internal method rebind with invalid $this.

What is new in version 7.0.3 / 5.6.18 / 5.5.32:

• Fixed bugs:
• Segfault when binding $this of internal instance method to null.
• Segfault for getClosure() internal method rebind with invalid $this.

What is new in version 7.0.0 / 5.6.16 / 5.5.30:

• Fixed bugs:
• Segfault when binding $this of internal instance method to null.
• Segfault for getClosure() internal method rebind with invalid $this.

What is new in version 5.6.8 / 5.5.24 / 5.4.40 / 5.6.9RC1 / 5.5.25RC1:

• Fixed bugs:
• PHP crashes with __get() and ++ operator in some cases.
• get_browser() browser_name_regex returns non-utf-8 characters.
• parse_url fails on some partial URLs.
• Per Directory Values overrides PHP_INI_SYSTEM configuration options.
• Type confusion vulnerability in exception::getTraceAsString.
• Serialize function return corrupted data when sleep has non-string values.
• Leaking VIA_HANDLER func when exception thrown in __call/... arg passing.
• Segmentation fault when using a generator in combination with an Iterator.
• php_stream_url_wrap_http_ex() type-confusion vulnerability.
• Missing null byte checks for paths in various PHP extensions.

What is new in version 5.6.6 / 5.5.22 / 5.4.38:

• Removed support for multi-line headers, as the are deprecated by RFC 7230.
• Added NULL byte protection to exec, system and passthru.
• Fixed bug:
• getClosure returns somethings that's not a closure.
• Use after free vulnerability in unserialize() with DateTimeZone.
• Mitigation for CVE-2015-0235 - GHOST: glibc gethostbyname buffer overflow.
• htmlspecialchars() does not respect default_charset specified by ini_set.

What is new in version 5.6.5:

• Upgraded crypt_blowfish to version 1.3.
• Fixed bugs:
• unlink() bug with some files path.
• Inside trait, self::class != __CLASS__.
• Pack for 64bits integer is broken on bigendian.
• Errors spawn MessageBox, which blocks test automation.
• Application Popup provides too few information.
• localeconv() broken in TS builds.
• Setting locale randomly broken.
• Configure doesn't define EXPANDED_DATADIR / PHP_DATADIR correctly.
• Crash in timeout thread.
• Constructor from trait conflicts with inherited constructor.
• Explicit Double Free.
• Use After Free Vulnerability in PHP's unserialize().

What is new in version 5.6.4:

• Fixed:
• Some Zend headers lack appropriate extern "C" blocks.
• Segfault while pre-evaluating a disabled function.
• "Inconsistent insteadof definition."- incorrectly triggered.
• Inconsistency in example php.ini comments.
• "unset($this)" can make the program crash.
• Incorrect argument reflection info for array_multisort().
• NULL pointer dereference in unserialize.c.
• Array constant not accepted for array parameter default.
• Use after free vulnerability in unserialize().

What is new in version 5.6.3:

• Implemented 64-bit format codes for pack() and unpack().
• Fixed bugs:
• proc_open on Windows hangs forever.
• A foreach on an array returned from a function not doing copy-on-write.
• Windows 8.1/Server 2012 R2 OS build number reported as 6.2 (instead of 6.3).
• DOMNodeList elements should be accessible through array notation.
• AddressSanitizer reports a heap buffer overflow in php_getopt().
• $a->foo .= 'test'; can leave $a->foo undefined.
• parse_url() - incomplete support for empty usernames and passwords.
• zend_mm_heap corrupted after memory overflow in zend_hash_copy.

What is new in version 5.6.2:

• Fixed bug:
• Integer overflow in unserialize() (32-bits only).

What is new in version 5.6.0:

• Constant scalar expressionss.
• Variadic functions, and argument unpacking syntax
• Exponentiation operator.
• Function and constants imports with the use keyword.
• phpdbg as an interactive integrated debugger SAPI.
• php://input attribute changes as well as POST data parsing mechanism.
• GMP objects now support operator overloading.
• Files larger than 2 gigabytes in size are now accepted.
• Array keys won't be overwritten when defining an array as a property of a class via an array literal.
• json_decode() is more strict in JSON syntax parsing.
• Stream wrappers now verify peer certificates and host names by default when using SSL/TLS.
• GMP resources are now objects.
• Mcrypt functions now require valid keys and IVs.

What is new in version 5.5.16:

• This release fixes several bugs against PHP 5.5.15 and resolves CVE-2014-3538, CVE-2014-3587, CVE-2014-2497, CVE-2014-5120 and CVE-2014-3597.

What is new in version 5.5.14:

• This release fixes several bugs against PHP 5.5.13.
• Also, this release fixes a total of 8 CVEs, half of them concerning the FileInfo extension.

What is new in version 5.5.13:

• Fixed bugs:
• copy() doesn't work when destination filename is created by tempnam().
• Echoing unserialized "SplFileObject" crash.
• Usage of memcpy() with overlapping src and dst in zend_exceptions.c.
• spl_fixedarray_resize integer overflow.
• printf out-of-bounds read.
• iptcparse out-of-bounds read.

What is new in version 5.5.12:

• Fixed bugs:
• Out of memory on command stream_get_contents.
• stream_socket_server() creates wrong Abstract Namespace UNIX sockets.
• Exit in stream filter produces segfault.
• fpassthru broken.
• getimagesize should recognize BMP files with negative height.
• substr_compare broke by previous change.

What is new in version 5.5.11:

• Fixed:
• proc_open() changes environment array.
• Allow zero length comparison in substr_compare().

What is new in version 5.5.10:

• Upgraded to PCRE 8.34.
• Fixed:
• Allow multiple paths in php_ini_scanned_path.
• file: infinite recursion.
• imagecrop(): insufficient fix for NULL defer.
• Implemented ldap_modify_batch.
• out-of-bounds memory access in fileinfo.

What is new in version 5.5.9:

• Fixed bug:
• copy() arginfo has changed starting from 5.4.

What is new in version 5.5.8:

• Disallowed JMP into a finally block.
• Added validation of class names in the autoload process.
• Fixed:
• Invalid C code in zend_strtod.c.
• list() fails to unpack yielded ArrayAccess object.
• Generators/throw_rethrow FAIL with ZEND_COMPILE_EXTENDED_INFO.
• fopen and O_NONBLOCK.
• zend_register_functions breaks reflection.

What is new in version 5.5.7:

• This release fixes some bugs against PHP 5.5.6, and fixes CVE-2013-6420.

What is new in version 5.5.6:

• Improved performance of array_merge() and func_get_args() by eliminating useless copying.
• Fixed:
• Basename is no more working after fgetcsv in certain situation.
• Space before ";" breaks php.ini parsing.
• Scope resolution operator - strange behavior with $this.
• Dangling context pointer causes crash.

What is new in version 5.5.5:

• Fixed bugs:
• Wrong behavior of static variables in closure generators.
• Compile time errors won't trigger auto loading.
• By-ref foreach on property access of string offset segfaults.

What is new in version 5.5.3 / 5.4.19:

• Fixed UMR in fix for CVE-2013-4248.

What is new in version 5.5.2:

• Fixed bugs:
• Segfault in gc_zval_possible_root when return reference fails.
• Value of FILTER_SANITIZE_FULL_SPECIAL_CHARS constant (previously was erroneously set to FILTER_SANITIZE_SPECIAL_CHARS value).
• Use of max int in array_sum.
• get_defined_constants() causes PHP to crash in a very limited case.
• Solaris sed has no -i switch.
• CGI mode - make install don't work.
• --enable-dtrace leads make to clobber Zend/zend_dtrace.d.

What is new in version 5.5.1:

• Fixed bugs:
• Exception not catchable when exception thrown in autoload with a namespace.
• Generated configure script is malformed on OpenBSD.
• is_callable() triggers Fatal Error.
• Yield / exit segfault.
• Generator + autoload + syntax error = segfault.
• chroot() does not get enabled.
• hex2bin() raises E_WARNING for invalid hex string.

What is new in version 5.5.0:

• Added generators and coroutines.
• Added the finally keyword.
• Added a simplified password hashing API.
• Added support for constant array/string dereferencing.
• Added scalar class name resolution via ::class.
• Added support for using empty() on the result of function calls and other expressions.
• Added support for non-scalar Iterator keys in foreach.
• Added support for list() constructs in foreach statements.
• Added the Zend OPcache extension for opcode caching.
• The GD library has been upgraded to version 2.1 adding new functions and improving existing functionality.

What is new in version 5.4.16:

• Fixed bugs:
• Heap based buffer overflow in quoted_printable_encode.
• Use of no longer available ini directives causes crash on TS build.
• Ccompilation failure on x32.
• SegFault on zend_deactivate.
• Segfault on memory exhaustion within function definition.

What is new in version 5.5.0 RC 1:

• FPM:
• Ignore QUERY_STRING when sent in SCRIPT_FILENAME.
• Fixed some possible memory or resource leaks and possible null dereference detected by code coverity scan.
• Log a warning when a syscall fails.
• GD:
• Fix build with system libgd >= 2.1 which is now the minimal version required (as build with previous version is broken). No change when bundled libgd is used.
• SNMP:
• Fixed bug #64765 (Some IPv6 addresses get interpreted wrong).
• Fixed bug #64159 (Truncated snmpget).
• Streams:
• Fixed bug #64770 (stream_select() fails with pipes returned by proc_open() on Windows x64).

What is new in version 5.4.14:

• Fixed bugs:
• Ran out of opcode space.
• Memoryleak when using the same variablename two times in function declaration.
• More empty delimiter warning in strX methods.
• ArrayAccess::&offsetGet() in a trait causes fatal error.
• microtime(true) less than $_SERVER['REQUEST_TIME_FLOAT'].
• Debug backtrace changed behavior since 5.4.10 or 5.4.11.
• Parent class incorrectly using child constant in class property.
• zend_do_fcall_common_helper_SPEC does not handle exceptions properly.
• Show class_alias In get_declared_classes().

What is new in version 5.5.0 Beta 1:

• Added Zend Opcache extension and enable building it by default.
• Added array_column function which returns a column in a multidimensional array.
• Fixed bug for unserialized array of objects whose class can't be autoloaded fail).
• Added support for changing the process's title in CLI/CLI-Server SAPIs. The implementation is more robust that the proctitle PECL module.
• Fixed bug #64370 (microtime(true) less than $_SERVER['REQUEST_TIME_FLOAT']).

What is new in version 5.5.0 Alpha 6:

• Fixed a bug where uninitialized ++$foo->bar; does not cause a notice,
• Updated bundled PCRE 8.32,
• Fixed a bug in ext/sockets where sendmsg/recvmsg shutdown handler causes segfault

What is new in version 5.4.12:

• Fixed:
• Wrong TSRM usage in zend_register_class alias.
• get_html_translation_table() output incomplete with HTML_ENTITIES and ISO-8859-1.
• isset() inconsistently produces a fatal error on protected property.
• Bad warning text from strpos() on empty needle.
• Use after scope error in zend_compile.
• Poor efficiency of strtr() using array with keys of very different length.
• zend_std_compare_objects crash on recursion.
• Magic methods called twice for unset protected properties.
• fopen follows redirects for non-3xx statuses.
• Support BITMAPV5HEADER in getimagesize().

What is new in version 5.4.12 RC1:

• Fixed bugs:
• Wrong TSRM usage in zend_Register_class alias.
• get_html_translation_table() output incomplete with HTML_ENTITIES and ISO-8859-1.
• isset() inconsistently produces a fatal error on protected property.
• Bad warning text from strpos() on empty needle.
• Use after scope error in zend_compile.
• Poor efficiency of strtr() using array with keys of very different length.
• zend_std_compare_objects crash on recursion.
• Magic methods called twice for unset protected properties.
• fopen follows redirects for non-3xx statuses.
• Support BITMAPV5HEADER in getimagesize().

What is new in version 5.5.0 Alpha 2:

• Added systemtap support by enabling systemtap compatible dtrace probes on Linux.
• Added support for using empty() on the result of function calls and other expressions.
• Optimized access to temporary and compiled VM variables. 8% less memory reads.
• The VM stacks for passing function arguments and syntactically nested calls were merged into a single stack. The stack size needed for op_array execution is calculated at compile time and preallocated at once. As result all the stack push operations don't require checks for stack overflow any more.

What is new in version 5.4.9:

• Fixed bugs:
• zend_mm_heap corrupted with traits.
• (un)serialize() leaves dangling pointers, causes crashes.
• PHP fails to open Windows deduplicated files.
• Handle leak in is_readable on Windows.

What is new in version 5.4.8:

• Added optional second argument for assert() to specify custom message.
• Support building PHP with the native client toolchain.
• Added --offline option for tests.
• Fixed bugs:
• parse_url does not match password component.
• is_callable() lies for abstract static method.
• Segfault while load extension failed in zts-build.
• Notice: could not be converted to int when comparing some builtin classes.
• Only one directive is loaded from "Per Directory Values" Windows registry.
• Double free when use traits.
• Shutdown functions not called in certain error situation.
• Custom error handler throwing Exception + fatal error = no shutdown function.
• error_log error time has changed to UTC ignoring default timezone.

What is new in version 5.3.16:

• Fixed bug where --with-zend-multibyte and --enable-debug reports LEAK with run-test.php).
• Fixed bug where curl_setopt($ch, CURLOPT_COOKIEFILE, "") returns false.
• Fixed bug where Segfault in DateInterval class when extended.
• Fixed bug where ReflectionParameter::isDefaultValueAvailable() wrong result.
• Fixed bug where ArrayIterator::count() from IteratorIterator instance gives Segmentation fault.

What is new in version 5.4.6 RC1:

• Interactive php-cli crashes if include() is used in auto_prepend_file.
• unset($array[$float]) causes a crash.
• Crashes due non-initialized internal properties_table.
• --with-zend-multibyte and --enable-debug reports LEAK with run-test.php.

What is new in version 5.4.5 / 5.3.15:

• This release fixes over 30 bugs and includes a fix for a security related overflow issue in the stream implementation. All users of PHP are encouraged to upgrade to PHP 5.4.5 or PHP 5.3.15.

What is new in version 5.4.3:

• Fixed Buffer Overflow in apache_request_headers.
• Improved fix for PHP-CGI query string parameter vulnerability.

What is new in version 5.4.2:

• Fixed bug for PHP-CGI query string parameter vulnerability.

What is new in version 5.4.1:

• Fix fileinfo test problems.
• Fixed crash in ZTS using same class in many threads.
• MFH mb_ereg_replace_callback() for security enhancements.
• Fixed memory leak in substr_replace.
• Make max_file_uploads ini directive settable outside of PHP.

What is new in version 5.4.1 RC2:

• Fixed crash in ZTS using same class in many threads.

What is new in version 5.4.0:

• Removed legacy features:
• break/continue $var syntax.
• Safe mode and all related ini options.
• register_globals and register_long_arrays ini options.
• import_request_variables().
• allow_call_time_pass_reference.
• define_syslog_variables ini option and its associated function.
• highlight.bg ini option.
• Session bug compatibility mode (session.bug_compat_42 and session.bug_compat_warn ini options).
• session_is_registered(), session_register() and session_unregister() functions.
• y2k_compliance ini option.
• magic_quotes_gpc, magic_quotes_runtime and magic_quotes_sybase ini options. get_magic_quotes_gpc, get_magic_quotes_runtime are kept but always return false, set_magic_quotes_runtime raises an E_CORE_ERROR.
• Removed support for putenv("TZ=..") for setting the timezone.
• Removed the timezone guessing algorithm in case the timezone isn't set with date.timezone or date_default_timezone_set(). Instead of a guessed timezone, "UTC" is now used instead.
• Moved extensions to PECL:
• ext/sqlite. (Note: the ext/sqlite3 and ext/pdo_sqlite extensions are not affected)
• General improvements:
• Added short array syntax support ([1,2,3]), see UPGRADING guide for full details.
• Added binary numbers format (0b001010).
• Added support for Class::{expr}() syntax
• Added multibyte support by default. Previously php had to be compiled with --enable-zend-multibyte. Now it can be enabled or disabled through zend.multibyte directive in php.ini.
• Removed compile time dependency from ext/mbstring
• Added support for Traits.
• Added closure $this support back.
• Added array dereferencing support.
• Added callable typehint.
• Added indirect method call through array.
• Added DTrace support.
• Added class member access on instantiation (e.g. (new foo)->bar()) support.
• Implemented Zend Signal Handling (configurable option --enable-zend-signals, off by default).
• Improved output layer, see README.NEW-OUTPUT-API for internals.
• Improved unix build system to allow building multiple PHP binary SAPIs and one SAPI module the same time.
• Implemented closure rebinding as parameter to bindTo.
• Improved the warning message of incompatible arguments.
• Improved ternary operator performance when returning arrays.
• Changed error handlers to only generate docref links when the docref_root INI setting is not empty.
• Changed silent conversion of array to string to produce a notice.
• Changed default value of "default_charset" php.ini option from ISO-8859-1 to UTF-8.
• Changed silent casting of null/''/false into an Object when adding a property into a warning.
• Changed E_ALL to include E_STRICT.
• Disabled windows CRT warning by default, can be enabled again using the ini directive windows_show_crt_warnings.
• Fixed bug #55378: Binary number literal returns float number though its value is small enough.

What is new in version 5.3.10:

• Fixed arbitrary remote code execution vulnerability.

What is new in version 5.3.9:

• Security Enhancements and Fixes in PHP 5.3.9:
• Added max_input_vars directive to prevent attacks based on hash collisions.
• Fixed bug #60150 (Integer overflow during the parsing of invalid exif header).
• Key enhancements in PHP 5.3.9 include:
• Fixed bug #55475 (is_a() triggers autoloader, new optional 3rd argument to is_a and is_subclass_of).
• Fixed bug #55609 (mysqlnd cannot be built shared).
• Many changes to the FPM SAPI module.

What is new in version 5.4.0 RC4:

• Added max_input_vars directive to prevent attacks based on hash collisions.
• Fixed a segfault in the traits code.

What is new in version 5.4.0 RC2:

• Further bug fixes in the built-in web server.
• PHP-FPM is no longer marked as EXPERIMENTAL.
• Several improvements and bug fixes in the Zend Engine, Core and other extensions.

What is new in version 5.4.0 RC1:

• Added class member access on instantiation (e.g. (new Foo)->bar()).
• Changed silent conversion of array to string to produce a notice.
• Numerous bug fixes and improvements in the Core and other extensions.

What is new in version 5.4.0 Beta 2:

• PHP 5.4 includes new language features and removes several legacy (deprecated) behaviors.

What is new in version 5.3.8:

• Fixed bug #55439 (crypt() returns only the salt for MD5).
• Reverted a change in timeout handling restoring PHP 5.3.6 behavior, which caused mysqlnd SSL connections to hang (Bug #55283).

What is new in version 5.3.7:

• Upgraded bundled SQLite to version 3.7.7.1.
• Upgraded bundled PCRE to version 8.12.

What is new in version 5.3.6:

• Security Enhancements and Fixes in PHP 5.3.6:
• Enforce security in the fastcgi protocol parsing with fpm SAPI.
• Fixed bug #54247 (format-string vulnerability on Phar). (CVE-2011-1153)
• Fixed bug #54193 (Integer overflow in shmop_read()). (CVE-2011-1092)
• Fixed bug #54055 (buffer overrun with high values for precision ini setting).
• Fixed bug #54002 (crash on crafted tag in exif). (CVE-2011-0708)
• Fixed bug #53885 (ZipArchive segfault with FL_UNCHANGED on empty archive). (CVE-2011-0421)
• Key enhancements in PHP 5.3.6 include:
• Upgraded bundled Sqlite3 to version 3.7.4.
• Upgraded bundled PCRE to version 8.11.
• Added ability to connect to HTTPS sites through proxy with basic authentication using stream_context/http/header/Proxy-Authorization.
• Added options to debug backtrace functions.
• Changed default value of ini directive serialize_precision from 100 to 17.
• Fixed Bug #53971 (isset() and empty() produce apparently spurious runtime error).
• Fixed Bug #53958 (Closures can't 'use' shared variables by value and by reference).
• Fixed bug #53577 (Regression introduced in 5.3.4 in open_basedir with a trailing forward slash).
• Over 60 other bug fixes.

What is new in version 5.2.17:

• Fixed bug #53632 (PHP hangs on numeric value 2.2250738585072011e-308). (CVE-2010-4645).

What is new in version 5.3.5:

• Fixed bug #53632 (PHP hangs on numeric value 2.2250738585072011e-308). (CVE-2010-4645).

What is new in version 5.2.15:

• Security Enhancements and Fixes in PHP 5.2.15:
• Fixed extract() to do not overwrite $GLOBALS and $this when using EXTR_OVERWRITE.
• Fixed crash in zip extract method (possible CWE-170).
• Fixed a possible double free in imap extension.
• Fixed possible flaw in open_basedir (CVE-2010-3436).
• Fixed NULL pointer dereference in ZipArchive::getArchiveComment. (CVE-2010-3709).
• Fixed bug #52929 (Segfault in filter_var with FILTER_VALIDATE_EMAIL with large amount of data).
• Key enhancements in PHP 5.2.15 include:
• Fixed bug #47643 (array_diff() takes over 3000 times longer than php 5.2.4).
• Fixed bug #44248 (RFC2616 transgression while HTTPS request through proxy with SoapClient object).

What is new in version 5.3.4:

• Security Enhancements and Fixes in PHP 5.3.4:
• Fixed crash in zip extract method (possible CWE-170).
• Paths with NULL in them (foo�bar.txt) are now considered as invalid (CVE-2006-7243).
• Fixed a possible double free in imap extension (Identified by Mateusz Kocielski). (CVE-2010-4150).
• Fixed NULL pointer dereference in ZipArchive::getArchiveComment. (CVE-2010-3709).
• Fixed possible flaw in open_basedir (CVE-2010-3436).
• Fixed MOPS-2010-24, fix string validation. (CVE-2010-2950).
• Fixed symbolic resolution support when the target is a DFS share.
• Fixed bug #52929 (Segfault in filter_var with FILTER_VALIDATE_EMAIL with large amount of data) (CVE-2010-3710).
• Key Bug Fixes in PHP 5.3.4 include:
• Added stat support for zip stream.
• Added follow_location (enabled by default) option for the http stream support.
• Added a 3rd parameter to get_html_translation_table. It now takes a charset hint, like htmlentities et al.
• Implemented FR #52348, added new constant ZEND_MULTIBYTE to detect zend multibyte at runtime.
• Multiple improvements to the FPM SAPI.
• Over 100 other bug fixes.

What is new in version 5.2.13:

• Fixed safe_mode validation inside tempnam() when the directory path does not end with a /).
• Fixed a possible open_basedir/safe_mode bypass in session extension.
• Improved LCG entropy.

What is new in version 5.3.2:

• Security Enhancements and Fixes in PHP 5.3.2:
• Improved LCG entropy. (Rasmus, Samy Kamkar)
• Fixed safe_mode validation inside tempnam() when the directory path does not end with a /). (Martin Jansen)
• Fixed a possible open_basedir/safe_mode bypass in the session extension identified by Grzegorz Stachowiak. (Ilia)
• Key Bug Fixes in PHP 5.3.2 include:
• Added support for SHA-256 and SHA-512 to php's crypt.
• Added protection for $_SESSION from interrupt corruption and improved "session.save_path" check.
• Fixed bug #51059 (crypt crashes when invalid salt are given).
• Fixed bug #50940 Custom content-length set incorrectly in Apache sapis.
• Fixed bug #50847 (strip_tags() removes all tags greater then 1023 bytes long).
• Fixed bug #50723 (Bug in garbage collector causes crash).
• Fixed bug #50661 (DOMDocument::loadXML does not allow UTF-16).
• Fixed bug #50632 (filter_input() does not return default value if the variable does not exist).
• Fixed bug #50540 (Crash while running ldap_next_reference test cases).
• Fixed bug #49851 (http wrapper breaks on 1024 char long headers).
• Over 60 other bug fixes.

What is new in version 5.2.12:

• Fixes:
• Fixed unnecessary invocation of setitimer when timeouts have been disabled.
• Fixed crash in com_print_typeinfo when an invalid typelib is given.
• Fixed crash in SQLiteDatabase::ArrayQuery() and QLiteDatabase::SingleQuery() when calling using Reflection.
• Fixed crash when instantiating PDORow and PDOStatement through Reflection.
• Fixed memory leak in openssl_pkcs12_export_to_file().
• Over 50 other bug fixes.
• Security:
• Fixed a safe_mode bypass in tempnam().
• Fixed a open_basedir bypass in posix_mkfifo().
• Added "max_file_uploads" INI directive, which can be set to limit the number of file uploads per-request to 20 by default, to prevent possible DOS via temporary file exhaustion.
• Added protection for $_SESSION from interrupt corruption and improved "session.save_path" check.

What is new in version 5.3.1:

• Added "max_file_uploads" INI directive, which can be set to limit the number of file uploads per-request to 20 by default, to prevent possible DOS via temporary file exhaustion.
• Added missing sanity checks around exif processing.
• Fixed a safe_mode bypass in tempnam().
• Fixed a open_basedir bypass in posix_mkfifo().
• Fixed failing safe_mode_include_dir.

What is new in version 5.2.11:

• Security Enhancements and Fixes in PHP 5.2.11:
• Fixed certificate validation inside php_openssl_apply_verification_policy.
• Fixed sanity check for the color index in imagecolortransparent().
• Added missing sanity checks around exif processing. (Ilia)
• Fixed bug for popen crashes when an invalid mode is passed).
• Key enhancements in PHP 5.2.11 include:
• Fixed regression in cURL extension that prevented flush of data to output defined as a file handle.
• A number of fixes for the FILTER_VALIDATE_EMAIL validation rule
• Fixed bug #49361 (wordwrap() wraps incorrectly on end of line boundaries).
• Fixed bug #48696 (ldap_read() segfaults with invalid parameters)
• Fixed bug #48645 (mb_convert_encoding() doesn't understand hexadecimal html-entities).
• Fixed bug #48619 (imap_search ALL segfaults).
• Fixed bug #48400 (imap crashes when closing stream opened with OP_PROTOTYPE flag).
• Fixed bug #47351 (Memory leak in DateTime).
• Over 60 bug fixes.

What is new in version 5.3.0:

• Removed the experimental RPL (master/slave) functions from mysqli. (Andrey)
• Removed zend.ze1_compatibility_mode. (Dmitry)
• Removed all zend_extension_* php.ini directives. Zend extensions are now always loaded using zend_extension directive. (Derick)
• Removed special treatment of "/tmp" in sessions for open_basedir. Note: This undocumented behaviour was introduced in 5.2.2. (Alexey)
• Removed shebang line check from CGI sapi (checked by scanner). (Dmitry)
• Changed PCRE, Reflection and SPL extensions to be always enabled. (Marcus)
• Changed md5() to use improved implementation. (Solar Designer, Dmitry)
• Changed HTTP stream wrapper to accept any code between and including 200 to 399 as successful. (Mike, Noah Fontes)
• Changed __call() to be invoked on private/protected method access, similar to properties and __get(). (Andrei)
• Changed dl() to be disabled by default. Enabled only when explicitly registered by the SAPI. Currently enabled with cli, cgi and embed SAPIs. (Dmitry)
• Changed opendir(), dir() and scandir() to use default context when no context argument is passed. (Sara)
• Changed open_basedir to allow tightening in runtime contexts. (Sara)
• Changed PHP/Zend extensions to use flexible build IDs. (Stas)
• Changed error level E_ERROR into E_WARNING in Soap extension methods parameter validation. (Felipe)
• Changed openssl info to show the shared library version number. (Scott)
• Changed floating point behaviour to consistently use double precision on all platforms and with all compilers. (Christian Seiler)
• Changed round() to act more intuitively when rounding to a certain precision and round very large and very small exponents correctly. (Christian Seiler)
• Changed session_start() to return false when session startup fails. (Jani)
• Changed property_exists() to check the existence of a property independent of accessibility (like method_exists()). (Felipe)
• Changed array_reduce() to allow mixed $initial (Christian Seiler)
• Improved PHP syntax and semantics
• Added lambda functions and closures. (Christian Seiler, Dmitry)
• Added "jump label" operator (limited "goto"). (Dmitry, Sara)
• Added NOWDOC syntax. (Gwynne Raskind, Stas, Dmitry)
• Added HEREDOC syntax with double quotes. (Lars Strojny, Felipe)
• Added support for using static HEREDOCs to initialize static variables and class members or constants. (Matt)
• Improved syntax highlighting and consistency for variables in double-quoted strings and literal text in HEREDOCs and backticks. (Matt)
• Added "?:" operator. (Marcus)
• Added support for namespaces. (Dmitry, Stas, Gregory, Marcus)
• Added support for Late Static Binding. (Dmitry, Etienne Kneuss)
• Added support for __callStatic() magic method. (Sara)
• Added forward_static_call(_array) to complete LSB. (Mike Lively)
• Added support for dynamic access of static members using $foo::myFunc(). (Etienne Kneuss)
• Improved checks for callbacks. (Marcus)
• Added __DIR__ constant. (Lars Strojny)
• Added new error modes E_USER_DEPRECATED and E_DEPRECATED. E_DEPRECATED is used to inform about stuff being scheduled for removal in future PHP versions. (Lars Strojny, Felipe, Marcus)
• Added "request_order" INI variable to control specifically $_REQUEST behavior. (Stas)
• Added support for exception linking. (Marcus)
• Added ability to handle exceptions in destructors. (Marcus)
• Added compatibility mode in GD, imagerotate, image(filled)ellipse imagefilter, imageconvolution and imagecolormatch are now always enabled. (Pierre)
• Added array_replace() and array_replace_recursive() functions. (Matt)
• Added ReflectionProperty::setAccessible() method that allows non-public property's values to be read through ::getValue() and set through ::setValue(). (Derick, Sebastian)
• Added msg_queue_exists() function to sysvmsg extension. (Benjamin Schulz)
• Added Firebird specific attributes that can be set via PDO::setAttribute() to control formatting of date/timestamp columns: PDO::FB_ATTR_DATE_FORMAT, PDO::FB_ATTR_TIME_FORMAT and PDO::FB_ATTR_TIMESTAMP_FORMAT. (Lars W)
• Added gmp_testbit() function. (Stas)
• Added icon format support to getimagesize(). (Scott)
• Added LDAP_OPT_NETWORK_TIMEOUT option for ldap_set_option() to allow setting network timeout (FR #42837). (Jani)
• Added optional escape character parameter to fgetcsv(). (David Soria Parra)
• Added an optional parameter to strstr() and stristr() for retrieval of either the part of haystack before or after first occurrence of needle. (Johannes, Felipe)
• Added xsl->setProfiling() for profiling stylesheets. (Christian)
• Added long-option feature to getopt() and made getopt() available also on win32 systems by adding a common getopt implementation into core. (David Soria Parra, Jani)
• Added support for optional values, and = as separator, in getopt(). (Hannes)
• Added lcfirst() function. (David C)
• Added PREG_BAD_UTF8_OFFSET_ERROR constant. (Nuno)
• Added native support for asinh(), acosh(), atanh(), log1p() and expm1(). (Kalle)
• Added LIBXML_LOADED_VERSION constant (libxml2 version currently used). (Rob)
• Added JSON_FORCE_OBJECT flag to json_encode(). (Scott, Richard Quadling)
• Added timezone_version_get() to retrieve the version of the used timezone database. (Derick)
• Added 'n' flag to fopen to allow passing O_NONBLOCK to the underlying open(2) system call. (Mikko)
• Added "dechunk" filter which can decode HTTP responses with chunked transfer-encoding. HTTP streams use this filter automatically in case "Transfer-Encoding: chunked" header is present in response. It's possible to disable this behaviour using "http"=>array("auto_decode"=>0) in stream context. (Dmitry)
• Added support for CP850 encoding in mbstring extension. (Denis Giffeler, Moriyoshi)
• Added stream_cast() and stream_set_options() to user-space stream wrappers, allowing stream_select(), stream_set_blocking(), stream_set_timeout() and stream_set_write_buffer() to work with user-space stream wrappers. (Arnaud)
• Added header_remove() function. (chsc at peytz dot dk, Arnaud)
• Added stream_context_get_params() function. (Arnaud)
• Added optional parameter "new" to sybase_connect(). (Timm)
• Added parse_ini_string() function. (grange at lemonde dot fr, Arnaud)
• Added str_getcsv() function. (Sara)
• Added openssl_random_pseudo_bytes() function. (Scott)
• Added ability to send user defined HTTP headers with SOAP request. (Brian J.France, Dmitry)
• Added concatenation option to bz2.decompress stream filter. (Keisial at gmail dot com, Greg)
• Added support for using compressed connections with PDO_mysql. (Johannes)
• Added the ability for json_decode() to take a user specified depth. (Scott)
• Added support for the mysql_stmt_next_result() function from libmysql. (Andrey)
• Added function preg_filter() that does grep and replace in one go. (Marcus)
• Added system independent realpath() implementation which caches intermediate directories in realpath-cache. (Dmitry)
• Added optional clear_realpath_cache and filename parameters to clearstatcache(). (Jani, Arnaud)
• Added litespeed SAPI module. (George Wang)
• Added ext/hash support to ext/session's ID generator. (Sara)
• Added quoted_printable_encode() function. (Tony)
• Added stream_context_set_default() function. (Davey Shafik)
• Added optional "is_xhtml" parameter to nl2br() which makes the function output
  when false and
  when true (FR #34381). (Kalle)
• Added PHP_MAXPATHLEN constant (maximum length of a path). (Pierre)
• Added support for SSH via libssh2 in cURL. (Pierre)
• Added support for gray levels PNG image with alpha in GD extension. (Pierre)
• Added support for salsa hashing functions in HASH extension. (Scott)
• Added DOMNode::getLineNo to get line number of parsed node. (Rob)
• Added table info to PDO::getColumnMeta() with SQLite. (Martin Jansen, Scott)
• Added mail logging functionality that allows logging of mail sent via mail() function. (Ilia)
• Added json_last_error() to return any error information from json_decode(). (Scott)
• Added gethostname() to return the current system host name. (Ilia)
• Added shm_has_var() function. (Mike)
• Added depth parameter to json_decode() to lower the nesting depth from the maximum if required. (Scott)
• Added pixelation support in imagefilter(). (Takeshi Abe, Kalle)
• Added SplObjectStorage::addAll/removeAll. (Etienne)
• Implemented FR #41712 (curl progress callback: CURLOPT_PROGRESSFUNCTION). (sdteffen[at]gmail[dot].com, Pierre)
• Implemented FR #47739 (Missing cURL option do disable IPv6). (Pierre)
• Implemented FR #39637 (Missing cURL option CURLOPT_FTP_FILEMETHOD). (Pierre)
• Fixed an issue with ReflectionProperty::setAccessible(). (Sebastian, Roman Borschel)
• Fixed html_entity_decode() incorrectly converting numeric html entities to different characters with cp1251 and cp866. (Scott)
• Fixed an issue in date() where a : was printed for the O modifier after a P modifier was used. (Derick)
• Fixed exec() on Windows to not eat the first and last double quotes. (Scott)
• Fixed readlink on Windows in thread safe SAPI (apache2.x etc.). (Pierre)
• Fixed a bug causing miscalculations with the "last of month" relative time string. (Derick)
• Fixed bug causing the algorithm parameter of mhash() to be modified. (Scott)
• Fixed invalid calls to free when internal fileinfo magic file is used. (Scott)
• Fixed memory leak inside wddx_add_vars() function. (Felipe)
• Fixed check in recode extension to allow builing of recode and mysql extensions when using a recent libmysql. (Johannes)
• Fixed PECL bug #12794 (PDOStatement->nextRowset() doesn't work). (Johannes)
• Fixed PECL bug #12401 (Add support for ATTR_FETCH_TABLE_NAMES). (Johannes)
• Fixed bug #48696 (ldap_read() segfaults with invalid parameters). (Felipe)
• Fixed bug #48643 (String functions memory issue). (Dmitry)
• Fixed bug #48641 (tmpfile() uses old parameter parsing). (crrodriguez at opensuse dot org)
• Fixed bug #48624 (.user.ini never gets parsed). (Pierre)
• Fixed bug #48620 (X-PHP-Originating-Script assumes no trailing CRLF in existing headers). (Ilia)
• Fixed bug #48578 (Can't build 5.3 on FBSD 4.11). (Rasmus)
• Fixed bug #48535 (file_exists returns false when impersonate is used). (Kanwaljeet Singla, Venkat Raman Don)
• Fixed bug #48493 (spl_autoload_register() doesn't work correctly when prepending functions). (Scott)
• Fixed bug #48215 (Calling a method with the same name as the parent class calls the constructor). (Scott)
• Fixed bug #48200 (compile failure with mbstring.c when --enable-zend-multibyte is used). (Jani)
• Fixed bug #48188 (Cannot execute a scrollable cursors twice with PDO_PGSQL). (Matteo)
• Fixed bug #48185 (warning: value computed is not used in pdo_sqlite_stmt_get_col line 271). (Matteo)
• Fixed bug #48087 (call_user_method() invalid free of arguments). (Felipe)
• Fixed bug #48060 (pdo_pgsql - large objects are returned as empty). (Matteo)
• Fixed bug #48034 (PHP crashes when script is 8192 (8KB) bytes long). (Dmitry)
• Fixed bug #48004 (Error handler prevents creation of default object). (Dmitry)
• Fixed bug #47880 (crashes in call_user_func_array()). (Dmitry)
• Fixed bug #47856 (stristr() converts needle to lower-case). (Ilia)
• Fixed bug #47851 (is_callable throws fatal error). (Dmitry)
• Fixed bug #47816 (pcntl tests failing on NetBSD). (Matteo)
• Fixed bug #47779 (Wrong value for SIG_UNBLOCK and SIG_SETMASK constants). (Matteo)
• Fixed bug #47771 (Exception during object construction from arg call calls object's destructor). (Dmitry)
• Fixed bug #47767 (include_once does not resolve windows symlinks or junctions) (Kanwaljeet Singla, Venkat Raman Don)
• Fixed bug #47757 (rename JPG to JPEG in phpinfo). (Pierre)
• Fixed bug #47745 (FILTER_VALIDATE_INT doesn't allow minimum integer). (Dmitry)
• Fixed bug #47714 (autoloading classes inside exception_handler leads to crashes). (Dmitry)
• Fixed bug #47671 (Cloning SplObjectStorage instances). (Etienne)
• Fixed bug #47664 (get_class returns NULL instead of FALSE). (Dmitry)
• Fixed bug #47662 (Support more than 127 subpatterns in preg_match). (Nuno)
• Fixed bug #47596 (Bus error on parsing file). (Dmitry)
• Fixed bug #47572 (Undefined constant causes segmentation fault). (Felipe)
• Fixed bug #47560 (explode()'s limit parameter odd behaviour). (Matt)
• Fixed bug #47549 (get_defined_constants() return array with broken array categories). (Ilia)
• Fixed bug #47535 (Compilation failure in ps_fetch_from_1_to_8_bytes()). (Johannes)
• Fixed bug #47534 (RecursiveDiteratoryIterator::getChildren ignoring CURRENT_AS_PATHNAME). (Etienne)
• Fixed bug #47443 (metaphone('scratch') returns wrong result). (Felipe)
• Fixed bug #47438 (mysql_fetch_field ignores zero offset). (Johannes)
• Fixed bug #47398 (PDO_Firebird doesn't implements quoter correctly). (Felipe)
• Fixed bug #47390 (odbc_fetch_into - BC in php 5.3.0). (Felipe)
• Fixed bug #47359 (Use the expected unofficial mimetype for bmp files). (Scott)
• Fixed bug #47343 (gc_collect_cycles causes a segfault when called within a destructor in one case). (Dmitry)
• Fixed bug #47320 ($php_errormsg out of scope in functions). (Dmitry)
• Fixed bug #47318 (UMR when trying to activate user config). (Pierre)
• Fixed bug #47243 (OCI8: Crash at shutdown on Windows) (Chris Jones/Oracle Corp.)
• Fixed bug #47231 (offsetGet error using incorrect offset). (Etienne)
• Fixed bug #47229 (preg_quote() should escape the '-' char). (Nuno)
• Fixed bug #47165 (Possible memory corruption when passing return value by reference). (Dmitry)
• Fixed bug #47087 (Second parameter of mssql_fetch_array()). (Felipe)
• Fixed bug #47085 (rename() returns true even if the file in PHAR does not exist). (Greg)
• Fixed bug #47050 (mysqli_poll() modifies improper variables). (Johannes)
• Fixed bug #47045 (SplObjectStorage instances compared with ==). (Etienne)
• Fixed bug #47038 (Memory leak in include). (Dmitry)
• Fixed bug #47031 (Fix constants in DualIterator example). (Etienne)
• Fixed bug #47021 (SoapClient stumbles over WSDL delivered with "Transfer-Encoding: chunked"). (Dmitry)
• Fixed bug #46994 (OCI8: CLOB size does not update when using CLOB IN OUT param in stored procedure) (Chris Jones/Oracle Corp.)
• Fixed bug #46979 (use with non-compound name *has* effect). (Dmitry)
• Fixed bug #46957 (The tokenizer returns deprecated values). (Felipe)
• Fixed bug #46944 (UTF-8 characters outside the BMP aren't encoded correctly). (Scott)
• Fixed bug #46897 (ob_flush() should fail to flush unerasable buffers). (David C.)
• Fixed bug #46849 (Cloning DOMDocument doesn't clone the properties). (Rob)
• Fixed bug #46847 (phpinfo() is missing some settings). (Hannes)
• Fixed bug #46844 (php scripts or included files with first line starting with have the 1st line missed from the output). (Ilia)
• Fixed bug #46817 (tokenizer misses last single-line comment (PHP 5.3+, with re2c lexer)). (Matt, Shire)
• Fixed bug #46811 (ini_set() doesn't return false on failure). (Hannes)
• Fixed bug #46763 (mb_stristr() wrong output when needle does not exist). (Henrique M. Decaria)
• Fixed bug #46755 (warning: use statement with non-compound name). (Dmitry)
• Fixed bug #46746 (xmlrpc_decode_request outputs non-suppressable error when given bad data). (Ilia)
• Fixed bug #46738 (Segfault when mb_detect_encoding() fails). (Scott)
• Fixed bug #46731 (Missing validation for the options parameter of the imap_fetch_overview() function). (Ilia)
• Fixed bug #46711 (cURL curl_setopt leaks memory in foreach loops). (magicaltux [at] php [dot] net)
• Fixed bug #46701 (Creating associative array with long values in the key fails on 32bit linux). (Shire)
• Fixed bug #46681 (mkdir() fails silently on PHP 5.3). (Hannes)
• Fixed bug #46653 (can't extend mysqli). (Johannes)
• Fixed bug #46646 (Restrict serialization on some internal classes like Closure and SplFileInfo using exceptions). (Etienne)
• Fixed bug #46623 (OCI8: phpinfo doesn't show compile time ORACLE_HOME with phpize) (Chris Jones/Oracle Corp.)
• Fixed bug #46578 (strip_tags() does not honor end-of-comment when it encounters a single quote). (Felipe)
• Fixed bug #46546 (Segmentation fault when using declare statement with non-string value). (Felipe)
• Fixed bug #46542 (Extending PDO class with a __call() function doesn't work as expected). (Johannes)
• Fixed bug #46421 (SplFileInfo not correctly handling /). (Etienne)
• Fixed bug #46347 (parse_ini_file() doesn't support * in keys). (Nuno)
• Fixed bug #46268 (DateTime::modify() does not reset relative time values). (Derick)
• Fixed bug #46241 (stacked error handlers, internal error handling in general). (Etienne)
• Fixed bug #46238 (Segmentation fault on static call with empty string method). (Felipe)
• Fixed bug #46192 (ArrayObject with objects as storage serialization). (Etienne)
• Fixed bug #46185 (importNode changes the namespace of an XML element). (Rob)
• Fixed bug #46178 (memory leak in ext/phar). (Greg)
• Fixed bug #46160 (SPL - Memory leak when exception is thrown in offsetSet). (Felipe)
• Fixed bug #46147 (after stream seek, appending stream filter reads incorrect data). (Greg)
• Fixed bug #46127 (php_openssl_tcp_sockop_accept forgets to set context on accepted stream) (Mark Karpeles, Pierre)
• Fixed bug #46115 (Memory leak when calling a method using Reflection). (Dmitry)
• Fixed bug #46110 (XMLWriter - openmemory() and openuri() leak memory on multiple calls). (Ilia)
• Fixed bug #46108 (DateTime - Memory leak when unserializing). (Felipe)
• Fixed bug #46106 (Memory leaks when using global statement). (Dmitry)
• Fixed bug #46099 (Xsltprocessor::setProfiling - memory leak). (Felipe, Rob).
• Fixed bug #46087 (DOMXPath - segfault on destruction of a cloned object). (Ilia)
• Fixed bug #46048 (SimpleXML top-level @attributes not part of iterator). (David C.)
• Fixed bug #46044 (Mysqli - wrong error message). (Johannes)
• Fixed bug #46042 (memory leaks with reflection of mb_convert_encoding()). (Ilia)
• Fixed bug #46039 (ArrayObject iteration is slow). (Arnaud)
• Fixed bug #46033 (Direct instantiation of SQLite3stmt and SQLite3result cause a segfault.) (Scott)
• Fixed bug #45991 (Ini files with the UTF-8 BOM are treated as invalid). (Scott)
• Fixed bug #45989 (json_decode() doesn't return NULL on certain invalid strings). (magicaltux, Scott)
• Fixed bug #45976 (Moved SXE from SPL to SimpleXML). (Etienne)
• Fixed bug #45928 (large scripts from stdin are stripped at 16K border). (Christian Schneider, Arnaud)
• Fixed bug #45911 (Cannot disable ext/hash). (Arnaud)
• Fixed bug #45907 (undefined reference to 'PHP_SHA512Init'). (Greg)
• Fixed bug #45826 (custom ArrayObject serialization). (Etienne)
• Fixed bug #45820 (Allow empty keys in ArrayObject). (Etienne)
• Fixed bug #45791 (json_decode() doesn't convert 0e0 to a double). (Scott)
• Fixed bug #45786 (FastCGI process exited unexpectedly). (Dmitry)
• Fixed bug #45757 (FreeBSD4.11 build failure: failed include; stdint.h). (Hannes)
• Fixed bug #45743 (property_exists fails to find static protected member in child class). (Felipe)
• Fixed bug #45717 (Fileinfo/libmagic build fails, missing err.h and getopt.h). (Derick)
• Fixed bug #45706 (Unserialization of classes derived from ArrayIterator fails). (Etienne, Dmitry)
• Fixed bug #45696 (Not all DateTime methods allow method chaining). (Derick)
• Fixed bug #45682 (Unable to var_dump(DateInterval)). (Derick)
• Fixed bug #45447 (Filesystem time functions on Vista and server 2008). (Pierre)
• Fixed bug #45432 (PDO: persistent connection leak). (Felipe)
• Fixed bug #45392 (ob_start()/ob_end_clean() and memory_limit). (Ilia)
• Fixed bug #45384 (parse_ini_file will result in parse error with no trailing newline). (Arnaud)
• Fixed bug #45382 (timeout bug in stream_socket_enable_crypto). (vnegrier at optilian dot com, Ilia)
• Fixed bug #45044 (relative paths not resolved correctly). (Dmitry)
• Fixed bug #44861 (scrollable cursor don't work with pgsql). (Matteo)
• Fixed bug #44842 (parse_ini_file keys that start/end with underscore). (Arnaud)
• Fixed bug #44575 (parse_ini_file comment line problems). (Arnaud)
• Fixed bug #44409 (PDO::FETCH_SERIALIZE calls __construct()). (Matteo)
• Fixed bug #44173 (PDO->query() parameter parsing/checking needs an update). (Matteo)
• Fixed bug #44154 (pdo->errorInfo() always have three elements in the returned array). (David C.)
• Fixed bug #44153 (pdo->errorCode() returns NULL when there are no errors). (David C.)
• Fixed bug #44135 (PDO MySQL does not support CLIENT_FOUND_ROWS). (Johannes, chx1975 at gmail dot com)
• Fixed bug #44100 (Inconsistent handling of static array declarations with duplicate keys). (Dmitry)
• Fixed bug #43831 ($this gets mangled when extending PDO with persistent connection). (Felipe)
• Fixed bug #43817 (opendir() fails on Windows directories with parent directory unaccessible). (Dmitry)
• Fixed bug #43069 (SoapClient causes 505 HTTP Version not supported error message). (Dmitry)
• Fixed bug #43008 (php://filter uris ignore url encoded filternames and can't handle slashes). (Arnaud)
• Fixed bug #42362 (HTTP status codes 204 and 304 should not be gzipped). (Scott, Edward Z. Yang)
• Fixed bug #41874 (separate STDOUT and STDERR in exec functions). (Kanwaljeet Singla, Venkat Raman Don, Pierre)
• Fixed bug #41534 (SoapClient over HTTPS fails to reestablish connection). (Dmitry)
• Fixed bug #38802 (max_redirects and ignore_errors). (patch by datibbaw@php.net)
• Fixed bug #35980 (touch() works on files but not on directories). (Pierre)

Limitations:

• All PHP users should note that the PHP 5.2 series is NOT supported anymore. All users are strongly encouraged to upgrade to PHP 5.3.x or higher.