PHP 8.4.22 Release - JIT Stability and Memory Fixes

The PHP project released version 8.4.22 on June 4, 2026. This point release focuses on stabilizing the tracing JIT engine and fixing memory management issues in several core extensions.

The full release notes and downloads are on the GitHub release page.

The tracing JIT engine received two critical fixes in this version. The project resolved a crash that occurred when a VM interrupt was handled during an observed user function call. This type of failure is particularly difficult to debug in production because it depends on the timing of external signals or internal timer interrupts relative to the execution of specific PHP bytecodes.

Additionally, an assertion failure in the tracing JIT code was addressed. This issue was tracked as GH-22004 and involved logic within ext/opcache/jit/zend_jit_trace.c. For operators running high performance workloads, these fixes are essential. An assertion failure in the JIT engine typically leads to an immediate process abort. In a PHP FPM environment, this results in a 502 Bad Gateway error for the end user and requires the manager process to spawn a new worker. Stabilizing the tracing JIT engine ensures that the performance benefits of machine code execution do not come at the cost of service availability.

Several extensions received bug fixes related to memory safety and stability. The MySQLnd extension now correctly handles memory management for persistent connection attributes. Specifically, the project fixed a persistent free of a non persistent connection attribute key. This change prevents memory corruption in environments that rely heavily on persistent database connections to reduce latency.

The Standard PHP Library (SPL) received significant attention. A memory leak was fixed in SplFixedArray::setSize. This leak occurred when a destructor caused the array to grow during a clear operation. For data engineering tasks that process large datasets in memory using fixed arrays, such leaks can eventually lead to OOM kills of long running scripts.

Another critical fix in SPL addresses a use after free vulnerability in MultipleIterator when handling self freeing children. This was tracked as GH-21933. Use after free bugs are serious as they can lead to unpredictable behavior or security vulnerabilities. The Intl extension also received updates to correct argument position errors in out of bounds messages for calendar methods and to expose Spoofchecker restriction level APIs across all supported ICU versions. These updates improve the reliability of internationalization logic in high volume applications.

The core date handling logic now avoids an integer overflow in the internal php_date_llabs function. This fix, tracked as GH-18422, ensures correct date calculations for edge cases on 64 bit systems where large timestamp values are processed. The standard library also saw a fix for version_compare where version strings ending with a dot were incorrectly handled, as seen in GH-21689.

For security and future proofing, the project improved compatibility with OpenSSL 4.0. While many production systems still run OpenSSL 1.1 or 3.0, the move toward 4.0 is ongoing in many rolling release distributions. Ensuring that the PHP core and the OpenSSL extension can compile and run against the 4.0 headers is a vital step for platform longevity. The project also resolved an inconsistency in ip2long regarding leading zeros on the AIX platform, demonstrating continued support for diverse operating systems.

This is a bug fix release and does not introduce breaking changes. Operators should be able to upgrade from earlier 8.4 versions without modifying application code. We recommend testing the tracing JIT engine in a staging environment if you rely on it for production traffic. Database connection pools should also be monitored for any change in memory consumption after the update due to the MySQLnd fix.