PHP

Core:

• cscript can fail to run on some systems
• Property nullability lost when using multiple property definition
• Code 0 is returned on invalid options
• Delayed variance check involving trait segfaults
• cookie values with spaces fail to round-trip
• Use-after-free when accessing already destructed backtrace arguments

COM:

• Garbage collecting variant objects segfaults

CURL:

• Hypothetical use-after-free in curl_multi_add_handle()

FFI:

• FFI Struct Segfault

IMAP:

• IMAP extension can't find OpenSSL libraries at configure time

Intl:

• NumberFormatter::format() may detect wrong type

Libxml:

• Error in SoapClient ctor disables DOMDocument::save()

MBString:

• SEGV in mb_convert_encoding with non-string encodings

MySQLi:

• Properties may emit a warning on var_dump()

MySQLnd:

• mysqlnd may fetch wrong column indexes with MYSQLI_BOTH
• MySQL caching_sha2_password Access denied for password with more than 20 chars

Opcache:

• Eval class during preload causes class to be only half available
• Preloading segfaults if preload_user is used
• Incorrect type inference for self::$field =& $field

OpenSSL:

• openssl memory leak

Phar:

• Files added to tar with Phar::buildFromIterator have all-access permissions). (
• heap-buffer-overflow in phar_extract_file). (
• PharFileInfo::decompress not working
• Reflection:
• ReflectionClass::isCloneable call reflected class __destruct

Session:

• Null Pointer Dereference in PHP Session Upload Progress). (

Standard:

• Memory leak when using stream_filter_append
• PASSWORD_DEFAULT should match PASSWORD_BCRYPT instead of being null

Testing:

• bug45161.phpt takes forever to finish

XSL:

• callbacks

Zip:

• Add ZipArchive::CM_LZMA2 and ZipArchive::CM_XZ constants (since libzip 1.6.0
• Add ZipArchive::RDONLY (since libzip 1.0.0
• Add ZipArchive::ER_* missing constants
• Add ZipArchive::LIBZIP_VERSION constant
• Wrong return for ZipArchive::addEmptyDir Method