PHP 8.4.24 변경 기록과 적용 점검

PHP 8.4.24 변경 사항

공식 php-src 태그의 NEWS에서 이 버전의 항목만 추출했습니다. 아래 구성요소와 확인 순서는 원문에 따라 자동 구성됩니다. 애플리케이션 호환성이나 취약점 영향 여부를 판정하지 않습니다.

변경된 구성요소

BCMath · Calendar · Date · DBA · DOM · Exif · GD · Hash · Intl · ODBC · OpenSSL · PDO_ODBC · PGSQL · Phar · PHPDBG · Reflection · Session · SPL · Standard · Streams · Zip

원문에 명시된 CVE

• CVE-2026-17544
• CVE-2026-9672
• CVE-2026-17543
• CVE-2026-7260

사용 환경별 확인 순서

• php -v와 php -m으로 실제 실행 버전과 확장 목록을 확인하고 아래 원문에서 사용 중인 구성요소의 변경을 찾으세요.
• composer check-platform-reqs로 설치 환경의 요구사항을 확인하세요. 성공하더라도 동작 호환성까지 보장하지는 않습니다.
• 날짜·시간대를 사용한다면 Carbon 및 날짜 변환 테스트에서 변경 항목과 관련된 입력을 점검하세요.
• PDO를 사용한다면 실제 데이터베이스 드라이버로 조회·트랜잭션 테스트를 실행하세요.
• PostgreSQL을 사용한다면 해당 확장과 드라이버의 쿼리 처리를 점검하세요.
• TLS 연결을 사용한다면 외부 API·메일 서버 연결과 인증서 검증을 점검하세요.
• GD를 사용한다면 이미지 업로드·리사이즈 처리를 실제 파일로 확인하세요.
• BCMath를 사용한다면 금액·정밀도·부호 경계값의 계산 결과를 확인하세요.
• 배포 전 스테이징에서 애플리케이션 테스트를 실행하고, 배포 후 웹 프로세스와 큐 워커가 새 PHP를 사용하는지 확인하세요.

공식 변경 기록

30 Jul 2026, PHP 8.4.24

• BCMath: . Fixed GHSA-x692-q9x7-8c3f (Out-of-bounds write in bccomp()). (CVE-2026-17544) (Recep Asan)

• Calendar: . Fixed bug GH-22602 (gregoriantojd() and juliantojd() integer overflow with INT_MAX year). (arshidkv12)

• Date: . Update timelib to 2022.17. (Derick) . Fixed bug GH-19803 (Parsing a string with a single white space does create an error). (Derick) . Fixed Unix timestamps in February of the year 0 are misparsed with @-notation. (LukasGelbmann) . Fixed bug GH-11310 (__debugInfo does nothing on userland classes extending Date classes). (Derick)

• DBA: . Fixed OOB read on malformed length field in dba flatfile handler. (alhudz)

• DOM: . Fixed bug GH-22570 (Stack overflow when serializing a deeply nested Dom\XMLDocument). (iliaal)

• Exif: . Fixed bug GH-11020 (exif_read_data() emits a spurious "Illegal IFD size" warning when an IFD is not followed by a next-IFD offset). (Eyüp Can Akman)

• GD: . Upgrade libgd. (CVE-2026-9672) (Pierre Joye)

• Hash: . Fixed bug GH-18173 (ext/hash relies on implementation-defined malloc alignment). (iliaal)

• Intl: . Fixed Locale::lookup() and locale_lookup() to return NULL instead of the fallback locale when a language tag cannot be canonicalized. (Weilin Du) . Fixed memory leaks when calling Collator::__construct() or Spoofchecker::__construct() twice. (Weilin Du) . Fixed IntlChar methods leaving stale global error state after successful calls. (Xuyang Zhang)

• ODBC: . Fixed bug GH-22668 (Heap buffer over-read when a column value exceeds the driver-reported display size). (iliaal)

• OpenSSL: . Fixed timeout for supplemental read at end of a blocking stream in SSL stream wrapper. (ilutov)

• PDO_ODBC: . Fixed bug GH-20726 (Crash with ODBC connection pooling when the DSN carries no credentials). (iliaal) . Fixed bug GH-22667 (Heap buffer over-read when a column value exceeds the driver-reported display size). (iliaal) . Fixed bug GH-22666 (Heap buffer overflow when an output parameter value is longer than the declared maxlen). (iliaal) . Fixed bug GH-22665 (Out-of-bounds write when the ODBC driver reports a diagnostic message length beyond the error buffer). (iliaal)

• PGSQL: . Fixed GHSA-7qpv-r5mr-78m4 (SQL injection via E'...' backslash breakout). (CVE-2026-17543) (ilutov)

• Phar: . Fixed inconsistent handling of the magic ".phar" directory. Paths such as "/.phar" remain protected, while non-magic paths that merely start with ".phar" are handled consistently across file and directory creation, copying, ArrayAccess, stream lookup, directory iteration and extraction. (Weilin Du) . Fixed GHSA-vc5h-9ppw-p5f3 (Crash via recursive symlinks). (CVE-2026-7260) (Jakub Zelenka)

• PHPDBG: . Fixed bug GH-17387 (Trivial crash in phpdbg lexer). (iliaal) . Fixed fleaked lowercased lookup keys in phpdbg_resolve_opline_break. (jorgsowa) . Fixed off-by-one in phpdbg_safe_class_lookup() causing class lookups to always fail during phpdbg's signal-safe interruption path. (jorgsowa)

• Reflection: . Fixed bug GH-22324 (Ignore leading namespace separator in ReflectionParameter::__construct()). (jorgsowa) . Fixed bug GH-22441 (ReflectionClass::hasProperty() and getProperty() ignore dynamic properties shadowing a private parent property). (iliaal) . Fixed bug GH-22658 (ReflectionConstant::__toString() with a string value with null bytes truncates output). (DanielEScherzer) . Fixed bug GH-22681 (Reflection*::__toString() truncates on null bytes). (DanielEScherzer)

• Session: . Fixed bug GH-21314 (Different session garbage collector behavior between PHP 8.3 and PHP 8.5). (jorgsowa)

• SPL: . Fix class_parents for classes with leading slash in non-autoload mode. (jorgsowa) . Ignore leading back-slash in class_parents(), class_implements(), and class_uses(). (jorgsowa) . Fixed bug GH-16217 (SplFileObject::fputcsv() on an uninitialized object segfaults). (iliaal)

• Standard: . Fixed bug GH-22360 (convert.base64-encode corruption on incremental flush). (David Carlier) . Fixed bug GH-22395 (base_convert() outputs at most 64 characters). (Weilin Du) . Fixed integer overflow in getimagesize() and getimagesizefromstring() when parsing an IFF chunk with a size of INT_MAX. (David Carlier, Weilin Du) . Fixed bug GH-22678 (Use-after-free in array_multisort() when the comparator mutates the array being sorted). (azchin, iliaal)

• Streams: . Fixed bug GH-22617 (persistent stream keys truncated at null bytes, causing distinct abstract unix domain sockets to share a resource). (David Carlier)

• Zip: . Fixed bug GH-22649 (ZipArchive::setCommentName() and setCommentIndex() could crash after overwriting an entry and resetting its inherited unchanged comment). (Weilin Du) . Fixed bug GH-21705 (ZipArchive::getFromIndex() ignores ZipArchive::FL_UNCHANGED for deleted entries). (Weilin Du)

출처

PHP 8.4.24 공식 NEWS · 현재 PHP 지원 일정

원문에 없는 지원 종료일, CVE, Laravel 호환성 결론은 자동으로 추가하지 않습니다.