This fixes:
- CVE-2025-14179
- CVE-2026-6104
- CVE-2026-6722
- CVE-2026-6735
- CVE-2026-7258
- CVE-2026-7262
- CVE-2026-7568
- CVE-2026-12184
- CVE-2026-14355
Full upstream changelogs:
https://www.php.net/ChangeLog-8.php#8.4.17
https://www.php.net/ChangeLog-8.php#8.4.18
https://www.php.net/ChangeLog-8.php#8.4.19
https://www.php.net/ChangeLog-8.php#8.4.20
https://www.php.net/ChangeLog-8.php#8.4.21
https://www.php.net/ChangeLog-8.php#8.4.22
https://www.php.net/ChangeLog-8.php#8.4.23
Signed-off-by: Michael Heimpold <redacted>
include $(TOPDIR)/rules.mk
PKG_NAME:=php
-PKG_VERSION:=8.4.16
-PKG_RELEASE:=4
+PKG_VERSION:=8.4.23
+PKG_RELEASE:=1
PKG_MAINTAINER:=Michael Heimpold <mhei@heimpold.de>
PKG_LICENSE:=PHP-3.01
PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
PKG_SOURCE_URL:=https://www.php.net/distributions/
-PKG_HASH:=f66f8f48db34e9e29f7bfd6901178e9cf4a1b163e6e497716dfcb8f88bcfae30
+PKG_HASH:=1ab9f52008414e43bb2427ffa288eff2a4de39e1a830f957e800ba368d887a72
PKG_BUILD_PARALLEL:=1
PKG_BUILD_FLAGS:=no-mips16
--- a/ext/date/php_date.c
+++ b/ext/date/php_date.c
-@@ -566,6 +566,23 @@ static const char* guess_timezone(const
+@@ -560,6 +560,23 @@ static const char* guess_timezone(const
} else if (*DATEG(default_timezone)) {
return DATEG(default_timezone);
}