PHP 8.4.27 and 8.5.12: check the SimpleXML crash

Developers whose automated tests or PHP workers began crashing after the October 21 update have a specific bug introduced by the update to investigate. PHP’s maintainers marked issue GH-24488 verified. The report identifies PHP 8.4.27 and 8.5.12 and involves SimpleXML, PHP’s extension for working with XML data.

Match the failure before changing PHP

The original reporter described Laravel/Pest test-worker crashes with zend_mm_heap corrupted. The reported trigger needs PHP to build a table of the XML object’s properties, for example when code converts it to an array or JSON. PHP must also free a circular set of objects that can still refer to that XML object. Its memory cleanup can then free the same data twice. Ordinary property access or a foreach loop alone does not trigger the reported failure. See the verified bug report.

That error message can have other causes. Ask the developer to identify the failing task and whether it uses SimpleXML before assigning the failure to this bug.

Check what your supplier has shipped

PHP committed the correction, f963484, on October 22 at 12:24 UTC. The proposed pull request was closed after the change was committed separately.

The PHP 8.4 development notes list GH-24488 under an undated 8.4.28 entry. The PHP 8.5 source branch also contains the corrected cleanup code. These are development records.

At our October 23 check, PHP’s stable source downloads still listed 8.4.27 and 8.5.12. Ask your host or package supplier whether it carries GH-24488 or the same correction applied to its own build, and which complete package revision or container image includes it. A supplier can add a correction without changing PHP’s short version number.

Keep the security fixes in your repair

The chosen repair must retain the fixes for CVE-2026-109618 and CVE-2026-109619. PHP’s October 21 security advisory names 8.2.35, 8.3.36, 8.4.27 and 8.5.12 as the original fixed releases. Have the operator arrange a supported build that addresses both the security issues and the matching crash.

Send the supplier a focused failure report:

• The failed application task, its time and the relevant error log.
• The PHP executable used by that task, complete package or image identifier, and loaded extensions.
• Whether the failure came from command-line tests or a website worker, plus the developer’s SimpleXML findings.
• A request for the supplier’s GH-24488 fix status and a supported replacement build.

Keep that build identifier with the change record. After the repair, repeat the task that failed and the site’s agreed application checks. Use the PHP update recovery guide if the logs point to another cause.