PHP shipped 8.5.9 alongside a security update for the older 8.2 branch (8.2.33), synchronizing patches across both actively maintained lines the same way MySQL and other mature open-source projects do for critical fixes. The release addresses several concrete vulnerabilities: a stack-based out-of-bounds write in the ext/bcmath arbitrary-precision math extension, a SQL injection vector in the pgsql extension triggered by backslash character handling in certain query contexts, a crash triggered by circular symlinks when using PHP's Phar archive handling, and a vulnerability in the bundled libgd image library. Two CVEs were specifically called out: an integer overflow in the gregoriantojd() and juliantojd() calendar conversion functions, and an issue in ext/hash tied to how the extension relies on implementation-defined memory alignment behavior from malloc, which could behave unpredictably across different platforms and compilers. None of these are exotic edge cases — bcmath and pgsql in particular are used directly in everyday PHP applications doing financial calculations or querying Postgres databases, so the SQL injection fix especially is worth prioritizing for any team running PHP against a Postgres backend. PHP 8.5 remains under active support until the end of 2029, so this is a routine but non-optional patch cycle rather than a sign the branch is winding down; teams still on 8.2 get the same security coverage without needing to jump to a newer major version immediately.