Wingetlywingetly
← All apps

PHP 8.3

by PHP Groupv8.3.32

Last updated

PHP 8.3

Visit homepage

Install with winget

$ winget install --id PHP.PHP.8.3 --exact --version 8.3.32

Run in Command Prompt, PowerShell, or Windows Terminal. Prompts for any agreements.

Built by Pckgr

For Intune admins

Stop chasing app updates. Pckgr patches them for you.

Automated application patching for Microsoft Intune. Pckgr keeps a curated library of 1,000+ apps continuously up-to-date in your tenant via Microsoft Graph - no manual repackaging, no chasing vendor sites.

Start free 30-day trial

No credit card required.

About

PHP (recursive acronym for PHP: Hypertext Preprocessor) is a widely-used open source general-purpose scripting language that is especially suited for web development and can be embedded into HTML.

Installers · v8.3.32

ArchitectureTypeScopeInstallDownload
x86ZIP
archive
-Direct
x64ZIP
archive
-Direct

Copy a command tailored to that specific architecture, type, and scope - useful when winget would otherwise pick a different default.

Security

25 known CVEs via NVD

  • medium5.5Fix in v8.3.33CVE-2026-7260affects before 8.2.33, 8.3.33, 8.4.24, 8.5.9Jul 30, 2026

    Circular symbolic links in phar archives could lead to unbounded recursion, exhausting the C stack and crashing the PHP process, in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.

    Vendor advisory
  • critical9.8Patched in wingetCVE-2026-17544affects before 8.4.24, 8.5.9Jul 30, 2026

    Attacker-provided inputs to bccomp() could lead to an out-of-bounds write with stack and heap corruption in PHP versions from 8.4.* before 8.4.24 and from 8.5.* before 8.5.9.

    Vendor advisory
  • critical9.8Fix in v8.3.33CVE-2026-17543affects before 8.2.33, 8.3.33, 8.4.24, 8.5.9Jul 30, 2026

    Improper escaping of backslashes in attacker-provided parameters would allow for trivial SQL injection in PHP versions from 8.2.* before 8.2.33, from 8.3.* before 8.3.33, from 8.4.* before 8.4.24, and from 8.5.* before 8.5.9.

    Vendor advisory
  • medium5.6Patched in wingetCVE-2026-14355affects before 8.2.32, 8.3.32, 8.4.23, 8.5.8Jul 3, 2026

    In PHP versions 8.2.* before 8.2.32, 8.3.* before 8.3.32, 8.4.* before 8.4.23, 8.5.* before 8.5.8, the AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw. The output buffer for the AES key-wrap-with-padding operation is sized from the pl...

    Vendor advisory
  • high7.5Patched in wingetCVE-2026-7263affects before 8.4.21, 8.5.6May 10, 2026

    In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, DOMNode::C14N() method may process the XML data incorrectly, causing a circular linked list in the data structure representing the XML document. This may cause subsequent processing of the XML document to enter infinite...

    Vendor advisory
  • critical9.1Patched in wingetCVE-2026-6104affects before 8.4.21, 8.5.6May 10, 2026

    In PHP versions 8.4.* before 8.4.21 and 8.5.* before 8.5.6, when an encoding name containing an embedded NUL byte is passed to mb_convert_encoding() or related mbstring functions, the code incorrectly assumes that when strncasecmp() returns 0 it means the strings have the same l...

    Vendor advisory
  • high7.5Patched in wingetCVE-2026-7568affects before 8.2.31, 8.3.31, 8.4.21, 8.5.6May 10, 2026

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the metaphone() function in ext/standard/metaphone.c uses a signed int variable to track the current position within the input string. If a string longer than 2,147,483,647 byt...

    Vendor advisory
  • high7.5Patched in wingetCVE-2026-7262affects before 8.2.31, 8.3.31, 8.4.21, 8.5.6May 10, 2026

    In PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, when a SOAP server has a typemap configured, the decoding process contains a mistake which checks the wrong variable in case of missing value element.  This leads to dereferenc...

    Vendor advisory
Showing 8 of 25. Source: NVD, updated 6h ago. Patch status is best-effort: NVD's fix version is compared against the latest version in winget, but the two version formats don't always align. Confirm with the vendor advisory before treating any specific build as safe.

See a CVE that affects your fleet? Push the patched version to Intune in one click with Pckgr - automated patching is the only way to keep up.

Related apps

  • PHP 8.4PHP Group
    PHP.PHP.8.4v8.4.24

    PHP 8.4

  • PHP 8.1 - Non-thread safePHP Group
    PHP.PHP.NTS.8.1v8.1.34

    PHP 8.1 - Non-thread safe

  • PHP 8.3 - Non-thread safePHP Group
    PHP.PHP.NTS.8.3v8.3.31

    PHP 8.3 - Non-thread safe

  • PHP 8.5 - Non-thread safePHP Group
    PHP.PHP.NTS.8.5v8.5.8

    PHP 8.5 - Non-thread safe

  • PHP 8.4 - Non-thread safePHP Group
    PHP.PHP.NTS.8.4v8.4.22

    PHP 8.4 - Non-thread safe

  • PHP 8.1PHP Group
    PHP.PHP.8.1v8.1.34

    PHP 8.1

More from PHP Group or browse php, php83.

Frequently asked questions

How do I install PHP 8.3 on Windows?
Open Windows Terminal, PowerShell, or Command Prompt and run: winget install --id PHP.PHP.8.3 --exact --version 8.3.32. winget downloads the installer from PHP Group and runs it. Requires Windows 10 (1809+) or Windows 11.
How do I install PHP 8.3 silently for unattended deployment?
Add --silent and accept the agreements upfront: winget install --id PHP.PHP.8.3 --exact 8.3.32 --silent --accept-package-agreements --accept-source-agreements. This is the variant Intune, Configuration Manager, and other deployment tools should use.
How do I uninstall PHP 8.3 via winget?
Run: winget uninstall --id PHP.PHP.8.3 --exact. Add --silent for unattended uninstalls. winget will use the registered uninstaller from PHP 8.3's Apps & Features entry.
Is PHP 8.3 free?
PHP 8.3 is distributed under PHP License v3.01. Refer to the publisher (https://php.net) for the full license terms - Wingetly itself does not charge for installation.
Does PHP 8.3 work on Windows 10?
Yes, as long as your Windows 10 build supports winget (1809 or newer). winget ships with App Installer on Windows 10/11 and pulls PHP 8.3 directly from the publisher.
How do I keep PHP 8.3 up to date?
Run winget upgrade --id PHP.PHP.8.3 --exact, or winget upgrade --all to update everything winget tracks. We index 3 versions of PHP 8.3 from microsoft/winget-pkgs.

Recent versions

  • 8.3.32latest
  • 8.3.31
  • 8.3.30