[Feature] PHP 8.4.27/8.5.12 运行环境存在 SimpleXML 崩溃回归（php-src#24488），建议先打官方已批准的一行补丁 / SimpleXML regression in 8.4.27/8.5.12 runtimes #14162

1Panel Version

N/A: applies to any 1Panel version using the PHP 8.4.27 / 8.5.12 runtime images (不限 1Panel 版本)

Please describe your needs or suggestions for improvements

中文： PHP 10 月 21 日的安全更新（8.4.27 / 8.5.12）引入了一个 SimpleXML 回归：当 SimpleXML 对象处于循环引用中被垃圾回收时，其属性表会被重复释放，PHP 进程崩溃并报 zend_mm_heap corrupted。常见代码如 json_decode(json_encode($xml), true) 即可触发：php/php-src#24488 。8.3.36 和 8.2.35 不受影响。刚为 php2shell 升级的用户可能因此遇到网站崩溃，甚至回滚到有漏洞的版本。

English: The 21 October security release (8.4.27 / 8.5.12) introduced a SimpleXML regression: the GC double-frees the properties table of SimpleXML objects in a reference cycle, crashing the worker with zend_mm_heap corrupted (php-src#24488). 8.3.36 and 8.2.35 are not affected. Users who just upgraded for php2shell may hit crashes and roll back to a vulnerable version.

Please describe the solution you suggest

中文： 官方修复是 ext/simplexml/simplexml.c 中的一行改动（zend_array_release() 替代 zend_hash_release()），已获核心开发者批准但尚未发布：php/php-src#24494 。建议在 1Panel 的 PHP 8.4 / 8.5 运行环境镜像中先带上这个补丁，直到官方下一个版本发布。

English: The official fix is a one-line change in ext/simplexml/simplexml.c, approved by a core developer but not yet released (php-src#24494). Suggest carrying it in 1Panel's PHP 8.4 / 8.5 runtime images until the next upstream release.

Additional Information

中文： 另外，对于无法获得官方 php2shell 修复的旧版 PHP（5.4–8.1），我们（比利时托管商 Hosted Power，利益相关说明）开源了一个扩展，可在不重新编译 PHP 的情况下复刻官方修复，同时也覆盖上述 SimpleXML 问题：https://github.com/HOSTED-POWER/php_uploadprogress_guard

English: For old PHP versions without an official php2shell fix, our open-source extension (disclosure: we maintain it) mirrors the official fix without rebuilding PHP, and also covers the SimpleXML issue above.