剛剛PHP組織的官方網站緊急釋出了PHP 4.4.2，是因應安全性的問題與改善bug而推出，除了解決包括XSS等重要的漏洞外，也另外修正了30項以上的bugs與提高對Apache 2的相容度。PHP方面鼓勵所有使用PHP4的網站立刻下載以進行更新，以免受到影響。
主要修正的安全性問題為：
Prevent header injection by limiting each header to a single line.
Possible XSS inside error reporting functionality.
Missing safe_mode/open_basedir checks into cURL extension.
Apache 2 regression with sub-request handling on non-Linux systems.
key() and current() regression related to references.
詳細的bug修正與更新內容列表如下：
Added missing safe_mode/open_basedir checks into cURL extension.
Backported missing imap_mailcompose() fixes from PHP 5.x.
Prevent header injection by limiting each header to a single line.
Fixed possible XSS inside error reporting functionality.
Fixed Apache 2 regression with sub-request handling on non-linux systems.
Fixed bug #35817 (unpack() does not decode odd number of hexadecimal values).
Fixed bug #35735 ($EGREP not defined in configure).
Fixed bug #35669 (imap_mail_compose() crashes with multipart-multiboundary-email).
Fixed bug #35655 (whitespace following end of heredoc is lost).
Fixed bug #35646 (%{mod_php_memory_usage}n is not reset after exit).
Fixed bug #35594 (Multiple calls to getopt() may result in a crash).
Fixed bug #35571 (Fixed crash in Apache 2 SAPI when more then one php script is loaded via SSI include).
Fixed bug #35536 (mysql_field_type() doesn't handle NEWDECIMAL).
Fixed bug #35410 (wddx_deserialize() doesn't handle large ints as keys properly).
Fixed bug #35341 (Fix for bug #33760 breaks build with older curl).
Fixed bug #35278 (Multiple virtual() calls crash Apache 2 php module).
Fixed bug #35257 (Calling ob_flush after creating an ob callback causes segfault).
Fixed bug #35079 (stream_set_blocking(true) toggles, not enables blocking).
Fixed bug #35078 (configure does not find ldap_start_tls_s).
Fixed bug #35071 (Wrong fopen mode used in GD safe-mode checks).
Fixed bug #35067, Fixed bug #35063 (key(),current() need to work by reference).
Fixed bug #35062 (socket_read() produces warnings on non blocking sockets).
Fixed bug #35059 (Apache2 crash with mod_rewrite).
Fixed bug #35009 (ZTS: Persistent resource destruct crashes when extension is compiled as shared).
Fixed bug #34996 (ImageTrueColorToPalette() crashes when ncolors is zero).
Fixed bug #34851 (SO_RECVTIMEO and SO_SNDTIMEO socket options expect integer parameter on Windows).
Fixed bug #34830 (the 5th argument of mb_send_mail does not work).
Fixed bug #34359 (Possible crash inside fopen http wrapper).
Fixed bug #33963 (mssql_bind() fails on input parameters).
Fixed bug #33760 (cURL needs CRYPTO_callback functions to prevent locking).
Fixed bug #33720 (mb_encode_mimeheader does not work for multibyte chars).
Fixed bug #33523 (Memory leak in xmlrpc_encode_request()).
Fixed bug #33201 (Crash when fetching some data types).
Fixed bug #33153 (crash in mssql_next result).
Fixed bug #32009 (crash when mssql_bind() is called more than once).
Fixed bug #31971 (ftp_login fails on some SSL servers).
Fixed bug #30760 (Remove MessageBox on win32 for E_CORE errors if display_startup_error is off).
Fixed bug #27678 (number_format() crashes with large numbers).
