diff --git a/NEWS b/NEWS
index 4b0189c7dd5..2ef37ee9b4e 100644
--- a/NEWS
+++ b/NEWS
@@ -21,6 +21,8 @@ PHP                                                                        NEWS
 - Fixed problem preventing startup errors from being displayed. (Marcus)
 - Fixed start-up problem if both SPL and SimpleXML were enabled. The double
   initialization of apache 1.3 was causing problems here. (Marcus, Derick)
+- Fixed bug #27586 (ArrayObject::getIterator crashes with [] assignment). 
+  (Marcus)
 - Fixed bug #27537 (Objects pointing to each other segfaults). (Dmitry)
 - Fixed bug #27338 (memory leak inside tsrm_virtual_cwd.c on win32). (Ilia)
 - Fixed bug #27287 (wddx segfaults during deserialization). (Moriyoshi)
diff --git a/ext/spl/spl_array.c b/ext/spl/spl_array.c
index 679b6e27242..278fd038af8 100755
--- a/ext/spl/spl_array.c
+++ b/ext/spl/spl_array.c
@@ -196,6 +196,11 @@ static void spl_array_write_dimension(zval *object, zval *offset, zval *value TS
 	spl_array_object *intern = (spl_array_object*)zend_object_store_get_object(object TSRMLS_CC);
 	long index;
 
+	if (!offset) {
+		value->refcount++;
+		add_next_index_zval(intern->array, value);
+		return;
+	}
 	switch(Z_TYPE_P(offset)) {
 	case IS_STRING:
 		value->refcount++;