PHP 8.6.0RC1: Downloads, Changelog, News

Release Information

Release
8.6.0RC1
PHP Version
PHP 8.6
Release Date
Release Type
Security Update
Release Status
QA Release
Branch Status
Upcoming Release

PHP 8.6 is a development version, and is not recommended for production use. PHP 8.6 is scheduled to reach General Availability on 2026-11-19.
PHP 8.6.0RC2 is the latest QA release in PHP 8.6.

Downloads

Source Code

Git Clone
Use Git to clone the 8.6.0RC1 tag from the PHP Git repository.
git clone https://github.com/php/php-src.git --depth 1 --branch php-8.6.0RC1
How to compile PHP
PHP can be compiled by setting up the dependencies, building the configure script (./buildconf), configuring the build ./configure, and running make.
Detailed articles on how to compile PHP are available for Ubuntu/Debian based systems and Fedora/RHEL based systems.

Docker/Podman Containers

PHP CLI
PHP CLI Containers images only include the PHP CLI, and no FPM or Apache modules. The Alpine builds are lightweight, but may introduce incompatibilities due to their musl builds. Albeit their larger size, the Debian-based (without the "-alpine" suffix) images are more complete, and widely used.

Alpine-based: Lightweight, but may introduce incompatibilities due to their musl builds.
docker pull php:8.6.0RC1-cli-alpine

Debian-based: More compatible with other components, complete, and are widely used.
docker pull php:8.6.0RC1-cli
PHP CLI + Web Server Integration
These container images include PHP CLI, and a web server integration. FPM container images can be integrated with web servers such as Nginx, Caddy, and Apache with Event MPM. The Apache container images include Apache web server, integrating PHP as an Apache module.

Alpine-based: Lightweight, but may introduce incompatibilities due to their musl builds.
docker pull php:8.6.0RC1-fpm-alpine

Debian-based ZTS Apache: Includes Apache web server integrating PHP as an Apache module.
docker pull php:8.6.0RC1-apache

Debian-based NTS FPM: PHP-FPM, can be integrated with Nginx, Caddy, and other web servers over Fast CGI.
docker pull php:8.6.0RC1-fpm

Commit List

Alexander Danilov

  • md5, sha1, openssl - using zend_bin2hex instead of local helper in GH-23819

Alexandre Daubois

Arnaud Le Blanc

  • Fix GH-21999: GC inconsistency after lazy object properties ht is added to roots in GH-22013

Arshid

  • ext/date: Change return type to static in GH-23317

Calvin Buckley

Chris Brown

Daniel Scherzer

  • ext/mysqlnd: add a hardening assertion that the fetch callback is set in GH-23716
  • CLI server: add regression tests for "Host" header reflection in 5bebadbc89
  • CLI server: remove "Host" header reflection from response in ed8ff1ec53
  • CLI server: document "Host" header reflection removal in UPGRADING in 1f1d223bc0

David Carlier

  • ext/zip: ZipArchive::extractTo() ignores files given in a non-list array in 214ed7eb93
  • ext/spl: SplDoublyLinkedList::serialize() use-after-free on element removal in daf076548b
  • Fix GH-23365: DOMNode::insertBefore() drops the node used as its own reference in a7bdb8b53d
  • ext/sockets: socket_select() silent set truncation on Windows in 2bca736479
  • ext/xsl: XSLTProcessor::importStylesheet() use-after-free during a transformation in b55c619356
  • ext/zip: ZipArchive::close() use-after-free from a progress or cancel callback in 132403de39
  • Fix GH-23729: DOMXPath::__construct() use-after-free during an evaluation in a74f826ff2

David CARLIER

  • ext/posix: revert posix_access() flags validation. in GH-23710

Derick Rethans

geeknik

  • Fix heap-buffer-overflow in convert stream filters with NUL in line-break-chars in b4e3397ec8

Gina Peter Banyard

  • Zend: deprecate using "_" as a class and constant name in GH-23615
  • Zend/exception.c: improve getTraceAsString() method call setup in GH-23665
  • ext/soap: Use bool type instead of int type for functions_all field in 8b1668d842
  • intl: refactor php_converter_resolve_callback() in GH-23666
  • Zend: deprecate is and let as identifiers in GH-23709
  • Zend: reorganise some type declarations tests in 6d910200db
  • Zend: fix OSS-Fuzz 532353396, static is a built-in type in 8d38af63ce
  • tree: Drop FCI.object assignment if we have an FCC in GH-23739
  • ext/curl: remove XFAIL section for tests that are fixed in GH-22460

Ilia Alshanetsky

  • dom: clear the xpath callback registrations before freeing them in 21e2c56aa4
  • iconv: keep working converter when stream filter seek reset fails in GH-23594
  • dom: report the xpath callback node list to the cycle collector in GH-23596
  • ext/intl: Preserve PHP-side state when cloning formatters in 0f20be3867
  • TSRM: roll back id_count when the resource type table cannot grow in GH-23595
  • ext/pgsql: Restore binary-safe pg_lo_write() in c135a869c1
  • ext/intl: Resolve UConverter callbacks when the object is allocated in 2311816c9e
  • ext/pdo: Bound-check column index in getColumnMeta() in 4e26dd0f79
  • ext/sqlite3: reject close() from inside a callback in 7300fa520d
  • dom: fix attribute namespaces from foreign content in the HTML parser in 92b08946a3
  • Fix GHSA-ch8v-r6jh-4vvr: encode 0xFF in FILTER_SANITIZE_ENCODED in 7ac9700d0d
  • [http] Fix out-of-bounds read on empty Location header in 547566f17a
  • Fix heap over-read in cli_get_prompt() for empty cli.prompt in c2c01aea6c
  • Fix three Win32-only defects in proc_open descriptor handling in 8d0d6307aa
  • ext/zlib: honor preset dictionary for raw inflate with non-default window in fb76b3d715
  • ext/gettext: throw on libintl NULL return in textdomain/bindtextdomain in GH-21882
  • Fix GH-23693: JIT guard branches on stale flags across basic blocks in 9c2acc343e
  • Fix GH-21776: use-after-free in zend_std_read_property magic __isset in GH-21786
  • Pin $this in zend_call_function in GH-22151
  • Zend: release the trampoline when zend_call_function() bails early in d19c413d48
  • ext/pdo: Do not register a bindColumn() binding for an unknown column in 3580bbd28b
  • ext/intl: Reject unconstructed Collator in attribute and strength methods in 630128392b

Jakub Zelenka

Jordi Kroon

  • curl: replace external URLs with local test server in tests in GH-21805
  • ext/standard: Fix 1-char relative Location redirects after GH-23467 in 64664758cd
  • build/gen_stub: include attribute arguments in synopsis modifiers in GH-22418
  • tree: Add #[\SensitiveParameter] to more functions taking secrets in GH-23782

Julien Voisin

  • Check the links before unlinking a huge block in GH-23568
  • Bound the free list walk in zend_mm_gc() in GH-23566
  • Fix a non-exploitable integer overflow in mhash_keygen_s2k in GH-23770
  • Fix an integer overflow in to_xml_hexbin in GH-23771
  • ext/openssl: scrub symmetric key material before freeing in GH-23778
  • ext/xml: reject changing handlers while parsing in GH-23818
  • ext/curl: fix use-after-free when setting a callback option from its own callback in GH-23814

jvoisin

  • Backport: reject XML handler changes while parsing in GH-23818
  • Backport: reject cURL callback changes from callbacks in GH-23814
  • Backport: fix integer overflow in to_xml_hexbin in GH-23771
  • Backport: fix integer overflow in mhash_keygen_s2k in GH-23770

Kamil Tekiela

  • Drop _mysqlnd_init_ps_fetch_subsystem in GH-23727
  • Fix GH-22854 (Assertion failure at link_errno_read in ext/mysqli/mysqli_prop.c) in GH-20117

lazerg

Lazizbek Ergashev

Louis-Arnaud

  • ext/calendar: take zend_long in the *ToSdn() conversion helpers in GH-23555

Manish Kafle

Marc

  • perf: fix LTO build with gcc (hybrid VM) in GH-23602
  • perf: ZTS: remove obsolete realpath access check in GH-22721
  • zend_strtod: use trunc(dval(&u)) instead of (Long)(dval(&u)) to keep per-digit dependency chain in float register in GH-22676
  • Enable the TAILCALL VM when building with --disable-gcc-global-regs on GCC >= 16 in GH-23603
  • fix windows ci: w11 no longer treats names like NUL.txt as reserved in GH-23844

Matteo Beccati

Máté Kocsis

  • ext/uri: Reject URL delimiters in builder hosts in a357c011ce
  • ext/uri: Initialize builder validation exception errors in 1c2ae570dc
  • ext/uri: Return builder soft errors consistently in a7a2303f95
  • ext/uri: Validate credentials against normalized builder hosts in 3bec7e4b66
  • ext/uri: Preserve empty query and fragment in URL builders in 100e8f353e
  • ext/uri: Minor fixes for Uri\WhatWg\UrlBuilder in 2b9b40779a
  • ext/uri: Build hostless URLs with the correct path type in eb34f8920d
  • ext/uri: Fix throwing Uri\UriError in 703b5bb37a
  • ext/uri: Fix the behavior for $softErrors in GH-23740
  • Restore JIT benchmark runs in d2493f6807
  • Implement "Followup improvements for ext/uri" RFC - URL building with base URL in GH-23526

ndossche

  • Fix OSS-Fuzz #546798343: Heap-buffer-overflow in zend_delete_call_instructions with callable conversion in 3213c3faa6
  • Fix OSS-Fuzz #538730793: Assertion failure when returning by-ref from closure invoke in 762fdd56c9
  • Fix OSS-Fuzz #540904105: ASSERT: ast->attr == T_CLASS_C in 71d56aa501
  • Fix OSS-Fuzz #545352966: default value AST of an SHM-persisted partial in 7c0ecd8053
  • Fix GH-23619: ext/ftp: cryptic error on servers that don't support TLS session resumption on data connection in d841b499b8
  • Fix OSS-Fuzz #5674034779193344: Read of uninitialized memory in is_cacheable_stream_path() in c7ffb825aa

NickSdot

  • ext/standard: Removes ZPP style tests in GH-23413
  • ext/standard: applied fixers to improve test robustness in GH-23136

Nicolas Grekas

  • ext/standard: Remove dead StreamPollHandle::getFileDescriptor() in 59e0be101b
  • ext/standard: Fix use-after-free when a polled stream is closed in 2a43bd1cce
  • ext/standard: Fix Io\Poll timeouts longer than INT_MAX milliseconds in 39f98f768a
  • Map epoll_ctl() errors through php_poll_errno_to_error() in GH-23805

Nora Dossche

Ondřej Mirtes

  • Cache freed VM stack pages instead of freeing them immediately in GH-23470

Pratik Bhujel

Shivam Mathur

tekimen

  • ext/mbstring: Update to Unicode 18.0 in GH-23755

tianfenghan

  • Fix GH-22567 (Windows ZTS CLI SAPI should refresh its TSRMLS cache during request activation) in 4e64a2655e

Tim Düsterhus

  • zend_API: Verify property types in object_properties_load() in GH-23639
  • date: Fix unserialization of Time\Duration in GH-23629
  • date: Fix test description for time/duration/methods/compare.phpt in 6766bdbdd8
  • date: Add comparison handler to Time\Duration in GH-23695
  • standard: Improve sprintf() error message when providing an empty arg specifier in GH-23706
  • uri: Fix casing of UriHostType and UrlHostType enum cases in GH-23851

Weilin Du

  • Zend: Fix iterator relocation at the current element during rehash in GH-23607
  • ext/intl: Reduce stack usage in collator_regular_compare_function() in GH-23627
  • ext/standard: Use ZVAL_STRINGL_FAST() in php_explode_negative_limit() in GH-23631
  • ext/standard: Optimize str_pad() using doubling copies in GH-23661
  • ext/mbstring: Optimize mb_str_pad() using doubling copies in GH-23667
  • ext/standard: Optimize octal escape generation in addcslashes() in GH-23680
  • ext/standard: Optimize str_repeat() when the multiplier is one in GH-23681
  • Revert Zend: Fix iterator relocation at the current element during rehash in 8.4 and 8.5 in 293f22e5ec
  • ext/standard: Optimize integer key insertion in array_change_key_case() in 1849f03afc
  • ext/standard: Use append-new insertion when parsing CSV in a318ae8251
  • ext/standard: Avoid redundant hash checks in getopt() in f0ed2c5890
  • ext/standard: Use known-new keys in error_get_last() in 6541e8331b
  • ext/standard: Preallocate stat result arrays in 9687652b3f
  • ext/standard: Optimize & Refactor pathinfo() in GH-23726
  • Upgrade fileinfo to file 5.48 in GH-23699
  • ext/intl: Optimize callback handling in IntlChar::enumCharTypes() in GH-23748
  • CI: fix ext/zend_test/tests/zend_mm_custom_handlers_alloc_01.phpt in GH-23775
  • ext/standard: Optimize array_column() in GH-23786

Yongqiang Tian

  • Fix GH-23752: Use scoped diagnostic suppression for global register declarations in GH-23753
Subscribe to PHP.Watch newsletter for monthly updates

You will receive an email on last Wednesday of every month and on major PHP releases with new articles related to PHP, upcoming changes, new features and what's changing in the language. No marketing emails, no selling of your contacts, no click-tracking, and one-click instant unsubscribe from any email you receive.