PHP 8.6.0RC3: Downloads, Changelog, News

Release Information

Release
8.6.0RC3
PHP Version
PHP 8.6
Release Date
Release Type
Bug Fix Release
Release Status
QA Release Latest
Branch Status
Upcoming Release

PHP 8.6 is a development version, and is not recommended for production use. PHP 8.6 is scheduled to reach General Availability on 2026-11-19. This is the latest QA release in the series.

ChangeLog

BCMath

  • Fixed BcMath\Number results that truncate to zero keeping a negative sign and comparing less than zero.

BZ2

  • Fixed double close of the descriptor and use-after-free of the inner stream when bzopen() is given a stream resource.

CLI

  • Fix GH-22567 (Windows ZTS CLI SAPI should refresh its TSRMLS cache during request activation).
  • Fixed bug GH-23764 (Built-in server leaks a file descriptor on every HEAD request for a static file).
  • Fixed crash in the built-in server when a client is reset before being accepted.
  • Fixed the built-in server truncating an error page and leaking its unsent part after a partial socket write.

Core

  • Fixed bug GH-23644 (Optimizer leaves a constant-vs-constant comparison unfolded, crashing the VM in zval_undefined_cv).
  • Fixed OSS-Fuzz 532353396 (assertion failure with static type).
  • Fix GH-23662 (Avoid NAN warning in print_r()).
  • Fix GH-21999: GC inconsistency with lazy object, var_dump(), and object comparison.
  • Fixed OSS-Fuzz #536440507 (Immutable class incorrect assertion).
  • Fixed bug GH-23628 (Tracing JIT reads undefined property slots of lazy proxy objects instead of forwarding to the real instance).
  • Fixed bug GH-23882 (array_map() optimization is incorrect for strict_types=1).
  • Fixed OSS-Fuzz #565486253 (coerced arg with '...' on non-variadic function).
  • Fixed AVX being reported as supported when the OS has not enabled AVX state.
  • Fixed OSS-Fuzz #552682112 (assertion failure wrt zp_arg_must_be_sent_by_ref()).
  • Fixed GH-23921 (Fibers start with error_reporting = 0 when the error_reporting INI directive is not set).
  • Fixed GH-23980 (ZEND_ASSERT violation @ ZEND_INCLUDE_OR_EVAL).
  • Deprecated using "let" or "is" as the name of a class, function, or constant, and as an alias in class_alias() and use declarations.
  • Deprecated using "_" as a constant name and as an alias for a class or constant in use declarations.
  • Switch the POSIX high resolution timer back to CLOCK_MONOTONIC from CLOCK_MONOTONIC_RAW.
  • Fixed array_map optimization with non-literal function or non-literal args.
  • Fixed use-after-free when a dl()-loaded extension declares a frameless function and a later request calls it.
  • Fixed System V shared memory emulation for Windows attaching segments past the end of their mapping.
  • Fixed exception thrown by destructor during GC in a Fiber not being rethrown into the frame that triggered the GC.

DOM

  • Fixed DOMXPath and Dom\XPath losing the context node and in-scope namespaces of an evaluation after a php:function() callback evaluated another expression on the same object.

FFI

  • Fixed crashes with FFI callbacks created from __call() trampolines and array callables whose object is released.

Intl

  • Fixed grapheme_strstr() and grapheme_stristr() returning incorrect substrings when supplementary characters precede the match.
  • Fixed grapheme_strstr() and grapheme_strpos() missing canonically equivalent matches, and grapheme searches reporting ICU errors for empty haystacks.
  • Fixed grapheme_strrpos() and grapheme_strripos() skipping overlapping matches when using a negative offset.
  • Fixed IntlDateFormatter::parse(), localtime() and parseToCalendar() treating the offset as UTF-16 code units instead of bytes.

Lexbor

  • Merge patches lexbor/lexbor@859f100, lexbor/lexbor@a36e09a, lexbor/lexbor@b0f7412, lexbor/lexbor@1b215a8, lexbor/lexbor@385afff, lexbor/lexbor@e6c068f, lexbor/lexbor@327a8b6, lexbor/lexbor@917742f and lexbor/lexbor@e89c258, fixing dropped usernames containing an at sign, uninitialized memory in IDNA buffer growth, the encoding of a space before a query or fragment in an opaque path, a query or fragment lost after a dot segment in a path, replacement file drive paths, the output encoding used for percent-encoding, the URLSearchParams tail pointer and fragment serialization without a query.

MySQLnd

  • Fixed field_count not resetting on OK packet.
  • Fixed memory leak when closing a prepared statement after its connection was killed.

Opcache

  • Fix zend_analyze_calls() call_stack buffer overrun.
  • Fixed bug GH-23679 (Tracing JIT writes a parent private property into a child's shadowing public property).
  • Fix multiple incorrect DCE due to unsound escape analysis.
  • Fixed bug GH-24063 (OPcache optimizer folds $cond ? -0.0 : 0.0 into a single -0.0 constant).
  • Fixed crash when a file cache is reused with a different set of extensions declaring frameless functions.
  • Fixed bug GH-23991 (JIT generates invalid IR for multiple recursive calls).
  • Fix SCCP evaluation of isset()/empty() on dimension of non-escaping object.

OpenSSL

  • Fixed stream_socket_enable_crypto() leaving the socket non-blocking after a handshake timeout.
  • Fix memory leak by doing early salt validation.
  • Fixed openssl_sign() using the maximum RSA-PSS salt length by default instead of the OpenSSL default.
  • Fixed feof() on a TLS stream staying false after a close_notify on Windows.

PCNTL

  • Fixed pcntl_signal_dispatch() dropping the queued signals when it runs while an exception is pending.
  • Fixed pcntl_signal_dispatch() dropping the signals queued behind a handler that throws.
  • Fixed bug GH-23986 (/proc/self paths resolve to the parent process after pcntl_fork()).

PDO

  • Fixed PDO::setAttribute() installing a PDO::ATTR_STATEMENT_CLASS class whose constructor arguments it rejects.
  • Fixed PDO::ATTR_STATEMENT_CLASS constructor_args type errors reporting "array given" regardless of the value passed.
  • Fixed PDOStatement::bindParam() and bindColumn() leaking the driver options value.
  • Fixed PDOStatement not reporting its bound parameters and columns to the cycle collector.
  • Fixed PDOStatement::setFetchMode() not applying changes atomically.
  • Fixed PDOStatement::execute() leaving the previous result available after a failed execution.
  • Fixed a use-after-free when bindValue()/execute()/closeCursor() is called from a bound parameter's __toString() during execute().

PDO_DBLIB

  • Fixed bug GH-23741 (segfault after a failed query inside a PDO transaction). Errors raised by beginTransaction(), commit(), rollBack() and lastInsertId() are now reported instead of being dropped.

PDO_PGSQL

  • Fixed crash when a persistent connection fails.

Reflection

  • Fixed bug GH-23842 (ReflectionProperty::skipLazyInitialization() copies invalid constant defaults with OPcache).

SimpleXML

  • Fixed reconstructing a SimpleXMLElement freeing a child element that another variable still references.

SOAP

  • Fixed bug GH-22895 (Heap use-after-free while encoding a Traversable with an illegal key).
  • Fixed memory leak when load_wsdl_ex() failed to load.

Standard

  • Fixed sha1_file() returning a digest for incomplete data after a stream read failure.
  • Fixed iptcembed() corrupting JPEG headers when called recursively from an output handler.
  • Fixed proc_open() leaking descriptor zero when descriptor setup fails.
  • Fixed StreamPollHandle changing unread_bytes of a TLS stream when it is added to an Io\Poll\Context.
  • Fix wordwrap() ignoring an existing break at the end of the string
  • Fixed convert.quoted-printable-decode decoding lowercase hex digits to the wrong byte.

Tidy

  • Fixed a use-after-free when a tidyNode is used after its document is reparsed.

Zip

  • Fixed bug GH-23899 (Assertion failure when a cancel callback returns an invalid type during shutdown).

Commit List

Alexander Danilov

  • openssl: Fix memory leak by doing early salt validation in 77bdd80927
  • openssl_sign - restore default salt length without passing salt_length parameter in GH-24033
  • openssl: Rename OpenSSLSession references to Openssl\Session in GH-24083

Alexander Lisachenko

  • Fix GH-23628: Tracing JIT reads undefined property slots of lazy proxies and unset properties in GH-23640

Alexandre Daubois

  • lexbor: Merge upstream WHATWG URL and IDNA fixes in beee5444d0

Arnaud Le Blanc

  • Fix array_map optimization with non-literal function or non-literal args in GH-23254
  • Update IR in GH-24013

Calvin Buckley

  • ext/odbc: fix cond for SQL_NO_TOTAL that led to single byte buffer in GH-23462

Daniel Scherzer

  • JSON fuzzer: use options for handling invalid UTF-8 and big strings in GH-23877
  • Opcache: abort process when mprotect() or VirtualProtect() calls fail in GH-23855
  • ext/gd: fix undefined behavior with GD2 images with INT_MAX-sized chunks in b8c63871c8
  • NEWS in 2e5bb79a92
  • ext/mbstring: assert that mb_wchar_to_uuencode() pointer write is in bounds in GH-23955
  • ext/iconv: add a hardening assertion that char_cnt doesn't underflow in GH-23873
  • ext/gd: fix undefined behavior with GIFs with problematic LZW compression data in 2cea4a358d
  • NEWS in c8d62b8a0b
  • ext/soap: fix leak when load_wsdl_ex() fails to load in GH-24066
  • [%pS migration] Use %pS in ext/bcmath in GH-23147
  • [%pS migration] Use %pS in ext/random in GH-23167
  • [%pS migration] Use %pS in ext/uri in GH-23172
  • [%pS migration] Use %pS in ext/zip in GH-23176
  • [%pS migration] Use %pS in ext/phar/dirstream.c in 24b6846bd6
  • [%pS migration] Use %pS in ext/phar/func_interceptors.c in 5974b8e4c5
  • [%pS migration] Use %pS in ext/phar/phar_object.c in fe1f83ecd0
  • [%pS migration] Use %pS in ext/phar/phar.c in 7ae1cd5ccb
  • [%pS migration] Use %pS in ext/phar/stream.c in b044cefe52
  • [%pS migration] Use %pS in ext/phar/tar.c in 686b597102
  • [%pS migration] Use %pS in ext/phar/util.c in 90a5c12dcb
  • [%pS migration] Use %pS in ext/mysqli in GH-23159
  • [%pS migration] Use %pS in ext/session in GH-23168

David Carlier

  • sapi/cli: Fix crash in the CLI server when a client is reset before being accepted in 83c59b8053
  • Fix GH-23897: php:function() assertion after failed registerPHPFunctions() in 6eb8d06b57
  • ext/intl: intl_error_set_custom_msg() crash without an active call frame in f61ebc0348
  • Fix GH-23637: opcache inheritance cache entry published too early in 873a997d70
  • ext/soap: to_xml_array() heap use-after-free with illegal iterator keys in d044f28b80
  • Fix GH-24050: gc_collect_white() frees data reachable from a resurrected object in 7b75d71ca3

Derick Rethans

Dmitry Stogov

Gina Peter Banyard

  • fibers: fix GH-23921 (Fibers start with error_reporting = 0 when the error_reporting INI directive is not set) in 3bb50c13a7

Ilia Alshanetsky

  • ext/session: Preserve exceptions thrown by create_sid() in eacd1576ad
  • ext/opcache: Fix GH-23679 tracing JIT shadowed private writes in c06e7370ae
  • ext/ffi: Hold a reference to the callable of an FFI callback in ed60b9edeb
  • Zend: clear the AVX bit in ECX when the OS has not enabled AVX state in eb32f52f77
  • ext/openssl: Restore blocking mode after a handshake timeout in ae429f100b
  • ext/pdo: Keep statement class when ATTR_STATEMENT_CLASS is rejected in beee995c90
  • ext/pdo: Release driver options after bindParam and bindColumn in 22237f2c07
  • Fix GH-23741: pdo_dblib use-after-free of statement error state in 2dc6626007
  • ext/libxml: Keep SimpleXML children alive across reconstruction in efb8ad276d
  • ext/bcmath: Clear the sign of BcMath\Number results that truncate to zero in 8184e9efec
  • ext/tidy: Reject tidyNode use after the document is reparsed in 30ba0217d1
  • sapi/cli: Fix built-in server truncating responses after a partial write in 021acbe980
  • ext/pdo: Drop the previous result when execute() fails in 11690db178
  • Fix HashTable UAF when rebound from a parameter __toString() in 08a49a9225
  • Zend: Skip frameless registration for temporary modules in 75d77cb4fe
  • ext/pdo: Report bound params and columns to GC in 71e56ed7a9
  • ext/pdo: Make PDOStatement::setFetchMode() updates atomic in 357fcf12f4
  • ext/mysqlnd: Fix VIO plugin area getter in a1e5424af2
  • TSRM: Fix Windows shared memory payload offset in e50b8b05be
  • Zend: Restart the va_list per callback in zend_llist_apply_with_arguments() in fc3a76a603
  • Zend: Include frameless functions in the system id in 1bffb94a2f
  • ext/standard: Reject incomplete sha1_file reads in 808685f576
  • ext/standard: Keep IPTC headers local to each call in 0c4e3b6295
  • ext/standard: Close owned proc_open descriptors on setup failure in 81e0367dbc
  • ext/dom: Restore the XPath context after a reentrant evaluation in 523127fd54
  • ext/intl: Use byte offsets in IntlDateFormatter parsing in 913e01c159
  • ext/pdo: Return false from rewrite_name_to_position() on IM001 error in 073095ed8d
  • ext/standard: Fix convert.quoted-printable-decode of lowercase hex in 09c3e734b1
  • Fix alternate form flag for %x testing stale signed value in ee0f3c5315

Ilija Tovilo

  • if out zend_class_constants_are_updated() in release builds in fa7734f43f

  • Skip result type inference verification for simple get in 3401483083
  • Re-generate outdated parse_date.c file in aaa870786c

Jakub Zelenka

  • Zend tests: skip syslog() in the arginfo/zpp mismatch test in 32f514962a
  • Fall back to epoll_wait when epoll_pwait2 is unavailable at runtime in GH-23825
  • Fix StreamPollHandle changing unread_bytes of a TLS stream when added in 8330ca37ed
  • Fix TLS stream EOF detection after close_notify with stale errno in GH-24132
  • Fix bzopen() ownership of the stream it wraps in 291252d45f

Joe Ferguson

Jordi Kroon

  • Document missing deprecation entries for PHP 8.6 in GH-23972

Kamil Tekiela

  • Reset field_count for OK packet in GH-23890
  • Fix memory leak when closing a statement on a killed connection in 9a3f37872b

lacatoire

  • ext/pcntl: fix an off by one bound and a parameter the parser made required in e23dc68f11

lazerg

Lazizbek Ergashev

Levi Morrison

  • Fix persistent stream context lifetime during shutdown in GH-23853

Marc

  • fix aarch64 gcc preserve_none detection in GH-23883

Marc Bennewitz

Michael Orlitzky

  • sapi/cli/tests/php_cli_server_ipv6_error_message.phpt: use TEST_PHP_ vars in 17506567b9
  • ext/soap/tests/bugs/bug62900.phpt: make use of TEST_PHP_ vars in e216cf64f0
  • ext/curl/config.m4: include string.h for test using strncmp() in 54f94852bb

Michael Voříšek

  • Verify bundled sources using CI - Opcache JIT IR in GH-20179

Mrmaxmeier

  • Fix call_stack buffer overflow in zend_analyze_calls() in 342a7465b3

ndossche

  • Fix OSS-Fuzz #536440507: Immutable class incorrect assertion in c4efd20931
  • Fix OSS-Fuzz #565486253: coerced arg with '...' on non-variadic function in b5526aa2fe
  • Fix incorrect DCE due to unsound escape analysis in cba864da35
  • Fix __isset escape analysis causing misoptimization in f9639b562a
  • Fix property hook escape analysis causing misoptimization in 4bf483fa88
  • NEWS in 3b3f5dd120
  • Fix GH-23980: ZEND_ASSERT violation @ ZEND_INCLUDE_OR_EVAL (include/eval run with a pending exception) in e7b225697e
  • Fix soap test on 8.5+ in c22ce97310
  • Fix GH-23991: JIT generates invalid IR for multiple recursive calls in 6abb600217
  • Fix SCCP evaluation of isset()/empty() on dimension of non-escaping object in 423529d2b7

NickSdot

  • ext/uri: fixed url path resolution in GH-23817
  • ext/uri: Allow empty credentials in the WHATWG URL Builder in GH-23816

Nicolas Grekas

  • ext/pcntl: do not drop queued signals when an exception is pending in GH-23624
  • ext/mbstring: Don't emit surrogates when encoding to UTF-8 in 0cf8668eb2
  • zend_hrtime: use CLOCK_MONOTONIC instead of CLOCK_MONOTONIC_RAW in GH-23790
  • standard: Create incomplete objects again from the C format in GH-24020
  • Rethrow exceptions from destructors called by the GC in a fiber in GH-24118
  • Fix wordwrap() ignoring an existing break at the end of the string in GH-24116

Nora Dossche

Shivam Mathur

  • Backport fixes for macOS 26 in GH-24031
  • Upgrade macos in CI. in GH-24032
  • Preserve bare NUL access with open_basedir on Windows in GH-24158

Tim Düsterhus

  • zend_compile: Disable array_map() optimization for strict_types=1 in GH-23889

Weilin Du

  • ext/curl: Preserve callback lifetime without rejecting callback changes in GH-23863
  • Fix GH-23899: Handle bailout from ZipArchive cancel callback return validation in GH-23914
  • Backport: Fix GH-23899 destructor test expectation in ef8f6dde6d
  • CI: Fix flacky ext\curl\tests`curl_setopt_ssl.phpt` in GH-23944
  • ext/intl: Fix grapheme_strstr() and grapheme_stristr() match offsets after supplementary characters in GH-24012
  • ext/intl: Fix grapheme_strstr() and grapheme_strpos() missing canonically equivalent matches in GH-24029
  • ext/intl: Fix overlapping grapheme matches with negative search offsets in GH-24028

武田 憲太郎

  • ext/pgsql: Removed pg_service(), unavailable with any released libpq in 43c6014670
  • ext/pdo_pgsql: Fix crash when a persistent connection fails in 5d57dd6140
Subscribe to PHP.Watch newsletter for monthly updates

You will receive an email on last Wednesday of every month and on major PHP releases with new articles related to PHP, upcoming changes, new features and what's changing in the language. No marketing emails, no selling of your contacts, no click-tracking, and one-click instant unsubscribe from any email you receive.