PHP 8.6.0RC4: Downloads, Changelog, News

Release Information

Release
8.6.0RC4
PHP Version
PHP 8.6
Release Date
Release Type
Security Update
Release Status
QA Release Latest
Branch Status
Upcoming Release

PHP 8.6 is a development version, and is not recommended for production use. PHP 8.6 is scheduled to reach General Availability on 2026-11-19. This is the latest QA release in the series.

Downloads

Source Code

Git Clone
Use Git to clone the 8.6.0RC4 tag from the PHP Git repository.
git clone https://github.com/php/php-src.git --depth 1 --branch php-8.6.0RC4
How to compile PHP
PHP can be compiled by setting up the dependencies, building the configure script (./buildconf), configuring the build ./configure, and running make.
Detailed articles on how to compile PHP are available for Ubuntu/Debian based systems and Fedora/RHEL based systems.

Docker/Podman Containers

PHP CLI
PHP CLI Containers images only include the PHP CLI, and no FPM or Apache modules. The Alpine builds are lightweight, but may introduce incompatibilities due to their musl builds. Albeit their larger size, the Debian-based (without the "-alpine" suffix) images are more complete, and widely used.

Alpine-based: Lightweight, but may introduce incompatibilities due to their musl builds.
docker pull php:8.6.0RC4-cli-alpine

Debian-based: More compatible with other components, complete, and are widely used.
docker pull php:8.6.0RC4-cli
PHP CLI + Web Server Integration
These container images include PHP CLI, and a web server integration. FPM container images can be integrated with web servers such as Nginx, Caddy, and Apache with Event MPM. The Apache container images include Apache web server, integrating PHP as an Apache module.

Alpine-based: Lightweight, but may introduce incompatibilities due to their musl builds.
docker pull php:8.6.0RC4-fpm-alpine

Debian-based ZTS Apache: Includes Apache web server integrating PHP as an Apache module.
docker pull php:8.6.0RC4-apache

Debian-based NTS FPM: PHP-FPM, can be integrated with Nginx, Caddy, and other web servers over Fast CGI.
docker pull php:8.6.0RC4-fpm

ChangeLog

Core

  • Fixed GHSA-w8hw-w9fx-j79w, GHSA-6wmf-4rv5-p3rp (Avoid state corruption via bailout). (CVE-2026-109618, CVE-2026-109619)
  • Fixed bug GH-24184 (System ID not being reinitialized after an Apache graceful restart, potentially causing incompatible OPcache file cache entries to be reused).
  • Fixed memory leak when an exception already contains the pending exception in its previous chain.
  • Fixed bug GH-23979 (Nullsafe operator must not flush delayed oplines of an enclosing function).
  • Fixed memory manager keeping a block reallocated to exactly the size of the next smaller bin in its larger bin, which efree_size() then freed into the wrong one.
  • Fix throwing behaviour with recursive arrays in VM.
  • Fixed skipped catch block when switching fibers during exception unwinding
  • Fix escape analysis for objects implementing ArrayAccess.
  • Fixed array_map() optimization not resolving the class name of a static first-class callable.

Date

  • Fixed bug GH-20503 (Assertion failure with ext/date DateInterval property hash construction).
  • Fixed bug GH-24350 (MINIT reads a stale external tz database after an in-process module restart).

Fileinfo

  • Fixed bug GH-24289 (finfo::file() reports the wrong argument number for an invalid $filename).

FPM

  • Fixed bug GH-24229 (fcgi_close() passes shutdown() a literal 1, which is SHUT_RD in WASI).

FTP

  • Fix double free in ext/ftp data_accept() on accept failure.

MBString

  • Fixed bug GH-23958 (truncated encoding names resolving to full names).

MySQLnd

  • Fixed bug GH-24293 (Segfault on connect with an empty password to a MariaDB PAM account).

Opcache

  • Fixed bug GH-17626 (JIT corrupts an opline handler when blacklisting a root trace at the opcache.jit_max_root_traces limit, causing spurious "Too few arguments" errors and crashes).
  • Fix type inference of ADD_ARRAY_UNPACK with integer keys.
  • Fix too wide type inference for ASSIGN_DIM_OP.
  • Fix OSS-Fuzz #568005340 (FETCH_DIM_FUNC_ARG partial conversion).
  • Fix exception checks due to NAN warnings and object empty()'s.
  • Fixed bug GH-24270 (JIT loses the called scope of self:: and parent:: calls in closures).
  • Fixed bug GH-24337 (JIT: segfault when decrementing a non-numeric string property).
  • Fixed bug GH-24185 (Windows ZTS: random access violations with OPcache JIT in multi-process setups).
  • Fix SIGFPE on LONG_MIN % -1 with a constant divisor.
  • Fixed bug GH-24388 (Tracing JIT: segfault when a trace runs out of side exits).
  • Fixed bug GH-24391 (JIT switch on constant null takes default instead of case 0).
  • Fixed bug GH-24206 (Tracing JIT loses loop-carried CV when its loop PHI is reloaded from memory).
  • Fixed bug GH-24386 (JIT: register operand must be loaded before the typed reference check).
  • Fixed bug GH-24437 (JIT: Fix OP_DATA read from an unwritten slot in zend_jit_assign_dim_op()).

PDO

  • Fixed invalid ATTR_ORACLE_NULLS values being accepted and truncated.
  • Fixed a duplicate warning when ATTR_STATEMENT_CLASS is rejected on a persistent connection.
  • Fixed constructor option errors naming argument #3 ($password) instead of argument #4 ($options).

Phpdbg

  • Fix wrong command names.

Phar

  • Fixed GH-24166 (Double-free in Phar::webPhar() in CGI without PATH_INFO).

POSIX

  • Fixed posix_setrlimit() rejecting POSIX_RLIMIT_INFINITY on Solaris.

Readline

  • Fixed a crash in readline_info() when completion_append_character contains a non-ASCII byte.

Session

  • Fixed session_write_close() keeping the save handler open when the session data cannot be encoded.
  • Fixed session data loss in the files save handler when writing the session file fails after it was already truncated.

SOAP

  • Fixed bug GH-23686 (SoapClient only strips Authorization: Basic when a WSDL imports from another host).

Standard

  • Fixed chown() and lchown() failing to resolve user names in ZTS builds when getpwnam_r() needs a larger buffer.
  • Fixed password_get_info() and password_needs_rehash() accepting malformed bcrypt costs.
  • Fixed proc_open() null descriptor not being inheritable on Windows.
  • Don't share the unserialize() context with enum autoloaders.
  • Fixed bug GH-24399 (usleep() and time_nanosleep() ignore queued APCs on Windows).
  • Fixed glob() not negating bracket expressions that start with "^".

Tidy

  • Fixed tidy_repair_string(), tidy_repair_file(), tidy::repairString() and tidy::repairFile() rejecting null for $encoding.

Zip

  • Fixed use-after-free when re-entering ZipArchive during destruction or a close warning, and rejected opening streams while closing.
  • Fixed a use-after-free when a ZipArchive method that modifies the archive is called from a progress or cancel callback during close().

Zlib

  • Fixed use-after-free when an error handler removes a failing zlib.inflate filter (GH-24176).

Commit List

Alejandro Pacheco

  • Fix double free in ext/ftp data_accept() on accept failure in 0d780377e5

Alexander Danilov

  • Fix memory leak in array_map optimization in GH-24138
  • date: Validate nanoseconds range and reject negative zero duration in GH-24356
  • date: Validate ISO 8601 duration strings for null bytes early in GH-24357

Alexandre Daubois

  • Backport PCRE2 security fixes to bundled 10.40 in 1e8a51d545

Arnaud Le Blanc

  • JIT: Fix TLS access with SHM reattachment in GH-24355
  • Avoid state corruption via bailout in 3584a98bda

Claudio Dekker

  • Fix array_map() optimization not resolving the class name of a static FCC in GH-24244

Daniel Scherzer

  • php_ftp_fopen_connect(): Confirm no extra commands are smuggled in in GH-23856
  • LiteSpeed: document security considerations for INI overrides in GH-23806
  • GH-23686: Add regression tests for sensitive headers in 1e8e679dd4
  • sdl_set_uri_credentials(): use early returns to improve readability in c1873412a5
  • ext/soap: redact more sensitive headers in 1b6e96cb5e
  • SoapClient: add new keep_headers option in 68aa3372a1

David Carlier

  • ext/soap: fix use of uninitialized func in do_request() on OOM bailout in a0434fdc24
  • Fix GH-23352: DOMDocument::adoptNode() stale document references in d4235d7cf9
  • Fix GH-24081: User opcode DISPATCH runs on a stale frame in the TAILCALL VM in 2cf7ad09bd
  • ext/zend_test: fix gh24081.phpt on arm CI in d9fb6eb570
  • Zend: zend_call_stack_get_netbsd_pthread() pthread attribute leak in 81fd6105bc
  • Fix GH-24321: reset global_map_ptr_last on shutdown in 171f81f4a4
  • Fix GH-23334: ext/dom: php_dom_free_templated_content() use-after-free in 5587c3265c

Edmond

  • Fix leak when the added previous exception is already in the chain in GH-24177
  • Fix use-after-free when removing a failing zlib.inflate filter in GH-24176
  • Fiber: hold the object a callable resolved to in the creating frame in GH-24134
  • std: Fix memory leak of the last response headers after a nested HTTP request in GH-24201

Gina Peter Banyard

hakre

  • Fix bug66338.phpt mangling path containing '.php' sequences in fd3a97d1c8

Heath Dutton🕴️

  • Fix GH-20503: Assertion failure with ext/date DateInterval property hash in GH-20720

Ilia Alshanetsky

  • ext/standard: Retry getpwnam_r() on ERANGE in php_get_uid_by_name() in f211ed307d
  • ext/zip: Reject ZipArchive mutators during close() in GH-24025
  • ext/standard: Validate the bcrypt cost before reading it in 2f7951d649
  • ext/pdo: Avoid a duplicate warning for a rejected statement class in 26e5bc454c
  • ext/session: Close save handler when session encoding fails in ae27423c33
  • ext/session: do not reuse session state a save handler tore down in 751190d8e0
  • ext/pdo: Report $options as the argument for constructor option errors in d8d55b75c5
  • ext/session: Truncate session file after successful write in c2b02f24df
  • Fix GH-24372: Keep stmt->executed set across PDOStatement::execute() in d5696b8cd1
  • ext/opcache: Mark dl()-created persistent strings as thread-local in 77dbc2ca54
  • ext/pdo: Validate Oracle null handling modes in bba94675f5

Ilija Tovilo

Jakub Zelenka

  • ext/phar: Fix double-free in webPhar() without PATH_INFO in GH-24166

Jorg Sowa

  • Fix proc_open() null descriptor not inheritable on Windows in 6ec698758e
  • ext/opcache: move bug66338.phpt cleanup to --CLEAN-- in 14f0d871e5
  • Fix posix_setrlimit() rejecting POSIX_RLIMIT_INFINITY on Solaris in 602ba3ac97
  • Fix xxh64 seed deprecation emitted when no seed is given in 17f94f0a4c

jvoisin

  • ext/zip: Fix use-after-free in the archive destructor path in GH-23779

Kamil Tekiela

  • Fix upmerge of ext`zend_test\test.c` in 2ba372b961
  • ext/mbstring: Fix truncated encoding names resolving to full names in GH-23974
  • Update NEWS in b4e7f8ac0f

Keyvan Minoukadeh

  • Fix GH-24260: querySelectorAll() returns duplicate elements for selector lists in d1fdbbacfb

lacatoire

  • ext/tidy: Accept null for the $encoding of the repair functions in 48994f596f

lazerg

Levi Morrison

  • fix: system ID for Apache graceful restart in GH-24184

Marc

Marc Bennewitz

  • zend_alloc: move a small block shrunk to the size of the bin below in 630406c895
  • Fix -Wint-to-pointer-cast warnings in the CALL VM on 32-bit in GH-24360

Matteo Beccati

Michael Orlitzky

  • sapi/cli/tests/023.phpt: support TEST_PHP_EXTRA_ARGS in c522554a02
  • ext/standard/tests: pass TEST_PHP_EXTRA_ARGS to some proc_open() tests in f93f92db37
  • {ext/standard,sapi/cli}/tests: pass TEST_PHP_EXTRA_ARGS to php in b9f41139cf
  • github/scripts/windows: pass an extension_dir to the test runner in e56aedb3f7
  • ext/standard/tests: work around Windows quoting with tempfiles in 077d7d6024

Máté Kocsis

  • ext/uri: Address UrlBuilder todo comments in 7d1d66246e

ndossche

NickSdot

  • ext/uri: Fixes inconsistent validation ordering in GH-23823
  • ext/uri: Refactors builder error handling in GH-23834
  • ext/uri: Fixes url delimiters in GH-23815

Nicolas Grekas

  • Fix skipped catch block when switching fibers during exception unwinding in GH-24117
  • ext/standard: Don't share the unserialize() context with enum autoloaders in b4a63ecd70
  • Make usleep() and time_nanosleep() alertable on Windows in GH-24399
  • Fix glob() not negating bracket expressions that start with "^" in GH-24422

Nora Dossche

RV7PR

Ryosuke Ishibashi

Shivam Mathur

  • ext/gd: Drop useless and doubtful MSVC specific code (libgd/libgd@f1480ab) in GH-24316
  • Use the default archive names for Windows ARM64 builds in GH-24313
  • Fix v142 ARM64 hash and floating point results in GH-24317
  • Pin macOS CI to OpenSSL 3 in GH-24332
  • Fix Windows quoting in proc_open tests in GH-24343
  • Fix macOS CI in GH-24409

Sjoerd Langkemper

  • Use FreeBSD 14.4 in GitHub actions in 810f0c6a81

waroad

  • JIT: Fix SIGFPE on LONG_MIN % -1 with a constant divisor in fe6a0ef59d
  • JIT: Fix OP_DATA read from an unwritten slot in zend_jit_assign_dim_op() in a1975b108b

Weilin Du

  • ext/intl: Fix grapheme_extract() next offset in GH-24160
  • ext/readline: Fix non-ASCII completion append characters in readline_info() in GH-24263
  • Backport CI: Fix gh20532.phpt on FreeBSD in GH-24424
Subscribe to PHP.Watch newsletter for monthly updates

You will receive an email on last Wednesday of every month and on major PHP releases with new articles related to PHP, upcoming changes, new features and what's changing in the language. No marketing emails, no selling of your contacts, no click-tracking, and one-click instant unsubscribe from any email you receive.