PHP 8.6.0alpha2: Downloads, Changelog, News

Release Information

Release: 8.6.0alpha2
PHP Version: PHP 8.6
Release Date: 2026 Jul 16
Release Type: Security Update
Release Status: QA Release
Branch Status: Upcoming Release

PHP 8.6 is a development version, and is not recommended for production use.
PHP 8.6.0beta1 is the latest QA release in PHP 8.6.

PHP can be compiled by setting up the dependencies, building the configure script (./buildconf), configuring the build ./configure, and running make.
Detailed articles on how to compile PHP are available for Ubuntu/Debian based systems and Fedora/RHEL based systems.

Docker/Podman Containers

PHP CLI

PHP CLI Containers images only include the PHP CLI, and no FPM or Apache modules. The Alpine builds are lightweight, but may introduce incompatibilities due to their musl builds. Albeit their larger size, the Debian-based (without the "-alpine" suffix) images are more complete, and widely used.

Alpine-based: Lightweight, but may introduce incompatibilities due to their musl builds.

docker pull php:8.6.0alpha2-cli-alpine

Debian-based: More compatible with other components, complete, and are widely used.

docker pull php:8.6.0alpha2-cli

PHP CLI + Web Server Integration

These container images include PHP CLI, and a web server integration. FPM container images can be integrated with web servers such as Nginx, Caddy, and Apache with Event MPM. The Apache container images include Apache web server, integrating PHP as an Apache module.

Alpine-based: Lightweight, but may introduce incompatibilities due to their musl builds.

docker pull php:8.6.0alpha2-fpm-alpine

Debian-based ZTS Apache: Includes Apache web server integrating PHP as an Apache module.

docker pull php:8.6.0alpha2-apache

Debian-based NTS FPM: PHP-FPM, can be integrated with Nginx, Caddy, and other web servers over Fast CGI.

docker pull php:8.6.0alpha2-fpm

ChangeLog

Core

Sync Boost.Context assembly with 1.91.0.
Fixed bug GH-22387 (AST pretty-printing drops meaningful parentheses around RHS of instanceof).
Fixed bug GH-15672 and GH-15911 (Stack overflow when an internal function recurses through zend_call_function, such as a self-attached SPL iterator).
Lock unmodified readonly properties for modification after clone-with.
abort() instead of exit() on hard OOM.
perf: ZTS: move AG and SCNG into native __thread storage.

Calendar

Fixed bug GH-22602 (gregoriantojd() and juliantojd() integer overflow with INT_MAX year).

Curl

Added CURLOPT_SEEKFUNCTION and the CURL_SEEKFUNC_OK, CURL_SEEKFUNC_FAIL and CURL_SEEKFUNC_CANTSEEK constants, letting libcurl rewind a streamed request body to resend it on a redirect, multi-pass authentication or a retried reused connection.

Date

Update timelib to 2022.17.
Fixed bug GH-19803 (Parsing a string with a single white space does create an error).
Fixed Unix timestamps in February of the year 0 are misparsed with @-notation.
Fixed bug GH-11368 (idate() doesn't work for the year -1).
Fixed bug GH-11310 (__debugInfo does nothing on userland classes extending Date classes).

DBA

Fixed OOB read on malformed length field in dba flatfile handler.

DOM

Fixed bug GH-22570 (Stack overflow when serializing a deeply nested Dom\XMLDocument).
Fixed Dom\DtdNamedNodeMap integer dimension access so negative indexes return NULL and indexes outside the int range throw ValueError instead of returning the first entity or notation.
Fixed bug GH-22623 (use after free with namespace nodes from XSLTProcessor::registerFunctions())/
Fixed bug GH-22554 (use-after-free with XPath callback returning a node from a foreign document).

Exif

Fixed bug GH-11020 (exif_read_data() emits a spurious "Illegal IFD size" warning when an IFD is not followed by a next-IFD offset).

GMP

Fixed bug GH-22549 (Assertion failure / UB on a compound GMP power or shift assignment with a negative exponent).

Intl

Fixed NumberFormatter::parse() and NumberFormatter::parseCurrency() to reject offset values outside the 32-bit range instead of silently truncating them.
IntlDateFormatter::parse()/datefmt_parse() and IntlDateFormatter::localtime()/datefmt_localtime() now raise TypeError when the offset argument is not of type int.

JSON

Report unterminated JSON strings as syntax errors.
Improve performance error position tracking during JSON decoding.
Fixed bug GH-22514 (Incorrect error column in PHP 8.6 JSON parser).

Opcache

Fixed bug GH-21770 (Infinite recursion in property hook getter in opcache preloaded trait).

OpenSSL

Added $salt_length parameter to openssl_sign() and openssl_verify() with new OPENSSL_RSA_PSSSALTLEN* constants.
Fixed timeout for supplemental read at end of a blocking stream in SSL stream wrapper.
Fixed stream_socket_get_crypto_status() after supplemental read.

PDO_ODBC

Fixed bug GH-20726 (Crash with ODBC connection pooling when the DSN carries no credentials).

PHPDBG

Fixed fleaked lowercased lookup keys in phpdbg_resolve_opline_break.
Fixed off-by-one in phpdbg_safe_class_lookup() causing class lookups to always fail during phpdbg's signal-safe interruption path.

Reflection

Fixed bug GH-22683 (Reflection(Class)Constant::__toString() should not warn on NAN conversions).
Fixed bug GH-22681 (Reflection*::__toString() truncates on null bytes).

Session

Fixed bug GH-21314 (Different session garbage collector behavior between PHP 8.3 and PHP 8.5).

SOAP

Fixed bug GH-22585 (OOM on bailout with uninitialized do_request() parameters).
Fixed xsd:hexBinary decoding to reject odd-length values instead of silently truncating the last nibble.
Made SOAP encoding errors report the affected type or failing operation instead of the generic "Violation of encoding rules" message.

Standard

Fixed sleep() and usleep() to reject values that overflow the underlying unsigned int timeout.
Fixed bug GH-22671 (assert.bail aborts the process when the assert callback throws an exception whose reporting re-throws).
Fixed bug GH-22678 (Use-after-free in array_multisort() when the comparator mutates the array being sorted).

Streams

Fixed bug GH-21468 (Segfault in file_get_contents w/ a https URL and a proxy set). (CVE-2026-12184)

URI

Fixed bug GH-22628 (Percent-encoding of caret in WHATWG URL paths is not performed).
Fixed bug GH-22629 (WHATWG Validation error incorrect with empty host and non-empty userinfo).

Zip

Fixed bug GH-22649 (ZipArchive::setCommentName() and setCommentIndex() could crash after overwriting an entry and resetting its inherited unchanged comment).
Fixed bug GH-21705 (ZipArchive::getFromIndex() ignores ZipArchive::FL_UNCHANGED for deleted entries).
Fixed bug GH-22176 (memory leak with ZipArchive::registerCancelBack() is used with reference returning function during shutdown).
ZipArchive::addGlob() and ZipArchive::addPattern() now raise a TypeError for invalid "remove_all_path", "comp_method", "comp_flags", and "enc_method" options instead of emitting a warning.

Commit List

alhudz

ext/dba: fix oob read on malformed length field in dba flatfile handler in a9c7dfefbd

arshidkv12

ext/calendar: Fix integer overflow in GregorianToSdn() and JulianToJd() in GH-22604
Fix GH-21720: macOS posix_spawn_file_actions_addchdir availability handling in 8ce99bc2ce
ext/ldap: fix ldap_explode_dn result ordering in 7809f94b1f

Ayesh Karunaratne

NEWS: fix markup in a1287f0ef0

Calvin Buckley

Remove submodule dependency from web-php in release process in GH-22535
Change bless to clean up absolute paths in GH-22067

Daniel Scherzer

Update NEWS after cherry-pick in f53c8a48ca
[8.5] NEWS: add entry for bugfix from GH-22187 in 76dad0667f
[RFC] Allow #[\Override] on class constants in GH-20478
Add and use known string for NoDiscard in GH-21810
Implement ReflectionClass::isAnonymous() using _class_check_flag() in dd86a8ab58
Reflection: use RETURN_BOOL in _class_check_flag() in ed27dbcdc8
Implement ReflectionClassConstant::isEnumCase() using existing helper in f98ebbf542
Implement ReflectionClassConstant::isDeprecated() using existing helper in 22f80dcf99
Fix inline documentation of ReflectionProperty::getName() in 0a858ea9f4
Update inline documentation of ReflectionProperty::setAccessible() in 36a602b077
Fix inline documentation of Reflection*::getModifiers() methods in ff39477564
Fix inline documentation of ReflectionType::allowsNull() in 4795c51aec
Fix inline documentation of ReflectionMethod::getClosure() in 5dfab102bd
Avoid unnecessary concatenation in zend_named_reflection_type_to_string() in 6a19160ca5
Reflection: use true and false for booleans rather than 0/1 in f44ae1bedb
Reflection: convert some integers used for conditions to booleans in 4f8f798936
Reflection: remove unneeded indentation support from _extension_string() in 5370fc8f16
Reflection: remove unneeded indentation support from _extension_ini_string() in 4427cb4516
Reflection: remove unneeded indentation support from _zend_extension_string() in 0d680a2390
Reflection: access common function fields through zend_function.common in 7eef7c9a9a
ReflectionNamedType::getName(): inline logic for legacy behavior in c89e3df764
ReflectionFunction::__toString(): stop accessing intern->ce in 09eaaae5dd
ReflectionFunctionAbstract::getClosureUsedVariables(): optimize arrays in 046596102d
ReflectionClass::getStaticProperties(): optimize array initialization in 08c039c87a
Fix inline documentation of tentative return methods in dca2c72011
ReflectionFunctionAbstract::getClosureCalledClass(): remove pointer cast in 4ba865110d
Reflection: remove reflection_extension_factory(), avoid extra lookups in 9b5f5e7992
Reflection: rename reflection_extension_factory_ex() in 86b0eaabf0
Reflection: improve string release in reflection_property_factory_str() in fc6aaf78ce
Simplify ReflectionProperty::getSettableType() property handling in 35f2e885cd
Rename ReflectionParameter_isDefault.phpt to reflect actual contents in e7b1d99ea6
Update ReflectionMethod_getClosureThis.phpt to match actual contents in 3b284ed4fc
Fix inline comment in ReflectionMethod::isConstructor() in 69f23e7ded
Reflection: minor whitespace cleanup in 22d2e4186e
ReflectionAttribute::getArguments(): optimize array initialization in f6a4702d89
ReflectionClass::get(Reflection)Constants(): optimize array initialization in 85f2424398
ReflectionClass::isSubclassOf(): remove extraneous parentheses in 2e2b03e1ce
Add regression tests for ReflectionConstant::__toString() with null bytes in 5b00437a09
GH-22658: avoid truncation on null bytes in ReflectionConstant::__toString() in ed3e06a673
NEWS in 834bdcedd1
[8.5] NEWS: add entry for bugfix from GH-22659 in 955a2ce519
Add regression tests for Reflection*::__toString() with null bytes in 1db6c84050
GH-22681: avoid truncation on null bytes in Reflection*::__toString() in 8706cd43f6
NEWS in 4804d17a13

David Carlier

ext/soap: fix use of uninitialized params in do_request() on OOM bailout in a437eab2f6
ext/soap: backport GH-22586 fix in cf2f699a6d
ext/zip: memory leak when zip cancel callback bails out in c889faab35
ext/standard: getimagesize()/getimagesizefromstring() overflow in f08491bf08
ext/dom: fix GH-22570 new test in 33d243c214
ext/zip: stricter numeric handling for archive array options in 201e3cc3d2
ext/dom: Use-after-free with namespace nodes from XSLTProcessor::registerPHPFunctions() in 9073875eb9
ext/dom: fix use-after-free with XPath callback returning foreign-document node in f36660d645
ext/dom: getElementsByClassName() item() returns wrong element on random access in 7f97b83976

Derick Rethans

Updated to version 2026.3 (2026c) in 29f8f56b1e
Update timelib to 2022.17, which has fixes for PHP bugs in d83851dae8
Add support for -1 as valid year for idate() output. in GH-22657
Fix GH-11310: __debugInfo does nothing on userland classes extending Date classes in GH-22655
Fixed __debugInfo() usage on PHP 8.5 and later for DatePeriod in GH-22677

Eyüp Can Akman

ext/exif: Fix GH-11020: spurious "Illegal IFD size" warning in exif_read_data() in 6317a472f4

Florian Engelhardt

abort() in OOM case in cf3c803b50

Gina Peter Banyard

ext/dba: prevent reallocation for info function in GH-22546
ext/soap: remove parameters that are always NULL in 53d0b0ea65
ext/soap: add const qualifiers to soap fault functions in cb5c303593
ext/soap: remove parameter of soap_server_fault_en() that are always NULL in 56d41ff034
ext/soap: convert fault_actor parameter to zend_string* in 14fb8692a5
ext/soap: refactor parse_packet_soap() in db5845e321
ext/soap: minor refactorings of parse_packet_soap() in 98e920c22a
ext/soap: use bool type instead of int type in php_xml.c in ac1e1ded77
ext/soap: use bool type instead of int type in php_http.c in 8c008042cb
ext/soap: use zend_string* in php_http.c where possible in 8c1e00e379
ext/soap: use {Type|Value}Errors for programming errors in SoapServer constructor in GH-22573
Zend: add test for <=> comparing against different types in GH-22634
bz2: use C23 enum and pack filter data struct in GH-22641
ext/standard: Add test for headers_sent() by ref args in 9b1cdc5a98
ext/standard/head.c: no need to rely on ZEND_NUM_ARGS() in 66966e625e
iconv: fix test with duplicate SKIPIF from merge up in d0ce868a5a
bz2: refactor filter creation to do parameter validation in GH-22307

Graham Campbell

ext/curl: add CURLOPT_SEEKFUNCTION in 93fa5f3c88

henderkes

perf: move AG and SCNG into native __thread storage in 0b0284eb16

Ilia Alshanetsky

Fix GH-20726: crash in pdo_odbc with pooling and no credentials in GH-22512
Fix infinite recursion in property hook getter in opcache preloaded trait in d27da095b1
Fix GH-22570: stack overflow serializing a deeply nested Dom\XMLDocument in dd57694402
Fix GH-22516: widen zend_mm srun free counter to cover bin 0 in GH-22530
main/poll: Record wait() error on every backend in GH-22326
Fix GH-22549: GMP compound pow/shift assign asserts on negative operand in GH-22582
Check the stack limit when calling internal functions in GH-22545
Fix GH-22671: assert.bail must not unwind with a pending exception in GH-22679
Fix GH-22678: array_multisort() use-after-free on mutating comparator in 1e9f56cdb4
Fix use-after-free on re-entrant ftp_close() during a transfer in 1feb20156b
Install the SQLite ODBC driver in CI in c3236b922d

Ilija Tovilo

Fixed timeout for supplemental read at end of a blocking stream in SSL stream wrapper in 1c196d0ee5
Fix stream_socket_get_crypto_status() after supplemental read in d822e940a2
Implement perf stat --control for cgi (GH-22537) in aae5edb8e3
Fix performance of gh22443.phpt in 21204bf59a

Jakub Zelenka

main/poll: Fix kqueue event buffer overflow in grouped mode in GH-22606
Fix flaky stream_socket_get_crypto_status handshake test in GH-22707
Fix flaky poll socket close tests on Solaris event ports in GH-22708

James Titcumb

Add information about PIE extensions in GH-22613

Joe Ferguson

Update versions for PHP 8.6.0alpha2 in 984225acc0

Jorg Adam Sowa

Use zend_hash_find_ptr_lc() for case-insensitive name lookups in GH-22565
ext/session: reject null bytes in save_path and referer_check in GH-22578
phpdbg: Fix off-by-one in phpdbg_safe_class_lookup() signal-safe class lookup in GH-22593
Fix incorrect method case for SplFileInfo::getPathname() in gen_stub.php in GH-22597
Zend: reuse zend_get_unqualified_name() in zend_add_const_name_literal() in GH-22598
sapi/phpdbg: remove dead str_type assignments before goto in GH-22600
CI: Revert timeout fix for Symfony community build in GH-22682

Jorg Sowa

ext/session: fix GH-21314 (session GC behaviour is different since 8.4) in fe53521e92
phpdbg: fix leaked lowercased lookup keys in phpdbg_resolve_opline_break in b6938a25ee

Khaled Alam

Fix GH-22683: Reflection(Class)Constant::__toString() should not warn on NAN conversions in GH-22694

kn1g78

Sync Boost.Context assembly with 1.91.0 in 9cefeea7b1

Marc

json: Stop tracking columns in the success path in GH-22487

Matteo Beccati

Added missing NEWS entries for alpha2 in 04b63f9f67

Michael Orlitzky

ext/iconv/tests/bug76249.phpt: fallback for non-GNU iconv() in GH-22552
ext/iconv/tests/bug52211.phpt: use per-iconv charset names in GH-22543
ext/iconv/tests/eucjp2iso2022jp.phpt: skip for "unknown" iconv in ebbfb3c02b
ext/iconv/tests/iconv_mime_encode.phpt: skip for "unknown" iconv in 863263a775
ext/gd/tests/gh19{666,739}.phpt: skip for external libgd in b51f575ba1
Alpine CI: don't install gnu-libiconv-dev in a095c57f03

Máté Kocsis

Fix Ipv6 and ipvfuture address validation to use PHP's built-in memory manager in GH-22571
ext/uri: Increase minimum uriparser version dependency in GH-22575
Fix macOS compatibility of update-lexbor.sh in f40c8f2b98
ext/uri: Fix GH-22629 WHATWG validation error incorrect with empty host and non-empty userinfo in GH-22699
ext/uri: Fix GH-22628 Percent-encoding of caret in WHATWG URL paths is not performed in GH-22700

NickSdot

zend_objects: Readonly properties must be re-locked after clone-with in GH-22654

Nora Dossche

Fix NULL deref when enabling TLS fails and the peer name needs to be reset in fc0f25f286

Ondřej Surý

ext/intl: don't include C++ ICU headers from C translation units in GH-22636

Remi Collet

session: ensure expected INI directives are set in GH-22577
Use PHP version for zip extension in 8ae6a8f1d6

Shivam Mathur

ext/openssl: fix OpenSSL 4 build and test compatibility in GH-22267

Sjoerd Langkemper

Throw an error on null byte in curl array options in GH-22662
curl: Use correct format string in curl debug messages in GH-22723

Tim Düsterhus

zend_types: Convert HT_*() macros to inline functions in GH-22305
iconv: Fix memory management in autoconf test for //IGNORE in GH-22620
zend_types: Remove Z_*CONSTANT_*() in GH-22295
zend_ast: Wrap class names in parens during export when they are an expression in GH-22389
json: Report unterminated JSON strings as syntax errors in GH-22528

Vazha Aptsiauri

sapi/cli: support HTTP QUERY method in built-in server in GH-22615

Weilin Du

ext/standard: Fix phpcredits() QA team heading alignment in GH-22501
Fix GH-21705: ZipArchive::getFromIndex() ignores FL_UNCHANGED in GH-21706
ext/intl: Fix NumberFormatter parse offset overflow in 14a7eadfb2
Revert "ext/intl: Fix NumberFormatter parse offset overflow" in cd7222dbcc
ext/Intl: Fix IntlDateFormatter offset type validation in GH-22533
ext/intl: Fix NumberFormatter parse offset overflow in GH-22572
Remove various useless #include in GH-22581
ext/soap: Add UNEXPECTED() in obvious error path in GH-22596
ext/Intl: Add UNEXPECTED() in obvious error path in GH-22601
Remove several useless include <sys/param.h> in GH-22611
ext/standard: Fix sleep and usleep unsigned integer overflow in GH-22619
ext/dom: Fix Dom\DtdNamedNodeMap index overflow in dimension access in GH-22630
Zend: Add new zend APIs for bin2hex to remove ext/hash usage in various extensions in GH-21724
CI: fix encoding errors in iconv tests in GH-22646
Replace dependencies on /ext/hash in various extensions in GH-21832
Fix GH-22649: avoid ZipArchive comment reset crash in GH-22652
Doc: Rename ZSTR_INIT to ZSTR_INIT_LITERAL in documentation in 6e20480250
Doc: Fix typo in zend_string.rst documentation in 838a9c2ef8
ext/soap: Fix SOAP xsd:hexBinary odd-length decoding in GH-22698
ext/soap: Improve SOAP scalar decoding error messages in GH-22706