Release Information
- Release Type
- Bug Fix Release
- Release Status
- QA Release Latest
- Branch Status
- Upcoming Release
PHP 8.6 is a development version, and is not recommended for production use. This is the latest QA release in the series.
ChangeLog
Core
- Deprecated "namespace" as a class constant name.
- Changed
run-tests.phpto run in parallel by default, using up to 10 automatically detected workers. Pass -j1 for sequential execution. - Allowed readonly properties to declare default values.
- Changed
run-tests.phpto run test subprocesses without a shell where possible. - Fixed GH-23083 (SEGV build_trace_args in
zend_exceptions.cwith -d error_include_args=On). - Fixed GH-23121 (
is_callable()wrongly accepts objects with no get_closure handler). - Passing a 3rd argument to
define()is now deprecated. - Naming a function readonly is now deprecated.
- Added stateless closure cache.
BZ2
- Passing an object for the Bzip2 {de}compression stream filter is now deprecated. Use
get_object_vars()on the object instead.
Curl
- Improved cURL option validation errors to include the option name.
- Raise a value error when the callback registered with
CURLOPT_READFUNCTIONreturns an unexpected long. - Fix bug GH-16513 (curl: exceptions in callbacks do not abort the request).
Date
- Update timelib to 2026.02.
- Added Time\Duration.
DOM
- Fixed bug GH-23116 (Stack overflow when normalizing a deeply nested DOMDocument).
- Fixed bug GH-23117 (Stack overflow when normalizing a deeply nested Dom\XMLDocument).
Exif
- Fixed
exif_read_data()allocating a HEIF meta box larger than the file it came from.
GMP
- Added optional
$definitely_primeoutput parameter togmp_prevprime(). - Added
gmp_powm_sec().
Intl
- Added static methods
IntlDatePatternGenerator::getSkeleton()andIntlDatePatternGenerator::getBaseSkeleton(). - Fixed
Collator::sort(),collator_sort(),Collator::asort(), andcollator_asort()to report UTF-8/UTF-16 conversion errors through the intl error handler instead of emitting a warning and continuing with an empty string. - Fixed
IntlListFormatter::__construct()leaving stale global error state after successful calls. - Fixed IntlNumberRangeFormatter leaving stale global error state after successful createFromSkeleton() and
format()calls. - Implemented GH-20255 (Add a predefined calendar constant in IntlDateFormatter for the proleptic gregorian calendar).
- Added
SpoofChecker::areBidiConfusable(). - Added
SpoofChecker::getBidiSkeleton(). - Added
SpoofChecker::getSkeleton(). - Fixed
IntlNumberRangeFormatter::format()crash when the formatting fails.
MbString
- Passing objects to
mb_convert_variables()is now deprecated.
MySQLi
- The
mysqli_get_charset()function is now deprecated.
PDO
- Fixed
pdo_raise_impl_error()emitting a warning under ERRMODE_SILENT.
PDO_ODBC
- Fixed bug GH-23016 (NULL values in long columns come back as garbage binary strings).
Readline
- Fixed the interactive shell not waiting for the pager process to exit.
Reflection
- Added
ReflectionAttribute::inNamespace(),ReflectionAttribute::getNamespaceName(), andReflectionAttribute::getShortName(). - Fixed bug GH-22905 (Reflection exception messages truncate on null bytes).
- Fixed
ReflectionProperty::isLazy()and skipLazyInitialization() using the parent slot when a child class hooks an inherited property. - Fixed segfault in
ReflectionMethod::createFromMethodName()on an uninstantiable subclass.
SimpleXML
- Fixed integer element offsets that cannot resolve aliasing an existing element.
SimpleXMLElement::__construct()now raises a ValueError when the$dataargument contains NUL bytes.- Fixed segfault when comparing uninitialized SimpleXMLElement instances.
SPL
- The
spl_classes()function is now deprecated, useReflectionExtension::getClassNames()instead. - The
spl_object_hash()function is now deprecated, usespl_object_id()instead. - The following ArrayIterator methods are now deprecated:
ArrayIterator::getFlags()ArrayIterator::setFlags()ArrayIterator::asort()ArrayIterator::ksort()ArrayIterator::uasort()ArrayIterator::uksort()ArrayIterator::natsort()ArrayIterator::natcasesort()ArrayIterator::unserialize()ArrayIterator::serialize()
Standard
- Added the "filter.max_filter_count" stream context option for php://filter URLs. Using more than 16 filters without configuring this option is now deprecated.
- The
metaphone()function is now deprecated, use a userland phonetic matching library instead. - Improved performance of
array_intersect(). - Fixed bug GH-23006 (
phpcredits()full-page HTML title saysphpinfo()). - The following functions now raise a ValueError when the
$filenameargument contains NUL bytes:fileperms(),fileinode(),filesize(),fileowner(),filegroup(),fileatime(),filemtime(),filectime(),filetype(),is_writable(),is_readable(),is_executable(),is_file(),is_dir(),is_link(),file_exists(),lstat(), stat(). - Fixed bug GH-22818 (
stream_filter_register()orphaned user_filter_map on shutdown re-registration). Io\Poll\Context::wait()now takes a Time\Duration object as a timeout.- Passing an object to
array_walk{_recursive} is now deprecated. Useget_object_vars()on the object instead. - The
is_double()function is now deprecated, useis_float()instead. - The
is_long()andis_integer()functions are now deprecated, useis_int()instead. - The
doubleval()function is now deprecated, usefloatval()instead. - The
strcoll()function is now deprecated, useCollator::compare()instead. - The SORT_LOCALE_STRING constant for the family of sort functions is now deprecated, use one of the following functions instead:
Collator::sort()Collator::asort()Collator::sort()Collator::sortWithSortKeys()
Streams
- Fixed
file_put_contents()LOCK_EX early return leaking stream error operation depth.
XSL
- Fixed use-after-free when a DOMDocument subclass
__clone()retains the stylesheet copy made byXSLTProcessor::importStylesheet().
Zlib
- Passing an object for the zlib deflate and inflate stream filter is now deprecated. Use
get_object_vars()on the object instead. - Passing an object to the
$optionargument to deflate_init and inflate_init is now deprecated. Useget_object_vars()on the object instead.
Commit List
Arnaud Le Blanc
- Follow-up GH-22829 in a652a00c02
- CS in 40c3e247f9
php_printf: introduce %pS to replace custom specifier %S in GH-22930- JIT: Preserve parent regs in
zend_jit_deoptimizer_start()in GH-22916
Calvin Buckley
- odbc: Quote spaces in UID/PWD appended to connection string in GH-22791
zend_call_stack.c: AIX backend in GH-22906- Remove
php_error_docref_uncheckedin GH-23042 - TSRM: don't use initial-exec on AIX in GH-23145
coderZhao
Daniel Scherzer
- Reflection: Add regression tests for error messages with null bytes in 14b6cd3636
- GH-22905: avoid truncation on null bytes in reflection exceptions in 866696459a
- NEWS for PHP 8.4 in 1c491e67c0
- NEWS for PHP 8.5 in 97e0b1c785
- NEWS for master in cb6262142e
- Reflection: use new
%pSformat specifier in GH-23005
David Carlier
ext/standard:stream_filter_register()orphaned user_filter_map on shutdown re-registration in 46352f7ead- Use
zend_hash_add_new_ptr()for the user_filter_map insertion in 33cdf36326 ext/sysvshm: do not trust$sizewhen opening an existing segment in f0d244ab3eext/intl: GH-20255 IntlDateFormatter adding proleptic gregorian calendar support in 25a2d9755eext/intl: introduceSpoofChecker::areBidiConfusablein f985f774c6ext/intl: AddSpoofchecker::getSkeleton()in 8ecc1a67f6- Zend:
include()with a non-literal argument reads out of bounds with error_include_args=1 in bf2ba7a800 - Zend:
is_callable()wrongly accepts objects with no get_closure handler in bb0ab98b9d ext/libxml: Fix build failure with libxml2 2.15 in bc7537dbf0ext/zip: addGlob() and addPattern() ignore their default options in 8d5b0d6fb4ext/intl:IntlNumberRangeFormatter::format()crash when the formatting fails in 2f08d44e86
David CARLIER
ext/intl:get_icu_value_internal()to reduce manual memory manageme… in GH-19433
Derick Rethans
- Update to timelib 2026.01 in 69b6debd80
- Adjust test for slightly different behaviour with empty strings in cc6a8c6542
- Update timelib to 2026.02 in 389d4a71e4
Gina Peter Banyard
- streams: various small refactoring for stream error API in GH-22847
- Zend: add _ex variants for calling known functions/FCC in GH-22910
- zip: convert ZIP option remove_path to
zend_string*in bcb05dcf6f - zip: convert ZIP option add_path to
zend_string*in 0d440d3768 - zip: add static storage specifier for private functions in 6739acedc8
- zip: use
zend_string*to build entry_name in 73e3e054e2 - std: add test for unserialize_callback_func INI setting in 5226e2f49f
- streams: refactor
_php_stream_opendir()to use early returns in 0c84160e11 - streams: use new stream error API in
_php_stream_opendir()in 29c237bf88 - main: convert unserialize_callback_func global to
zend_string*in c82acefe47 - main: convert last_error_lineno global to type uint32_t in 6877f77c62
- main: group Windows globals together in 1de8f4f16d
- main: convert doc_root global to
zend_string*in 1b204626c5 - main: convert error_log global to
zend_string*in 9362fc793c - main: convert output_handler global to
zend_string*in e0221be81e - streams: refactor
_php_stream_open_wrapper_ex()to use early returns in d75f79e2ac - streams: use
php_stream_wrapper_warn()in_php_stream_open_wrapper_ex()in f9ac6c13c4 - streams: use common cleanup code in
_php_stream_open_wrapper_ex()in 605ff6e11b ext/standard: Throw ValueError for filenames with null bytes in d3c95d1745ext/standard: Refactorphp_stat()API in 732243fb66- Zend: reuse
zend_parse_arg_func()inzend_parse_arg_impl()in GH-22937 - sapi: convert current_user field to
zend_string*in GH-22902 - streams: check class exists when attempting to register stream filter in GH-22823
ext/reflection: move ReflectionAttribute tests into subfolder in ee019fab5aext/reflection: add namespace methods to ReflectionAttribute in 9e9445f742- NEWS/UPGRADING entries for new ReflectionAttribute methods in 9ed85af67e
- main: duplicate PG(output_handler) zstr in deb6ef1db1
- output: only use FCC for storing user output handler in GH-22815
- standard/fpt_fopen_wrapper: use size_t instead of int in ec80461431
- standard/http_fopen_wrapper: add const qualifiers in 9658dfc1f3
- serializer: move unserialize_callback_func INI tests to subfolder in 1b061f851c
- serializer: more unserialize_callback_func INI tests with different types of string callables in ec562d07d2
- serializer: must duplicate unserialize_callback_func global zstr in 79d76a560a
- Zend: move '\' and lowercase handling to
zend_fetch_function()in GH-22966 - streams: call
php_stream_wrapper_warncalls checking REPORT_ERRORS is set in GH-22965 - Zend: pass callable as
zend_string*inzend_is_callable_check_func()in 65fe066d0f - Zend: rename
zend_is_callable_check_funcfunction in 46ab695271 - Zend: use bool type for call_via_handler variable in c309ad8124
- Zend: move and rename some
zend_stringdefinitions in 4c3bd1a915 - Zend: remove goto in
zend_is_callable_at_frame()in af7a6c704a - Zend: unify cleanup in
zend_is_callable_at_frame()in 76e0734ec5 - Zend: move true function search out of main callability check in 0dc8a54f62
- spl: use
zend_call_known_function()when possible in GH-22972 - Zend: ZPP use uint32_t type for variable storing result of
ZEND_CALL_NUM_ARGS()in 41b4d43d3e - Zend: move some basic forwarding function definitions to the header in GH-22936
- Zend: use C enum for ZPP error states in add8d542b6
- Zend: Remove ZPP_ERROR_WRONG_COUNT case in bbf82d7a84
- Zend: handle non-string arguments for ZPP class-string specifier as expected in GH-23001
- Zend: remove
zend_get_compiled_variable_value()in GH-23013 - calendar: improve ValueError for
jdtounix()in 588dd0445c - Zend: remove
zend_save_error_handling()in GH-23011 - tests: remove unnecessary ZPP tests in GH-23020
- Fix GH-23082: unserialize_callback_func can no longer be reset to its empty default at runtime in GH-23096
- Zend: mark
zend_unfinished_calls_gc()as static in GH-23012 - Zend: deprecate naming a function readonly in a9ba369abe
- standard: deprecate passing an object to
array_walk{_recursive}() in 7e0d5c75e7 - zlib: deprecate passing objects as array in f8c854e82f
- bz2: deprecate passing objects as array in 3fda4e9c18
- mbstring: deprecate passing objects as vars to
mb_convert_variables()in 7cc143235d - standard: deprecate aliases with non canonical type name in 0b14af3b98
- standard: deprecate strcoll and SORT_LOCALE_STRING in 22217b3bbb
- Zend: move builtin function tests into subfolder in 75abe1c654
- Zend: deprecate passing a 3rd argument to
define()in acd342d82d - spl: deprecate
spl_object_hash()in 2c1c61de07 - spl: deprecate
spl_classes()in 6214a21659 - spl: deprecate ArrayIterator methods that make little sense in e95647ce36
- Zend: remove
zend_parse_parameter()in GH-23051 - Amend UPGRADING for recent deprecations and engine API changes in 34f5a729d3
- zlib: Add test with invalid levels in 1cf82bef0a
- zlib: use new stream error API in 148afdb60a
- standard: deprecate passing objects to
http_build_query()in GH-23202 - Update NEWS/UPGRADING for deprecations in 969a50d995
Holly Schilling
- Improve asymmetric visibility write performance in fast path (GH-22709) in 94136cf9bf
Ilia Alshanetsky
- Free the hooked property value when
json_encode()sees an exception in c35253d364 - Add NOT_SERIALIZABLE to XMLWriter, XMLReader, SNMP, tidy, and tidyNode in GH-21694
- Free previous state when re-calling Reflection*::__construct() in 87f8d17426
- zip: require remove_path to be shorter than the path it strips in GH-22973
- Parse qualified reflection names with a length-aware search in 3a9d86a81b
- Avoid truncation on null bytes in class and function names in 841fe26c11
- Check
object_init_ex()inReflectionMethod::createFromMethodName()in b80ef095ea - Resolve the effective property in ReflectionProperty lazy APIs in ae42ecf1f3
- sysvmsg/sysvsem: fix IPC_PRIVATE and out-of-range key handling in GH-22956
ext/sysvshm: don't orphan the segmentshm_attach()just created in a72e0636fe- zip: skip the entry name allocation when there is no add_path in GH-22975
- streams: tidy the wrapper error log when the opener succeeds in GH-22977
- Fix GH-23016: pdo_odbc returns garbage for NULL long columns in 05202568c4
- sapi/cli: guard Content-Length overflow and enforce post_max_size in GH-22017
- SAPI: clear current_user and content_type_dup after releasing them in GH-22974
- Fix SimpleXML integer offsets that cannot resolve aliasing a node in 9e696413e8
- Reject NUL bytes in the SimpleXMLElement constructor in GH-23069
- Balance stream error ops on file_put_contents LOCK_EX URL reject in GH-23186
- Honor ERRMODE_SILENT in pdo_raise_impl_error in GH-23070
- Fix segfault comparing uninitialized SimpleXMLElement instances in 7b1f5637b6
- Fix use-after-free when
__clone()retains the stylesheet copy in 11047a7a66 - Bound the HEIF meta box allocation by the file size in 82ac0da470
Ilija Tovilo
- Fix use-after-free in OpenSSL empty cafile warning (GH-22880) in d2780bcbae
- Fix test file conflict in facf3f99cf
- Add stateless closure cache in f47cd216e9
Jakub Zelenka
- Add stream socket so_linger context option in GH-20808
Joe Ferguson
- Update versions for PHP 8.6.0beta1 in 8d8126a497
Jorg Adam Sowa
- Use
zend_hash_find_ptr_lc()for case-insensitive name lookups (batch 2) in GH-22591 - Add tests for
session_regenerate_id()write/destroy failure paths in GH-22687
Kamil Tekiela
- mysqli: Deprecate
mysqli_get_charset()in GH-23206
lazerg
Lazizbek Ergashev
- Fix GH-22206: Enable the TAILCALL VM only on Clang in GH-23054
- Add a stack limit check in
zend_hash_compare()in GH-23090 - Add a stack limit check in
php_array_walk()in GH-23125 - Add a stack limit check in
php_array_replace_recursivein GH-23124 - Add a stack limit check in
php_compact_var()in GH-23126 - Add a stack limit check in
php_count_recursive()in GH-23197 - Fix GH-23204: use-after-free when
__toString()destroys an array argument in 8ce7f7f5e9
Lothar Serra Mari
- tests: Allow overriding
TEST_PHP_EXECUTABLEfor FPM SAPI in GH-23087 ext/gd: Fix two external libgd tests in GH-23138
Louis-Arnaud
- Enforce zero arity in
apache_get_version()andapache_get_modules()in GH-23102
Mateusz Łukasik
- configure.ac: register main/io as a build directory in GH-22913
Matthias Goergens
- Fix mbregex search state after cache invalidation in 03a71535c3
- Fix mbregex search state after cache invalidation in da4b676047
- Fix mbregex search state after cache invalidation in efd178b1b6
mehmetcan
- Optimize
array_intersect()using hash-based matching in GH-23019
Máté Kocsis
- Fix typed reference property writes during
Uri\Rfc3986\UriBuilder::reset()in GH-23144
ndossche
- sqlite3: Fix leak when trying to close db if blob stream is still open in eaac0378e3
- session: fix corruption in mod_mm in a033601273
- Fix GH-23043: broken session id code can cause
zend_mm_heapcorrupted in 9366c61247 - Improve merge in d7911aa9ea
NickSdot
- Tests: Fixes leaked System V shared-memory segments in tests in GH-22911
ext/mysqli: applied fixers to improve test robustness in GH-22929- Run scandir overflow test on Windows only in GH-22934
- Prevents tests from leaking System V IPC objects in GH-22912
ext/mbstring: applied fixers to improve test robustness in 7b78eb4fcc- Applied fixers to improve test robustness (
ext/intl,ext/phar) in GH-22985 ext/random: applied fixers to improve test robustness in a5a94766b6ext/gmp: applied fixers to improve test robustness in GH-22987- run-tests: run test subprocesses without a shell where possible in GH-22957
- Fix redirected-test progress accounting in parallel runs in GH-22952
- Applied fixers to improve test robustness to extensions with no code owners in GH-23018
- CI: fix test error in 588dd04 in GH-23033
ext/intl: applied fixers to improve test robustness in GH-23021ext/zip: applied fixers to improve test robustness in GH-23034ext/pgsql: applied fixers to improve test robustness in GH-23040ext/odbc: applied fixers to improve test robustness in GH-23022ext/dba: applied fixers to improve test robustness in GH-23027- tests: Cache failed service probes in GH-22944
ext/session: applied fixers to improve test robustness in GH-23036- tests: applied fixers to improve test robustness in GH-22988
ext/hash: cleaned up test in GH-23041ext/spl: applied fixers to improve test robustness in GH-23058- Zend: add readonly reinitable helper in GH-22718
ext/pdo_sqlite: applied fixers to improve test robustness in GH-23032- sapi/cli: applied fixers to improve test robustness in GH-23137
ext/pdo: applied fixers to improve test robustness in GH-23023- Run tests in parallel by default in GH-22939
- CI: Select Windows test workers automatically in GH-22946
- core: Deprecate using
namespaceas class constant name in GH-22964 ext/standard: improved tests in GH-23184- perf: speed up benchmark checkout in GH-23211
- docs: Clarify
--CREDITS--section (GH-23215) in 1f1570906e
Nora Dossche
- Fix unchecked BN_bin2bn() call in GH-22754
- openssl: Fix checks on BIO_get_mem_ptr() in GH-20998
- Properly propagate X509_STORE_CTX_new() in GH-22625
- openssl: Check return value of SSL_CTX_set_alpn_protos() in GH-22996
- openssl: Check return value of SSL_CTX_set_alpn_protos() in GH-22996
Remi Collet
- Fix error: static declaration of copy_file_range follows non-static declaration in 774e5b6455
Rob Landers
- Update test file path for bug60771 in GH-22980
Shivam Mathur
- Fix hMailServer URL in Windows CI in GH-23055
- Fix Windows mail handling regressions in GH-23060
ext/libxml: Export xmlCtxtSetOptions on Windows in GH-23178- Fix GH-23120 test on Windows x86 in GH-23180
- Upgrade php-sdk to 2.8.2 in GH-23193
Sjoerd Langkemper
ext/standard: Warn when number base conversion loses precision in GH-22371ext/standard: limit maximum number of filter chains in GH-22110ext/curl: error when curl read func returns unexpected long in ac37a9760bext/curl: show curl option name in error message in GH-22908ext/curl: abort curl transfer if callback throws exception in GH-22745- Zend: compile time assert on Bucket size in GH-23079
tekimen
- Update
ext/mbstring/tests/gh21036.phptin 0ee81b4060 - Update
ext/mbstring/tests/gh21036.phptin f699538427 - Update
ext/mbstring/tests/gh21036.phptin 0d9b381beb
Tim Düsterhus
- run-tests: Improve handling of test reproduction helpers in GH-23066
- date: Add new timelib/duration.c source file to autoconf in GH-23077
- Time\Duration in GH-23073
- standard: Take
Time\DurationinIo\Poll\Context::wait()in GH-23092 - date: Fix
Z_PARAM_DATE_TIME_DURATION()error handling in GH-23097 - date: Correctly handle
Duration::__construct()calls in GH-23098 - standard: Fix error reporting for negative timeouts in
Io\Poll\Context::wait()in GH-23099 - tree-wide: Generate nicer code in
Z_PARAM_*()helpers wrappingZ_PARAM_*()in GH-23100
Volker Dusch
- RM docs: Update security release procedure in GH-22953
Weilin Du
ext/gmp: Addgmp_powm_sec()in GH-22852ext/gmp: expose the possibility of being a prime ingmp_prevprimein GH-22907ext/intl: Fix Collator sort conversion error handling in GH-22893ext/standard: Fixphpcredits()heading alignment in GH-22918- Fix GH-22935: Make
php_hash.hincludable from C++ code in GH-22940 ext/soap: Fix SOAP classmap validation for integer keys in GH-22884- Zend: Refactor deduplicate auto-global checks in GH-22963
ext/intl: Reset IntlListFormatter error state in constructor in GH-22931ext/intl: Refactor global error resets in GH-22990- Do not install internal main/io headers on Windows in GH-23003
- Zend: factor out guarded lazy-proxy forwarding in object handlers in GH-22983
ext/readline: write test for readline CLI in GH-22994ext/readline: Fix flacky readline CLI pager test in 34a294993dext/intl: AddSpoofChecker::getBidiSkeleton()in GH-23017- Fix GH-23006: Correct
phpcredits()full-page HTML title in GH-23007 ext/intl: Include <limits> for std::numeric_limits in GH-23072ext/intl: Add IntlDatePatternGenerator skeleton methods in GH-23078- Fix GH-23120:
DOMNode::isEqualNodestack overflow on deeply nested trees in GH-23140 ext/intl: Fix stale intl error state in IntlNumberRangeFormatter in GH-23191- Zend: Name map ptr chunk size constants in GH-23109
- RFC: Deprecate
metaphone()in GH-21889 ext/opcache: Name map ptr chunk size constants in GH-23212