PHP 8.6.0beta2: Downloads, Changelog, News

Release Information

Release
8.6.0beta2
PHP Version
PHP 8.6
Release Date
Release Type
Security Update
Release Status
QA Release
Branch Status
Upcoming Release

PHP 8.6 is a development version, and is not recommended for production use. PHP 8.6 is scheduled to reach General Availability on 2026-11-19.
PHP 8.6.0beta3 is the latest QA release in PHP 8.6.

Downloads

Source Code

Git Clone
Use Git to clone the 8.6.0beta2 tag from the PHP Git repository.
git clone https://github.com/php/php-src.git --depth 1 --branch php-8.6.0beta2
How to compile PHP
PHP can be compiled by setting up the dependencies, building the configure script (./buildconf), configuring the build ./configure, and running make.
Detailed articles on how to compile PHP are available for Ubuntu/Debian based systems and Fedora/RHEL based systems.

Docker/Podman Containers

PHP CLI
PHP CLI Containers images only include the PHP CLI, and no FPM or Apache modules. The Alpine builds are lightweight, but may introduce incompatibilities due to their musl builds. Albeit their larger size, the Debian-based (without the "-alpine" suffix) images are more complete, and widely used.

Alpine-based: Lightweight, but may introduce incompatibilities due to their musl builds.
docker pull php:8.6.0beta2-cli-alpine

Debian-based: More compatible with other components, complete, and are widely used.
docker pull php:8.6.0beta2-cli
PHP CLI + Web Server Integration
These container images include PHP CLI, and a web server integration. FPM container images can be integrated with web servers such as Nginx, Caddy, and Apache with Event MPM. The Apache container images include Apache web server, integrating PHP as an Apache module.

Alpine-based: Lightweight, but may introduce incompatibilities due to their musl builds.
docker pull php:8.6.0beta2-fpm-alpine

Debian-based ZTS Apache: Includes Apache web server integrating PHP as an Apache module.
docker pull php:8.6.0beta2-apache

Debian-based NTS FPM: PHP-FPM, can be integrated with Nginx, Caddy, and other web servers over Fast CGI.
docker pull php:8.6.0beta2-fpm

ChangeLog

Core

  • Fixed bug GH-15375 (Nested "yield from" skips items after a valid() or next() call on the inner generator).
  • Fixed GH-10497 (Allow direct mutation of objects stored in constants or class constants via OBJ->prop = $val).
  • Reverted GH-22833, which attempted to fix bug GH-18985.
  • Using the return statement in a finally block is now deprecated.

Curl

  • Set content length using CURLOPT_POSTFIELDSIZE_LARGE instead of CURLOPT_POSTFIELDSIZE. This makes it possible to post strings larger than 2GB on some platforms, e.g. Windows.

DOM

  • Fixed a typo in the DOMException message for INUSE_ATTRIBUTE_ERR.
  • Fixed bug GH-22624 (use-after-free via DOMNameSpaceNode after DOMDocument::xinclude()).
  • Fixed a use-after-free when cloning a DOMNameSpaceNode after DOMDocument::xinclude().
  • Fixed a crash in DOMXPath when a php:function callback receives a nodeset and a later callback returns a node from another document.
  • Fixed bug GH-23331 (UAF when node_list_unlink() skips attribute children that still have a live wrapper).
  • Fixed a use-after-free when Dom\Element::setAttributeNS() replaces the value of an attribute whose child still has a live wrapper.

GD

  • Fixed imageaffinematrixget() and imageaffinematrixconcat() reporting the wrong argument in error messages.
  • Fixed imageaffinematrixget() to enforce the documented array|float type for the $options parameter.

Intl

  • Fixed grapheme_strrev() treating UBRK_DONE as a byte index and leaving the result without a terminating NUL.
  • Fixed a double-free when IntlGregorianCalendar construction fails after the ICU constructor adopts the TimeZone.
  • Fixed bug GH-23094 (NumberFormatter parsing offsets use UTF-16 positions for UTF-8 strings).
  • Fixed Locale::parseLocale() reading past a trailing '-' or '_'.
  • Fixed grapheme_str_split() treating UBRK_DONE as a byte index.

Opcache

  • Fixed a tracing JIT crash when compiling a side trace for a method of a class that could not be stored in the inheritance cache. (GH-21710)

PDO

  • Fixed a leak when a persistent connection failed a liveness check with no other live PDO handle.

PDO_PGSQL

  • Fixed several lazy fetch (PDO::ATTR_PREFETCH => 0) defects: an infinite loop when cleaning up a fetch left in a COPY, a use-after-free when a statement with emulated or disabled prepares is destroyed, a connection left busy for the next fetch, and rows delivered from a result another statement took over.

PGSQL

  • Fixed the class name casing of pg_close_stmt()'s connection parameter.

Phar

  • Fixed Phar archives being automatically detected when ".phar" only occurs in a directory name or is not a filename extension in an included file's path.

Readline

  • Fixed class constant completion in the interactive shell.

Zip

  • Fixed bug GH-23276 (ZipArchive subclass storing its own stream cannot be garbage collected).
  • Fixed bug GH-17787 (ZipArchive stream stops reading early when the archive is freed while the stream is still open).

SAPI

  • Fixed fuzzer targets failing to build in isolation.
  • Fixed returns uninitialized value on LiteSpeed lsapi SAPI

Session

  • Fixed bug GH-23056 (missing handler name in session write warning).
  • SessionHandler::validateId() is now implemented, so session.use_strict_mode applies to the built-in handler.
  • It is now deprecated to pass an object that does not implement the create_sid() and validateId() methods.
  • A deprecation is now emitted when implementing SessionHandlerInterface on a class which doesn't define the create_sid() or validateId() methods, as those will be moved from SessionUpdateTimestampHandlerInterface and SessionIdInterface to SessionHandlerInterface.

SNMP

  • It is now possible to use the AES192, AES192C, AES256, and AES256C as SNMPv3 security protocols if the underlying library supports them.
  • It is now possible to reset the MIB tree using the new snmp_init_mib() function.
  • Additional MIB parsing and output control functionality has been exposed via the snmp_set_mib_option(), snmp_set_output_option(), snmp_set_string_output_format() functions, the $numeric_index, $numeric_timeticks, $extended_index, $dont_print_units, $escape_quotes, $print_hex_text SNMP properties, and the SNMP::setOidOutputFormat(), SNMP::setStringOutputFormat() methods.

Sodium

  • Fixed incorrect parameter name in sodium_add(), sodium_memcmp(), and sodium_compare() length-mismatch error messages.

SPL

  • The following SplFileObject methods have been deprecated SplFileObject::fgetcsv(), SplFileObject::fputcsv(), SplFileObject::setCsvControl(), and SplFileObject::getCsvControl().

Standard

  • Fixed incorrect parameter name in convert_uudecode() warning.
  • Added support for the "<" and ">" endianness modifiers in pack() and unpack() format codes.

Zlib

  • Fixed bug GH-22142 (Assertion failure in deflate_init() when an option object has uninitialised typed properties).

Commit List

Alexandre Daubois

  • standard: Add support for endianness modifier in pack()/unpack() format codes in GH-21074
  • UPGRADING: document the unpack() element name BC break in GH-23446

Arnaud Le Blanc

  • PFA: Fix strict_types checking when a const arg is inlined in GH-23256
  • PFA: Fix magic method resolution in GH-23251
  • PFA: Extend local pointer map after loading PFA from SHM in GH-23250

Arshid

  • ext/spl: Narrow tentative return types for DirectoryIterator methods in GH-22642
  • Zend: Use %pS for zend_string in zend_throw_error in GH-23364

Calvin Buckley

  • configure.ac: Use 64-bit fibers on AIX without overriding triplet in GH-23284

ColumbusLabs

Daniel Scherzer

  • Arginfo: add and use known string for "8.6" in GH-23222
  • [RFC] Deprecate ReflectionProperty::setValue() with wrong types in 29f351d355
  • [RFC] Deprecate ReflectionProperty::setRawValue() with wrong types in 1b5de53960
  • [RFC] Deprecate ReflectionMethod invocation for static methods with objects in d3f4eada10

David Carlier

  • ext/zip: fix extractTo()/getFrom*() success on CRC-corrupted entries in 2a2b337392
  • ext/dom: use-after-free via DOMNameSpaceNode after DOMDocument::xinclude() in e5623ea1e9
  • ext/dom: Fix GH-22522: Double-free of namespaces on OOM during parsing in 50de982d31
  • ext/standard: array_merge_recursive() fix leak in 4c71b4e58e
  • ext/opcache: opcache.interned_strings_buffer per FPM pool crashed on restart in bfbae397a3
  • Revert "Fix GH-22142: Assertion failure in zendi_try_get_long() on IS_UNDEF." in 7a8131e09c
  • ext/zlib: deflate_init() assertion failure on uninitialised typed properties in c0e7d498c5

David CARLIER

eskyuu

  • snmp: Add support for draft SNMPv3 AES192 and AES 256 (and Cisco variant) security protocols in GH-21451
  • Add snmp_init_mib function to allow MIB tree to be reset using environment variables in GH-21452
  • snmp: Additional SNMP library output formatting options in GH-21502

Eyüp Can Akman

  • Fix GH-17787: ZipArchive stream truncates when the archive is freed in GH-22555

Florian Engelhardt

  • Fix OPcache memory protection race under ZTS in GH-23081

Gina Peter Banyard

  • Zend: remove zend_is_countable() in GH-23010
  • Zend: remove Z_PARAM_FUNC_OR_NULL_WITH_ZVAL() in GH-23234
  • com: use zend_object* rather than zval* in GH-23255
  • Zend: pass $this as a zend_object* in fbb2e1f23d
  • Zend: use zend_object* for this_ptr in 7a5e452f14
  • Zend: write tests for some ZPP specifiers in GH-23192
  • soap: call_user_function API doesn't care about the function table in GH-22941
  • session: fix some expectations for C session handlers in GH-23297
  • reflection: pass zend_object* to _class_string() in GH-23279
  • odbc: use custom ZPP to extract result and connection in GH-23261
  • session: add create_sid and validateId methods to some tests in 00f90287a1
  • session: deprecate passing save handlers without create_sid() and validateId() methods in 6901c87aea
  • NEWS/UPGRADING for return in finally deprecation in f7e9b5a820
  • Optimizer: add const qualifiers in GH-22009
  • main/output.c: use RETURN_BOOL() when possible in 6734892444
  • Zend: normalise behaviour around class name ZPP specifier in GH-23359
  • snmp: use size_t type instead of int type in d7bfcb2ea6
  • snmp: use bool type instead of int type in 62756c367e
  • snmp: use zend_result type instead of int type in 16b3863d7d
  • snmp: move stubs into an explicit global namespace in d3fa8bb497
  • Update NEWS/UPGRADING for snmp and session changes in 399e6bf5b9
  • Zend: refactor zend_parse_arg_impl() to return zend_expected_type in GH-23052
  • spl: deprecate SplFileObject CSV methods in GH-23437
  • Update NEWS/UPGRADING for SplFileObject deprecations in ccb6c5f988

Go Kudo

  • sapi/lsapi: fix returns uninitialized value in GH-23281

Ilia Alshanetsky

  • ext/session: check the created ID before validating it in 0df284a4fc
  • Fix GH-15375: nested "yield from" skips items after valid()/next() in 0ccff76763
  • Fix GH-17126: get_class_methods omits __invoke for Closure in GH-21879
  • Fix DOMNameSpaceNode clone UAF after xinclude in d09e5e2bc2
  • Fix DOMXPath crash wrapping a foreign node after a nodeset callback in fcdc4fbf85
  • Stop grapheme_strrev from using UBRK_DONE as a byte index in GH-23323
  • Fix IntlGregorianCalendar double-free of an adopted TimeZone in GH-23321
  • Bound getSingletonPos before reading the next separator in GH-23350
  • Stop grapheme_str_split from using UBRK_DONE as a byte index in GH-23349
  • Fix GH-23331: UAF when an attribute child keeps a live wrapper in d19f248f8e
  • Fix UAF when setAttributeNS() frees a wrapped attribute child in 0dd7f31f15
  • Fix leak when persistent PDO liveness check fails in b782a27242
  • Document and test SessionHandler::validateId() in GH-23071
  • ext/session: report a rejected session cookie header in 0870487b62
  • JIT: persist the SHM op_array in trace exit_info in 7873640e08

Ilija Tovilo

  • Revert lineno changes in fde23dffbc
  • Fix enabling of opcache in community job for PHP <8.5 in 4fa25b04e7

Jorg Sowa

  • Fix NULL pointer dereference in SessionHandler::create_sid() in d974c64303

Juliette

  • PHP 8.5 | UPGRADING: add missing finfo function in GH-23263

Kamil Tekiela

  • Collapse if statement in php_stat in GH-23219
  • gen_stub.php clean up and small refactoring in GH-23230
  • ext/mysqli: Deprecate mysqli_stmt_init in GH-23209

Khaled Alam

  • Allow direct mutation of objects stored in constants or class constants via OBJ->prop = $val in b16cab7da8

Kuba Werłos

  • Prevent inlining of zend_compile_expr_inner() to guarantee low stack usage of compilation in GH-23294

lacatoire

  • ext/pgsql: fix the class name casing of pg_close_stmt()'s connection in fb604aab1d

laokz

  • tests/GHSA-x692-q9x7-8c3f.phpt: Add extensions required in GH-23408

Lazizbek Ergashev

  • session: fix create_sid()/validateId() check depending on interface order in GH-23329
  • Fix GH-23056: missing handler name in session write warning in GH-23059
  • Fix GH-23301: nested "yield from" repeats a value after "yield from []" in GH-23302
  • sapi/cli: check php_cli_server_client_send_through() return value in 6748db3ff5

Levi Morrison

  • Fix memfd_create header inclusion in b02e38a4a8
  • Fix memfd_create config header inclusion in 1c298565a6
  • Fix JUnit timing aggregation for long-running tests in GH-23438
  • Fix JUnit timing aggregation for long-running tests in GH-23438

Louis-Arnaud

  • ext/sockets: socket_cmsg_space() returns int, never null in GH-23345
  • ext/zip: declare true as the return type of zip_entry_close() in GH-23395
  • ext/standard: declare true as the return type of header_register_callback() in GH-23402
  • ext/sodium: Fix parameter name in the length-mismatch errors in GH-23396
  • standard: Fix parameter name in the convert_uudecode() warning in GH-23306

Matteo Beccati

  • Update versions for PHP 8.6.0beta2 in 504132215d

Michael Orlitzky

  • ext/gettext/tests: updates for musl-1.2.6 in 0f5b60ac70

Mrmaxmeier

  • sapi/fuzzer: depend on PHP_BINARY_OBJS instead of PHP_SAPI_OBJS in GH-23394

Máté Kocsis

  • lexbor: Add new URL patches in GH-23274
  • Optimize cloning in the real-time benchmark suite in f3341ac254
  • Implement "Followup improvements for ext/uri" RFC - WHATWG URL building in GH-22268
  • Optimize the real-time benchmark workflow in f009ad0df8
  • Retrieve the full commit SHA from the database of the real-time benchmark in 271f689482

NickSdot

  • [RFC] Allow Readonly Property Defaults (GH-22588) in a2640aebc9
  • fix: isolate rmdir test fixtures in GH-23225
  • ext/curl: applied fixers to improve test robustness in GH-23038
  • fix: flaky cli server when parallel in GH-23238
  • ext/curl: Test exception type in curl_read_function_error_on_int.phpt‎ in a8d0fb4229
  • ext/curl: Test exception types in tests added in GH-22745 in 337af2feab
  • ext/soap: applied fixers to improve test robustness in GH-23031
  • ext/pcntl: applied fixers to improve test robustness in GH-23037
  • ext/xml: applied fixers to improve test robustness in GH-23025
  • ext/gd: applied fixers to improve test robustness in GH-23132
  • ext/uri: applied fixers to improve test robustness in GH-23271
  • ext/uri: Remove dead Uri\WhatWg\Url::getFragment() method implementation in GH-23303
  • ext/date: applied fixers to improve test robustness in 170ca63f7b
  • ext/sockets: Fixes CI failure introduced by GH-23345 in 6d3c5c67dd
  • ext/gettext: applied fixers to improve test robustness in GH-23028
  • ext/ffi: applied fixers to improve test robustness in GH-23131
  • ext/opcache: applied fixers to improve test robustness in GH-23133
  • ext/xmlwriter: applied fixers to improve test robustness in GH-23026
  • ext/simplexml: applied fixers to improve test robustness in GH-23030
  • ext/libxml: applied fixers to improve test robustness in GH-23024
  • ext/bcmath: applied fixers to improve test robustness in GH-23129
  • ext/xmlreader: applied fixers to improve test robustness in GH-23035
  • Zend: applied fixers to improve test robustness (part 1/8) in GH-23308
  • Zend: applied fixers to improve test robustness (part 2/8) in GH-23310
  • Zend: applied fixers to improve test robustness (3/8) in GH-23311
  • ext/json: applied fixers to improve test robustness in GH-23029
  • Zend: applied fixers to improve test robustness (part 4/8) in GH-23312
  • Zend: applied fixers to improve test robustness (part 5/8) in GH-23313
  • Zend: applied fixers to improve test robustness (part 6/8) in GH-23314
  • ext/dom: applied fixers to improve test robustness in GH-23130
  • Zend: applied fixers to improve test robustness (part 7/8) in GH-23315
  • tests: asserted error classes for test introduced in GH-23123 in GH-23179
  • Zend: applied fixers to improve test robustness (part 8/8) in GH-23316

Ondrej Mirtes

  • Make strtolower()/strtoupper() frameless in 89a17252a4

Osama Aldemeery

  • Deprecate returning from a finally block. in GH-22509

Shivam Mathur

  • Fix test file conflict on Windows in GH-23226
  • Fix SNMP build with modern Net-SNMP API in GH-23419

Sjoerd Langkemper

  • ext/curl: set curl post size using CURLOPT_POSTFIELDSIZE_LARGE in GH-22842

Steve Wilton

  • snmp: use book type for boolean options and rename variables in 7268b84ec1
  • snmp: use zend_result return type for functions returning SUCCESS/FAILURE in fe77a737c0
  • snmp: update php_snmp_write_t and php_snmp_read_t to use zend_result return type in 79c11935fa

Weilin Du

  • ext/readline: Fixed the interactive shell not waiting for the pager process to exit in GH-23047
  • ext/readline: Fix class constant completion in readline interactive shell in GH-23218
  • ext/snmp: Add XFAIL on several tests (#22476) in GH-23231
  • tree-wide: Refactor with zend_string_ends_with* in GH-23216
  • ext/phar: only .phar extensions in file names trigger automatic archive detection in GH-23260
  • Zend: Various refactor with zend_hash_str_find_ptr_lc in GH-23293
  • Zend: Use lowercase hash lookup for duplicate function checks in 48186fcd4c
  • Zend: Reuse zend_fetch_function() for dynamic calls in 3eeca78fcb
  • Zend: Use pointer hash lookups for methods in d3f0e07df3
  • Zend: Avoid temporary lowercase static method names in fa2ceb1a9a
  • Zend: Use pointer hash lookup for classes in 7a3785a78b
  • Zend: Use pointer hash lookups for property metadata in 5f9e5e0886
  • Zend: Use pointer hash lookup for property guards in 62e870868d
  • Zend: Use zend_hash_find_ex_ptr() for __invoke in 98a259edd2
  • ext/zip: Fix AES-192 and AES-256 support reporting in phpinfo() in GH-23319
  • CI: fix flacky ext/mysqli/tests/protocol_stmt_row_fetch_data.phpt in GH-23330
  • ext/snmp: Put XFAILs under SKIPIF section in tests in GH-23237
  • ext/gd: Fix incorrect argument numbers in GD affine function errors in GH-23356
  • ext/dom: Fix INUSE_ATTRIBUTE_ERR message in GH-23381
  • ext/gd: Add ZPP specifier for array|float parameters in GH-23384
  • Fix GH-23276: Collect ZipArchive subclasses holding their own streams in GH-23282

Yudai Takada

武田 憲太郎

  • ext/pdo_pgsql: Fix several lazy fetch defects in 0b91828b01
Subscribe to PHP.Watch newsletter for monthly updates

You will receive an email on last Wednesday of every month and on major PHP releases with new articles related to PHP, upcoming changes, new features and what's changing in the language. No marketing emails, no selling of your contacts, no click-tracking, and one-click instant unsubscribe from any email you receive.