PHP 8.6: release date and what to check before you move

Do not wait for 8.6 to fix PHP2Shell

PHP 8.6 has not been released. Its newest build is a release candidate, and the PHP project says such builds are for testing and not for production.

The fixed releases you can install today are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. For most sites the right move is 8.4. See which version to pick. The advisories list affected branches 8.2 to 8.5 only. We have not verified whether the 8.6 release candidates carry the PHP2Shell fixes, and you should not run a release candidate on a live site to find out.

Release date

The PHP project's release page for 8.6 on wiki.php.net, last edited 21 Oct 2026, lists general availability (GA) on 19 Nov 2026. That matches the date in our notes. It is a planned date. Nothing is final until php.net announces the release.

The wiki says the soft feature freeze came with Beta 1 on 13 Aug and the hard freeze on 22 Sep, after which features need release manager approval. So the feature set is essentially settled. The php.net pre-release page lists 8.6.0RC4, dated 21 Oct 2026.

Support dates for 8.6 are not published yet. The PHP project's supported versions page does not list 8.6. Its stated policy is two years of active support, then two more years of security fixes only, but we do not print dates for 8.6 until the project does.

What is confirmed

The wiki RFC index lists these under "Implemented" for PHP 8.6. The list below is a selection.

• Partial function application.
• Readonly property defaults.
• A clamp() function.
• A Duration class.
• A polling API.
• Stream error handling improvements.
• A SortDirection enum.
• #[\Override] on class constants.
• Debuggable enums.
• Secure session configuration defaults.
• Form feed added to the trim() functions.
• The end of mbregex support, because Oniguruma is no longer maintained.
• Deprecation of returning values from __construct() and __destruct().

We list nothing that is only proposed or under discussion. The RFC index also shows an accepted "Minimum supported versions for PHP 8.6" RFC. We did not read its text.

What to check before you move

These changes come from the UPGRADING file in the php-src PHP-8.6 branch. A file on a branch can still change before GA, so recheck it at release.

Behavior changes that can break a site

• Session defaults change: session.use_strict_mode=1, session.cookie_httponly=1 and session.cookie_samesite="Lax". Test logins, carts and any flow that crosses sites, such as payment returns and single sign-on.
• trim(), ltrim() and rtrim() now strip form feed (\f) by default.
• Stricter input checks. Many functions now reject NUL bytes with an error, including getenv(), putenv(), parse_str(), proc_open() and the file status functions such as file_exists() and is_file(). Look for code that passes unfiltered user input to them.
• preg_grep() returns false on a PCRE error instead of a partial array.
• A hard out-of-memory error now calls abort() and the process exits with code 134. Check monitoring or process supervisors that react to exit codes.

Deprecations

• return inside finally.
• A third argument to define().
• Returning values from __construct() and __destruct().
• The aliases is_double(), is_long(), is_integer() and doubleval().
• spl_object_hash().
• Mbregex.
• Session handlers that lack create_sid() and validateId().

Steps

1. Wait for GA, then for your host or distribution to offer the new branch.
2. Check your CMS. The WordPress handbook shows that PHP 8.5 support arrived in WordPress 6.9. Check the handbook for 8.6 and your WordPress version after GA.
3. Run a scan on staging. PHP 8.2 to 8.4 shows the PHPCompatibility commands. Set testVersion to the release you target once your copy of PHPCompatibility knows it.
4. Test on staging only. Never put a release candidate on production. Fix PHP2Shell with 8.4 now and treat 8.6 as a separate project.

Last reviewed on 22 October 2026.