PHP 8.6 Lands Alpha 3, While 8.5.9 and 8.2.33 Ship Coordinated Security Patches
The PHP development team tagged three releases from php/php-src in rapid succession this morning. PHP 8.6.0alpha3 landed first at 10:12 UTC, followed by security updates for both the active 8.5 and maintenance-mode 8.2 branches. All three carry an identical set of security patches, with a stack-based out-of-bounds write in ext/bcmath leading the list.
Alpha 3 is shaping up to be one of the more usable snapshots in the 8.6 cycle. The headline addition is partial function application, built off the first-class callable cache that Arnaud shipped back in the first alpha. If you're working with higher-order functions or callback-heavy routing, pre-binding arguments should shave off meaningful overhead. The new clamp() function rounds out the userland additions, letting you constrain numeric ranges without writing custom helpers.
TAILCALL VM support now runs on Windows when compiling with Clang 19 or newer on x86_64. Beyond the feature work, the patch set cleans up several nasty bugs. There's a crash fix for when memory limits trip during JIT tracing, a heap buffer over-read patched in PDO_ODBC, and a brand new fast copy API using sendfile or splice. Opcache's JIT finally comes back online for ZTS builds on Apple Silicon. The GMP extension now correctly rejects NUL bytes and out-of-range operands instead of silently truncating them.
php-8.6.0alpha3
Tag for php-8.6.0alpha3
Not exactly a small update. What ties the three tags together is the synchronized timing. All three landed within a roughly three-hour window, and every actively maintained branch received the same four security fixes. The bcmath patch addresses GHSA-x692-q9x7-8c3f, blocking an out-of-bounds write triggered by bccomp() when truncating fractions at caller-supplied scales. The pgsql extension gets a SQL injection fix for E'...' backslash breakouts. Phar's circular symlink crash is patched. And the bundled libgd receives a backport for CVE-2026-9672.
PHP 8.5.9 arrived a few hours after the alpha tag. Volker Dusch pushed the commit, but the official bulletin hasn't hit php.net yet. That usually means the security advisory is being finalized. Since 8.5 is currently the latest stable series, anyone running it should upgrade as soon as the page goes live. The bcmath OOB and pgsql injection are the kind of bugs that slip past standard linters and test suites alike.
php-8.5.9
Tag for php-8.5.9
PHP 8.2.33 arrived with the same patch set, though GitHub's signature verification will warn you about an expired GPG key. Maintenance mode is the reality for 8.2 right now. It entered general availability in December 2023, and this is as good a reminder as any that security-only updates are the end of the line. Keep in mind that the previously fixed CVE-2026-14355 (openssl_encrypt memory corruption) remains addressed here.
php-8.2.33
Tag for php-8.2.33
What to Do Next
If you're on 8.5, watch php.net for the official drop. The aligned patch set means your upgrade path is straightforward. 8.2 users need to stop treating this as a routine patch and start treating it as a migration deadline. PHP 8.4 LTS is supported until December 2027. Moving there, or jumping straight to 8.5, saves you from chasing this kind of coordinated security roll.
Alpha 3 testers should play with clamp() and partial application. The next alpha is expected around July 30, which puts an RC in the crosshairs for August. It's a tight cadence, but the team has been sticking to it. Do not deploy alpha builds to production environments.
