PHP 8.6.0 RC2 lands less than a day after RC1
PHP 8.6.0 RC2 landed on 23 September 2026, roughly 18 hours after the first candidate. That's a tight gap, and it's actually a useful signal rather than a sign the team is throwing code over the wall.
The release manager, Matteo Beccati, tagged RC1 on 22 September. RC2 followed on 23 September. Both carry a NEWS header dated 24 September, which reflects when the project planned to announce them, not when the git tags were actually written.
Why does a handful-of-hours gap matter? Release candidates are the final gate before a stable launch. Once something hits RC status, the feature set freezes. What should still change are bug fixes and security patches, and nothing else. Two candidates in such quick succession usually means the maintainers triaged a batch of real problems, squashed them fast, and wanted one more round of eyes on the result. Either way, 8.6 is clearly in its closing stages, with stable 8.6.0 expected around November 2026.
Keep in mind that this tracks PHP's usual annual rhythm. 8.2 landed in November 2022, 8.3 in November 2023, 8.4 in November 2024, and 8.5 on 20 November 2025. This is a language running on a clock it has kept for years.
PHP itself is a success story in its own right, though nobody ever posts a trophy about it. It powers roughly a third of all websites, running on the Zend Engine (version 4.6 in 8.6). WordPress, Drupal, Laravel, and Facebook's early infrastructure all lean on it, alongside countless CMS and API back-ends you've used without thinking about it.
What this candidate actually bundles
The difference between RC1 and RC2 is tiny by design. The feature set is locked, so RC2 carries exactly three fixes on top of RC1.
The first is a resource leak in the CLI development server. Every HEAD request for a static file leaked a file descriptor, and the leak would build up under sustained traffic. (GH-23764, Jakub Skopal.)
The second touches session handling. When strict mode rejects a supplied session ID, session_start() could keep going after a failed create_sid(), leaving the request in an inconsistent state. (Ilia Alshanetsky.)
The third is a subtle correctness gap. Feeding an empty string to unserialize('') failed silently instead of throwing a proper error, which can hide bugs in code that unmarshals untrusted data. (GH-23780, Tim Wolters.)
These are exactly the edge cases that surface during RC testing. Nothing flashy. Just memory leaks, state corruption, and swallowed errors. Fuzzers tend to find them, and the fact that all three shipped in the same build is a sign of an active team closing out a cycle.
What 8.6 actually brings
Since the feature set is locked, everything new in 8.6 already arrived during Alpha and Beta. That's what makes RC2 a preview of a finished feature list.
Partial function application is one highlight. An RFC lets you pre-fill arguments of a function to produce a new callable, enabling cleaner functional-style code. There's also a new clamp() builtin for constraining a value to a range, plus performance caches for first-class callables and stateless closures that reuse prepared structures across a request.
Other locked-in additions include readonly properties finally being allowed to declare default values, the Time\Duration value type, and a new Io\Poll polling API alongside an expanded streams error API. Extension-level changes range from chunked PostgreSQL fetching to libsodium 1.0.22 supporting ML-KEM768 post-quantum key encapsulation.
And, as usual, a wave of deprecations. PHP 8.6 leans hard into a stricter language, giving you advance warning before potential breakage downstream. Pass objects where arrays are expected, reach for the legacy is_double or is_long helpers, call metaphone(), or reference "namespace" as a class constant name, and several old habits all get the deprecated treatment. That last point matters most for upgrades, since deprecations are usually the first thing that bites when you move to a new major version.
Where you stand on this
Keep in mind that RC2 is not your only option on the table. That same day, 22 September, the PHP Group also shipped coordinated point releases: 8.5.11, 8.4.26, and the security-only 8.3.35 and 8.2.34. Those patch a batch of CVEs hitting FPM, MySQLnd, OpenSSL, Phar, SOAP, and friends. They're for production use. RC2 is explicitly not. The two tracks run in parallel: the team keeps current stable lines patched while stress-testing the next major version.
Source tarballs and Windows QA builds of 8.6.0 RC2 are live on the official PHP pre-release pages, with manifest signatures posted alongside. The build announces itself as PHP 8.6.0RC2 running Zend Engine 4.6.0RC2, and the tag carries Matteo Beccati's verified GPG signature.
The standing warning is unchanged from earlier in the cycle: don't run this in production. It's a test build, and the team wants you to test your app against it and report regressions on GitHub. If things break badly, more RCs could follow. If testing is clean, 8.6.0 heads toward its stable release in November.
If you're on stable 8.4 or 8.5, plan the 8.4.26 or 8.5.11 point releases for security reasons, independent of the 8.6 timeline. Still on 8.2 or 8.3? Prioritize the security-only 8.2.34 and 8.3.35 builds. Building on the edge? Test RC2 and watch especially for the deprecations, since those are the most likely source of upgrade friction come November.
Head here to download RC2 from GitHub.
