PHP 8.6.0 RC3 reached Ondřej Surý's Debian PHP repository today, four days after the PHP Group tagged the candidate. Since RC1 was skipped, this is effectively the second public release candidate, with RC4 on October 22, RC5 on November 5, and General Availability landing November 19. The build focuses on bug-fixing rather than new features, patching regressions like the Fiber error_reporting=0 bug, the hrtime() clock running 4 percent too fast, and array_map() TypeErrors under strict_types=1. It's a test build, so operators should install with a pinned version if they want to stress-test 8.6 before the stable release ships.

PHP 8.6.0 RC3 for Debian is now installable via Ondřej Surý's repositories

PHP 8.6.0 RC3 reached Ondřej Surý's packages.sury.org/php repo today. The PHP Group tagged the candidate four days earlier. If you run Debian or Ubuntu, you can install this test build right now.

The version in the pool is 8.6.0~rc3-1+0~20261012.3. Surý compiled the binaries between 13:32 and 15:48 UTC that afternoon, one CI sweep across every distro he supports. The source archive is a lean 14.4 MB.

It's a QA snapshot, so keep in mind that this isn't production code. There's no new feature set to gloat about, and no CVEs shipped with the build. What got released instead is bug-fixing and memory-safety patching across roughly 19 components. The changelog tracks 21 areas of fixes, though some outlets count 69 individual entries.

Why RC3, and where the missing RC1 went

RC1 was skipped for PHP 8.6. That makes RC3 effectively the second public candidate, even though the name says otherwise. The numbering quirk is a minor annoyance, but it trips people up every single release cycle.

The schedule that follows is packed. RC4 arrives October 22. RC5 on November 5. General Availability lands November 19.

For context, 8.6's feature set is already locked. What's left is hardening, so expect no more partial-application tricks being bolted on, just the fixing of the mess the betas made. The final 8.6 will still ship partial function application via ?, the clamp() helper, the Time\Duration class, readonly properties with defaults, a shared first-class callable cache, and the new IoPoll API.

Surý has been packaging PHP for Debian since version 5, back when the language was younger and far rougher around the edges. Holding that up for over two decades is a bit of a marathon, and it's partly why these repos stay the default way people pull timely, co-installable PHP on Debian and Ubuntu.

The fixes that actually matter

Most of the RC3 fixes are regressions PHP 8.6 introduced during its own beta cycle. That's the annoying part, you'd normally expect candidates to polish, not to quietly reintroduce bugs. Still, catching them before GA saves the whole ecosystem an upgrade headache. These are the ones worth your attention.

The biggest one involves Fibers. Bug GH-23921, fixed by Gina Peter Banyard, meant that freshly created Fibers started with error_reporting = 0 whenever php.ini didn't set an explicit value. That's precisely the state of the official PHP Docker images and any php -n invocation. Every warning and notice inside a fiber just vanished. Code that worked locally stayed dead silent in production. The fix has Fibers pick up the configured error level and stops the @ suppressor from leaking into a fiber's body.

If you use async libraries like Revolt or AMPHP, this is the one to care about. A silent failure spanning a whole async codebase is exactly the kind of thing that slips past CI.

Then there's hrtime(). PHP 8.6 swapped the high-resolution timer from CLOCK_MONOTONIC to CLOCK_MONOTONIC_RAW under GH-19221, hoping to keep NTP adjustments out of timing. On some systems it ran about 4 percent too fast. Nicolas Grekas measured a sleep(1) under WSL2 where hrtime() reported roughly 1.0389 seconds instead of just over 1.0001. RC3 reverts to CLOCK_MONOTONIC to match 8.5, so if you benchmarked with hrtime() on the betas, rerun it.

array_map() had a bad moment too. RC2 added a faster internal path for some calls, but in strict_types=1 files it began type-checking the callback's arguments, something array_map() never did before. Existing code started throwing TypeErrors out of nowhere. Tim Düsterhus disabled the fast path for strict files, and Arnaud Le Blanc handled the calls with non-literal functions or arguments.

A handful more that will bite people in the real world. OPcache folded $cond ? -0.0 : 0.0 into a bare -0.0 (GH-24063), and since the sign of zero matters in floating-point math, 1.0 / $zero could flip between +INF and -INF depending on which environment you're in. Dev often runs without OPcache; production almost always has it on. Classic mismatch.

The built-in web server leaked a file descriptor on every HEAD request for a static file (GH-23764), a bug dating back to PHP 8.2. A monitoring probe hitting the server every 40 seconds could exhaust descriptors in about 11 hours, after which it couldn't accept new connections at all. Then PDO, led largely by Ilia Alshanetsky, closed a use-after-free from a bound parameter's __toString() and made setFetchMode() changes atomic, while also stopping PDO_DBLIB from swallowing errors out of beginTransaction() and commit().

Deprecations are now emitting notices, too. These passed the August deprecation vote, so if your code uses let or is as a name, or _ as a constant, check it now before the notices become a bigger problem.

Where to get it

The RC3 build covers Debian 11, 12, and 13, plus Ubuntu 22.04, 24.04, and 26.04, across amd64, arm64, and armhf. That's a full mirror of upstream, which is rather the whole point of using sury's repo for pre-release testing.

To set it up, follow the commands in the README: add the keyring, point apt at the php archive, then update before installing whatever you need.

# As root (or with sudo)
apt-get update
apt-get -y install lsb-release ca-certificates curl
curl -sSLo /tmp/debsuryorg-archive-keyring.deb \
    https://packages.sury.org/debsuryorg-archive-keyring.deb
dpkg -i /tmp/debsuryorg-archive-keyring.deb
sh -c 'echo "deb [signed-by=/usr/share/keyrings/debsuryorg-archive-keyring.gpg] \
    https://packages.sury.org/php/ $(lsb_release -sc) main" > \
    /etc/apt/sources.list.d/php.list'
apt-get update

One thing worth pinning, if it's not obvious. Reach for version-specific package names like php8.6-cli rather than the generic php-cli, and consider pinning to the exact RC build so that apt upgrade doesn't drag you forward to RC4 or GA as they roll out. It's a small step, but it's the difference between testing 8.6 and accidentally shipping it early.

The release is tagged and the packages are ready, but this is still a test build. RC4 lands October 22 and RC5 on November 5 before the November 19 final. If you're going to test 8.6 at all, do it now, while the regressions are still fresh and fixable rather than baked into a stable release.

Head here to the sury.org homepage.