PHP 8.6.0 RC6 ships four fixes before the 19 November stable deadline
The sixth and final release candidate for PHP 8.6 is live. It's a stabilization build, not a feature drop, and it arrives with just nine days between you and the stable PHP 8.6.0 release.
The PHP Group tagged the release on 10 November 2026. Joe Ferguson, one of the three release managers, committed it under 03569bd. The NEWS file header dates it 12 November instead, though. Minor quibble. Someone's being cautious with the changelog, but you'll see two dates floating around.
Release candidates are near-final builds. They tell you the feature work is done and the team has switched to bug-hunting. PHP asks developers to test RC6 in non-production environments and file issues on GitHub. It also says, pretty plainly, don't deploy it. RC6 is small on purpose, carrying only the fixes that slipped in after RC5 shipped on 5 November.
What RC6 actually contains
Not much excitement here, and that's the point. RC6 is a textbook stabilization snapshot. The NEWS file lists exactly four fixes across four areas.
The Core patch adds padding to the global struct so future patches don't break ABI compatibility. ilutov handled it. It's exactly the kind of low-level binary-interface hygiene you want right before GA.
Date gets a timelib bump to 2026.03 from Derick. That keeps timezone data and date arithmetic current.
Fileinfo is where you'll spot the most user-facing change. Two regressions from the newer libmagic 5.48 were biting people: TrueType fonts were sniffing as application/octet-stream, and Korean HWPX files got wrong MIME types. Weilin Du fixed both.
Then there's the Streams use-after-free. During request startup, a raised stream error could touch the previous request's default stream context. Go Kudo closed it. It's tied directly to PHP 8.6's new stream-error handling, so it's a memory-safety fix, not a cosmetics change.
If RC6 clears QA with no blockers, PHP 8.6.0 ships on 19 November as planned. There's not much more to it.
What the release will actually give you
RC6 is test software. The bits developers will care about are already frozen into the branch, so that's where the real story lives.
The headline is partial function application. You can now use ? or ... as argument placeholders to build a closure with some arguments already bound:
$startsWithAdmin = str_starts_with(?, 'admin.'); array_filter(['admin.users', 'web.home'], $startsWithAdmin); // ['admin.users']
Fixed arguments are evaluated when the partial is created, not when it's called. That distinction matters if your expressions have side effects, which they often do in the wild.
The rest of the list is arguably more practical. clamp() is now a built-in for range-limiting a value. Readonly properties can finally carry a default, which unblocks get-only interface properties without a constructor. Enums can implement __debugInfo(), and #[\Override] now works on constants and enum cases. There's also a native polling API (Io\Poll\*) wrapping epoll and kqueue, a first-class Time\Duration type, and a global SortDirection enum so libraries stop reinventing the wheel.
Deprecations are on the books too. return inside finally blocks goes, along with the standalone SplFileObject CSV methods and a grab bag of legacy type aliases. mbregex is being deprecated because Oniguruma has reached end of maintenance.
A security episode you can't ignore
This RC cycle ran alongside something worth pausing on. On 21 October 2026, the team shipped fixes for two CVSS 9.2 remote code execution bugs across the supported lines: CVE-2026-109618, an OOM-induced state corruption during cleanup, and CVE-2026-109619, stale state surviving after its memory was freed. RC4 onward carries both fixes, so testing RC6 is also validating that hardening. A follow-up advisory on session-upload-progress (CVE-2026-115560) dropped two days later.
For operators the message is blunt. PHP 8.2 reaches end of life on 31 December 2026, and these two RCEs make staying current a real priority rather than a nice-to-have.
What's next
RC6 is QA-only software. Use it to shake out problems, report them on GitHub, then steer clear of production until the 19 November GA.
That date is the important one. If RC6 doesn't surface any blockers, PHP 8.6.0 lands as a stable release nine days out, bringing partial function application, clamp(), the polling API, and structured stream errors to real-world stacks.
Head here to the PHP 8.6.0 RC6 tag on php-src to read the full NEWS file and file your own issues.
