PHP shipped five coordinated releases on 22 September 2026, spanning every actively supported line plus the first candidate for the next major version. The headline is 8.6.0 RC1 from Matteo Beccati, a feature-frozen preview not meant for production. The other four are practical: 8.5.11 and 8.4.26 bundle bug fixes and security patches, while 8.3.35 and 8.2.34 are security-only updates. This cycle fixes a wide range of vulnerabilities, including a FastCGI ACL bypass, OpenSSL hostname-downgrade flaws, and a cross-origin credential leak, so running 8.2 through 8.5 should probably be on your list this week.
PHP Ships Five Versions in a Single Release Day, with 8.6.0 RC1 as the Headline
A coordinated wave of point releases landed across every supported version line, anchored by the first candidate for the next major release.
PHP doesn't make much of a fuss about these things, but 22 September 2026 was one of the rarer release days. The PHP Group published five separate versions of its scripting language in one cycle. That spans the cutting-edge preview, the current stable line, and two older versions still getting maintenance.
It's the kind of synchronized release day that is routine inside the project and nearly invisible outside it. Shipping five versions of a language on one afternoon sounds ambitious. In practice it just means the schedule held.
Keep in mind that PHP (the name, for those who haven't lived through it, now recursively stands for "PHP: Hypertext Preprocessor") powers roughly a third of websites on the internet. Keeping this many old codebases from rotting is admittedly important work, even if the project rarely hypes it.
PHP 8.6.0 RC1: the next major version gets its first candidate
The main event is PHP 8.6.0 RC1, tagged by release manager Matteo Beccati. It closes a cycle that opened with Alpha 1 on 2 July 2026 and ran through Beta 3 a few weeks later on 10 September. RC1 was always the planned next milestone, so nothing here is a surprise for anyone watching the calendar.
An RC is essentially the team saying the features are locked in and the real job is finding crashes. It is not for production. PHP asks developers to test their applications against it and file reports on GitHub. If something breaks badly, more RCs can follow before a final 8.6.0 ships, which is expected around November 2026.
Reading the release notes from Alpha 1 through RC1, the 8.6 feature set is a decent-sized pile. Highlights include:
- Partial function application, a new RFC that lets you pre-fill arguments of a function and get a fresh callable back.
- clamp(), a built-in for keeping a value inside a range.
- A first-class callable cache and a stateless closure cache to reuse prepared call structures within a request.
- readonly properties that can finally declare default values.
- Time\Duration in the Date extension for representing spans of time.
- A new polling API (Io\Poll) plus an expanded streams error API (StreamException, StreamError, and friends).
The extension additions are where the detail really stacks up: chunked PostgreSQL fetching (Pdo\Pgsql::ATTR_CHUNK_SIZE), libsodium 1.0.22 support for X-Wing and ML-KEM768, tighter SNMP control, and </> endianness modifiers in pack() and unpack().
Just as big is what 8.6 drops. The deprecation list is long enough to make some codebases nervous: passing objects where functions like array_walk() expect arrays, the legacy is_double/is_long/doubleval type-cast helpers, metaphone(), and using "namespace" as a class constant name, among others. These give you advance notice before they potentially become breaking changes down the line.
Even in an RC, the branch absorbed memory-safety fixes across Core, DOM, Intl, Opcache, PDO, Phar, Sockets, SOAP, and Zlib. We're talking use-after-free errors and out-of-bounds reads during UTF-16/32 encoding detection, plus some assertion failures that OSS-Fuzz turned up.
The point releases: where most people should actually be looking
If 8.6 RC1 is for tasters, the other four are for everyone else.
PHP 8.5.11 (Volker Dusch) and PHP 8.4.26 (Saki Takamachi) are combined bug-fix and security releases. PHP nudges all 8.5 and 8.4 users to upgrade. Beyond the shared security patches, 8.5.11 fixes things like a FPM UID and GID overflow, an Opcache protect_memory race under ZTS builds, and a tracing-JIT crash for uncacheable methods.
8.4.26 brings its own batch: a buffer overflow fix in hash_pbkdf2() when a large output length is requested, a speed fix for a sluggish imagebmp(), plus crash and segfault corrections in SNMP and SOAP and some robustness work for ZipArchive.
The other two are pure security releases. PHP 8.3.35 (Jakub Zelenka) and PHP 8.2.34 (Pierrick Charron) carry the same family of advisory fixes, since both lines sit in the security-only tail of their lifecycles. 8.2 shipped in November 2022 and has no feature work left in it. That's the whole point of the lifecycle model: bug-fix support for about two years, then security-only for about one more, then end of life.
A quick aside on dates. The git tags in the php/php-src repository were all created on 22 September 2026, which is when these builds actually became available. The NEWS files in each tag carry a header date of 24 September, matching the project's planned announcement schedule. Same builds, two dates. Worth knowing if you're cross-checking.
The CVEs fixed this cycle
The 8.3.35 and 8.2.34 entries spell out the advisories most completely. Those same fixes were backported into 8.4.26 and 8.5.11, so the security side of this wave is broad.
| CVE | Component | What broke |
|---|---|---|
| CVE-2026-91768 | FPM | IPv6 ACL bypass in listen.allowed_clients from partial address comparison |
| CVE-2025-1218 | MySQLnd | Packet overreads in the mysqlnd wire protocol |
| CVE-2026-91769 | OpenSSL | TLS hostname verification falls back to CN after a SAN mismatch |
| CVE-2026-91767 | OpenSSL | Heap buffer overflow in wildcard CN matching |
| CVE-2026-6103 | Phar | Integer overflow in TAR parsing allowing entry injection |
| CVE-2026-91765 | SOAP | Unbounded recursion in server-side XML cleanup |
| CVE-2025-14181 | SOAP | Integer overflow leading to buffer overflow in HTTP parsing |
| CVE-2026-93682 | HTTP stream wrapper | Out-of-bounds read on a redirect with an empty Location header |
| CVE-2026-92842 | convert.* filters | Out-of-bounds read when line-break-chars contains a NUL |
| CVE-2026-91766 | HTTP stream wrapper | Cross-origin credential leak in redirects (GHSA-fpwc-w8rq-cr92) |
| CVE-2026-17545 | Windows | Reserved device names not blocked before file and stream I/O |
A couple of advisories got fixed without a public CVE number shown, including a FILTER_SANITIZE_ENCODED issue (GHSA-ch8v-r6jh-4vvr) on the 8.2 and 8.3 lines and the hash_pbkdf2() overflow on 8.4. Most of the security work was done by Jakub Zelenka, Ilia Alshanetsky, Alexandre Daubois, Nora Dossche, and Jordi Kroon.
The FastCGI ACL bypass, the OpenSSL hostname-downgrade bug, and the cross-origin credential leak are probably the ones worth your attention first. They're all the kind of thing that only bites you if you expose PHP directly to the network, but they're exactly the category that turns a routine Tuesday into an incident report.
What to do about it
If you're running 8.2 or 8.3, treat 8.2.34 and 8.3.35 as a priority. Same for 8.4 and 8.5 users with 8.4.26 and 8.5.11 — you get the security fixes plus whatever accompanying bug fixes landed.
If you're testing ahead of the curve, 8.6.0 RC1 is available as source and Windows QA builds on the PHP pre-release pages. It's not for production, so keep it in a staging slot and file any regressions on GitHub. The whole cycle stays free software under the PHP License, with tarballs and binaries on the official download pages.
Release php-8.2.34 · php/php-src
Tag for php-8.2.34
Release php-8.3.35 · php/php-src
Tag for php-8.3.35
Release php-8.4.26 · php/php-src
Tag for php-8.4.26
Release php-8.5.11 · php/php-src
Tag for php-8.5.11
Release php-8.6.0RC1 · php/php-src
Tag for php-8.6.0RC1
