PHP 8.6 release candidate is out: what changes and what to do now

On September 24, 2026 the first release candidate of PHP 8.6 shipped, with the stable release expected on November 19. It brings partial function application, a clamp() function and safer session defaults. What matters more for PHP projects right now: security updates for branches 8.2–8.5 came out the same day, and PHP 8.2 support ends at the end of 2026.

Here is what changed, who it affects and a sensible upgrade plan.

What was released in September 2026?

On September 24 the PHP team published PHP 8.6.0 RC2 — the first release candidate of the new version — together with security updates for every supported branch. According to php.net news, the RC1 number was skipped because of a packaging mistake, so RC2 became the first candidate.

Version	What shipped	What it means
PHP 8.6.0 RC2	First release candidate	Features are frozen; compatibility testing can start
PHP 8.5.11	Security release	Install soon
PHP 8.4.26	Security release	Install soon
PHP 8.3.35	Security release	Install soon
PHP 8.2.34	Security release	The branch gets security fixes until the end of 2026

The next candidate, RC3, is planned for October 8, and the stable release is expected on November 19, 2026, according to Laravel News.

What is new in PHP 8.6?

PHP 8.6 adds partial function application, a clamp() function, new stream and URI capabilities and safer session defaults. The full list of changes and deprecations is in the UPGRADING file of the php-src repository.

Partial function application

You can call a function with some arguments and get back a closure that takes the rest. A missing argument is marked with ?:

$makeSlug = str_replace(' ', '-', ?);

$makeSlug('Hello World'); // Hello-World

clamp() and secure sessions

clamp() constrains a value to a range — a common task previously solved by combining min() and max():

clamp(150, min: 0, max: 100); // 100

For new installations, session defaults change: strict mode, the HttpOnly flag on the session cookie and SameSite=Lax are enabled. Existing servers keep the settings from your php.ini, but it is worth checking that they are already configured this way.

Photo: Unsplash

Who is affected right now?

Anyone running PHP is affected right now: security updates shipped for all supported branches, and owners of projects on PHP 8.2 or older need to plan a move. PHP 8.6's new features will matter later, after the stable release and framework support.

What to do:

1. Install the latest security update for your PHP branch — these are patch releases and do not break compatibility.
2. Check the PHP version in production. On 8.2, move to 8.3 or newer before the year ends; on anything older, security updates have already stopped.
3. Check your framework's requirements. Laravel 13 officially requires PHP 8.3, but from version 13.3 its Symfony 8 dependencies require PHP 8.4 (discussion in the Laravel repository). The next major version, Laravel 14, will also require PHP 8.4, according to Laravel News — in practice, target 8.4.
4. Run your tests on PHP 8.6 RC in CI if the project is actively developed, so compatibility issues surface before the stable release.

How do you plan a PHP upgrade?

Plan a PHP upgrade like any other task: tests and static analysis on the new version first, then dependency updates, then staging and only then production. Moving one or two versions at a time usually goes smoothly if the project is updated regularly.

# Compatibility check in CI across several PHP versions
strategy:
  matrix:
    php: ['8.4', '8.5', '8.6']
steps:
  - uses: shivammathur/setup-php@v2
    with:
      php-version: ${{ matrix.php }}
  - run: composer install --no-interaction
  - run: vendor/bin/phpunit

For stable projects, it is sensible to move to a new PHP version a few months after release, once your framework and key libraries support it. Small regular upgrades cost less than jumping several versions at once.

In short

• On September 24, PHP 8.6.0 RC2 and security updates for PHP 8.2–8.5 were released.
• Stable PHP 8.6 is expected on November 19, 2026: partial function application, clamp() and secure session defaults.
• Install your branch's security update now.
• PHP 8.2 receives security fixes until the end of 2026 — time to plan the move.
• Add PHP 8.6 RC to your CI matrix to catch compatibility issues early.