PHP 8.6.0 RC5 released: final test run before 19 November GA

The PHP team announced on 5 November 2026 the availability of PHP 8.6.0 RC5, the fourth release candidate of the 8.6 cycle. For anyone managing hosting and needing to plan container or staging environment updates, this is the last testing round before the stable release.

What changes between now and GA

The PHP team has announced the fourth release candidate of PHP 8.6.0, RC5, continuing the release cycle described in the PHP Wiki. Downloads of PHP 8.6.0 RC5 source code are available on the download page, with an explicit warning: this version should not be used in production—it is an early test release.

The next release will be the first GA, PHP 8.6.0, scheduled for 19 November 2026. Anyone running test environments based on containers or dedicated VMs therefore has two weeks to report regressions before the stable release.

Security fixes already included in the RC

RC5 is not the only candidate released in recent days. According to LinuxCompatible, the PHP Group published three release candidates simultaneously, with 8.6.0 RC5 as the final candidate before the general release on 19 November 2026. Alongside 8.6.0, maintenance candidates were also released for older versions 8.5.13 and 8.4.28.

The reason for the coordinated release is a security matter: all three candidates include fixes for two critical vulnerabilities. According to LinuxCompatible, on 21 October the PHP security team patched two bugs with a CVSS score of 9.2 that allowed unauthenticated remote code execution: CVE-2026-109618, related to memory corruption during out-of-memory events, and CVE-2026-109619, related to global state persisting after being freed. A third flaw, CVE-2026-115560, relating to session upload progress, still lacked a full advisory at the time of the RC release.

Anyone already on 8.5.12 or 8.4.27 (or later) is covered against the two main CVEs; versions earlier than 8.1 do not receive upstream fixes.

Where to find the files

Source packages (tar.bz2, tar.gz, tar.xz) and their signatures are on the php.net pre-release builds page, along with checksums to verify download integrity before any testing on staging environments.