PHP 8.6: RC4 with two critical flaws fixed, RC5 on 5 November, GA on 19

Update to our PHP 8.6 page: two weeks before the general release scheduled for 19 November 2026, the project has reached its fourth release candidate with just one more to come before GA. Anyone managing shared hosting, VPS or control panels has one final window to test before the version ends up in production repositories.

Release candidate status as of 4 November

According to the official news archive on php.net, the third release candidate of PHP 8.6.0, RC4, continues the release cycle of PHP 8.6, whose general schema is defined in the PHP Wiki. The numbering is irregular because, as the project's wiki page notes, the first release candidate of PHP 8.6.0, RC2, was released instead of RC1 due to a packaging error.

The updated schedule, verified on wiki.php.net/todo/php86, is as follows:

Milestone	Date
RC2 (RC1 skipped)	24 September 2026
RC3	8 October 2026
RC4	21 October 2026
RC5 (final)	5 November 2026
GA (general release)	19 November 2026

One detail that was not mentioned in our previous notes: RC4 is not just a functional advancement milestone. The third release candidate of PHP 8.6.0, RC4 includes the security fixes rolled out in parallel for stable branches. The official archive states this explicitly: the build also contains fixes for two critical vulnerabilities that can enable unauthenticated remote code execution—the same CVE-2026-109618 and CVE-2026-109619 already fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Anyone already testing earlier builds of 8.6.0 (alpha or beta) should upgrade to RC4 or later, not just for features but for security.

What remains confirmed from the RFCs

Compared to the beta phase, the upgrade notes (UPGRADING) for RC4 confirm several behaviours worth reviewing before moving code to production: a new SortDirection enum (Ascending and Descending cases) and a polling API (Io\Poll), changes for which foreach by-reference can now visit elements that it previously skipped after array compaction, and the ?? operator or empty() on a magic property no longer calls _get() in a specific case, plus preg_grep() now returns false instead of a partial array when a PCRE error occurs, aligning with other preg* functions. The deprecation of return values from __construct() and __destruct() is also confirmed, which have been silently discarded so far, with a deprecation notice that PHP 9.0 will turn into an error.

Practical checklist for testing the RC on staging

For those wanting to try RC5 (or RC4 in the meantime) without touching production servers, the official Docker image exists and is kept up to date: on Docker Hub the tag php:8.6-rc is published, along with the cli, fpm, apache and alpine variants.

1. Download the official image

docker pull php:8.6-rc-cli

2. Verify the installed version in the container

docker run --rm php:8.6-rc-cli php -v

3. Run lint on your plugin/theme code before the full suite

docker run --rm -v $(pwd):/app -w /app php:8.6-rc-cli php -l wp-content/plugins/plugin-name/plugin.php

4. Execute the test suite for critical WordPress plugins by mounting your project folder and using PHPUnit inside the container:

docker run --rm -v $(pwd):/app -w /app php:8.6-rc-cli vendor/bin/phpunit --configuration phpunit.xml.dist

5. Enable all deprecation logs to catch early warnings on __construct()/__destruct() and other changed behaviours:

docker run --rm -v $(pwd):/app -w /app -e PHP_INI_SCAN_DIR=/app/ci php:8.6-rc-cli php -d error_reporting=E_ALL -d display_errors=1 wp-content/plugins/plugin-name/test.php

6. If a plugin fails only on new deprecation notices and not on fatal errors, it can stay in production until GA on 19 November; if the PHPUnit suite fails, it needs updating first.

Article updated from the previous version on "PHP 8.6: what's changing" with release candidate status as of 4 November 2026.