On July 28, 2026, PHP released version 8.6.0alpha3 along with security updates for versions 8.5.9 and 8.2.33, addressing vulnerabilities such as a stack-based out-of-bounds write, SQL injection, and several crash issues. The new alpha version introduces features like partial function application and a new clamp() function, with TAILCALL VM support now available on Windows. Users of the stable 8.5 version should prepare for an upgrade as the official bulletin will soon be released, while 8.2 users should consider migrating to the supported 8.4 LTS or 8.5 before the end-of-life for their current version. It is advised not to deploy alpha builds in production environments, as further updates are expected soon

PHP 8.5.9 and 8.2.33 Security Updates Drop Alongside 8.6 Alpha 3

PHP tagged three releases in php/php-src on July 28, 2026, landing PHP 8.6.0alpha3 alongside security patches for both 8.5.9 and 8.2.33. Every active branch received the same synchronized patch set, addressing a stack-based out-of-bounds write in ext/bcmath, a pgsql SQL injection via backslash breakouts, a Phar circular symlink crash, and a libgd vulnerability. The 8.6 alpha cycle brings partial function application, a new clamp() function, and TAILCALL VM support on Windows, with the next snapshot expected around July 30. 8.5 users should watch php.net for the official bulletin, while 8.2 operators need to start planning a migration to 8.4 LTS or 8.5 before the maintenance branch hits end-of-life.

PHP 8.5.9 and 8.2.33 Security Updates Drop Alongside 8.6 Alpha 3 @ Linux Compatible