PHP 8.6.0 RC4 has been released, containing a frozen feature set since September and approximately 50 bug fixes since the previous release candidate, RC3. This release coincided with the PHP team's emergency patch for two critical remote code execution (RCE) vulnerabilities, known as "php2shell," which affect all versions from 5.4 to 8.5.11. Major new features in RC4 include partial function application, a new `clamp()` function, and enhancements to error handling and native APIs. The community is urged to update to the latest patched versions or test RC4 before the general availability release scheduled for November 19, 2026, while remaining vigilant against the identified security flaws

PHP 8.6.0 RC4 Ships Hours After Team Emergency-Patches Critical RCE Flaw

PHP 8.6.0 RC4 shipped today, carrying a feature list frozen since the September hard freeze and roughly 50 bug fixes since RC3. It arrived the same morning the PHP team emergency-patched two critical, unauthenticated RCE flaws dubbed "php2shell," which affect every version from 5.4 through 8.5.11. 

PHP 8.6.0 RC4 Ships Hours After Team Emergency-Patches Critical RCE Flaw @ Linux Compatible