The PHP Group has released three release candidates simultaneously, including the final one for PHP 8.6.0, which is set to become generally available on November 19, 2026. The newer version 8.6.0 RC5 introduces the significant feature of partial function application, allowing for pre-filling arguments, while also addressing critical RCE vulnerabilities that were disclosed on October 21. Alongside 8.6.0, maintenance candidates for older versions 8.5.13 and 8.4.28 have also been released, all of which are intended for testing rather than production use. Users planning to upgrade to 8.6 are encouraged to test the release candidates and monitor for new deprecations, while those on versions prior to 8.1 will not receive upstream fixes for the vulnerabilities

PHP 8.6.0 RC5 Ships With 8.5.13 and 8.4.28 Candidates Ahead of 19 November GA

The PHP Group shipped three release candidates at once, with 8.6.0 RC5 being the final one before 8.6.0 goes general availability on 19 November 2026. The two older lines got their next maintenance candidates too, 8.5.13 RC1 and 8.4.28 RC1, each inheriting fixes for the two critical RCE vulnerabilities disclosed on 21 October. 8.6's headline feature is partial function application, letting you pre-fill arguments with ? or ... placeholders, while the RC-level changelogs are dominated by the usual memory-safety and JIT fixes. All three are test software, not for production, and should release as stable versions within days if no blockers turn up.

PHP 8.6.0 RC5 Ships With 8.5.13 and 8.4.28 Candidates Ahead of 19 November GA @ Linux Compatible