PHP 8.6 reaches its final release on 19 November 2026, according to the project’s official schedule. Since 24 September 2026, technical teams have been testing the release candidate RC2. For a manager or IT director, however, the topic goes beyond the technical: it affects user sessions, maintenance and the budget of every PHP application.
This article first summarises what changes, then the impact on a Laravel, Symfony or WordPress project, and finally the method we recommend.
Key points
- The PHP team published PHP 8.6.0 RC2 on 24 September 2026 and plans the final release for 19 November 2026.
- Three session settings become stricter by default: test this point on every existing application.
- The language gains partial function application, the clamp() function and a new handling of stream errors.
- PHP 8.2 loses its security fixes on 31 December 2026: plan the upgrade now.
PHP 8.6: a precise release schedule
The PHP project publishes a new version every year. For PHP 8.6, it went through three alpha versions in July 2026, then three beta versions between 13 August and 10 September 2026. The feature freeze dates from 22 September 2026.
The first release candidate is numbered RC2, because the team skipped RC1 after a packaging error. The schedule then announces RC3 on 8 October, RC4 on 22 October, RC5 on 5 November, and the final release on 19 November 2026.
The official announcement recalls a simple rule: a release candidate is for testing, not for production. But the functional scope no longer changes: assess the impact on your applications now.
PHP 8.6 features that matter for a project
Here are the changes that weigh most in a business application project.
Sessions better protected by default
PHP 8.6 changes three default values: session.use_strict_mode becomes 1, session.cookie_httponly becomes 1, and session.cookie_samesite takes the value “Lax”. A new installation therefore rejects unknown session identifiers and better protects its cookies.
An older application that relies on the previous values may, however, behave differently. Two cases deserve testing: login from a third-party site, and the JavaScript script that reads the session cookie.
Shorter, more readable code
Partial function application enters the language. A developer fixes some of a function’s arguments and obtains a new, ready-to-use function, using the “?” and “…” placeholders. Contributors adopted this proposal by 33 votes to 0.
PHP 8.6 also adds the clamp() function, which bounds a value between a minimum and a maximum, the SortDirection enumeration, and the #[Override] attribute for class constants.
Errors that are easier to diagnose
A new API structures stream errors (files, network) with dedicated classes. JSON error messages now indicate where the problem lies. The language also receives an I/O polling API and TLS session resumption for streams.
Targeted performance gains
The engine optimises several common array functions, such as array_map(), array_sum() or array_intersect(), as well as JSON encoding. The upgrade notes, however, give no overall figure. Measure the gain on your own application.
What the migration to PHP 8.6 can break
As with every annual version, this one introduces a few compatibility breaks.
- Sessions: the three new default settings change how cookies behave.
- trim() functions: they now also remove the form feed character.
- Extensions: GD, GMP, Intl and cURL now raise errors where they tolerated invalid values.
- Deprecations: PHP flags returning a value from a constructor or destructor, and the use of mbregex functions, whose Oniguruma library no longer has a maintainer.
None of these breaks blocks a project that has automated tests. They do, however, require a test campaign before any switch-over.
Impact of PHP 8.6 on your Laravel, Symfony and WordPress applications
Your application also depends on a framework, libraries and a hosting provider. Each follows its own timetable, however.
- Laravel 13, available since 17 March 2026, supports PHP 8.3 to 8.5 according to its official documentation.
- Symfony 8.1 and the upcoming 8.2 require PHP 8.4 at a minimum.
- WordPress recommends PHP 8.3 or higher.
The real countdown concerns older versions. PHP 8.2 indeed loses its security fixes after 31 December 2026. PHP 8.3 keeps them until 31 December 2027, while PHP 8.4 ends its active support phase on 31 December 2026.
Our recommendations for preparing the upgrade
AISYSNEXT builds applications through custom development with Laravel and Symfony. Our practical view comes down to five steps.
- Inventory your PHP applications first: language version, framework, extensions, hosting.
- Handle the urgent cases: move off PHP 8.2 and earlier versions before the end of December 2026.
- Test PHP 8.6 in a staging environment with the release candidate, without touching production.
- Fix deprecation warnings progressively, before they become errors.
- Wait for official support from your framework and dependencies before switching to production.
This discipline applies to a website or an online shop as much as to a complex business application. You can also see the technologies we use to position your project.
Frequently asked questions
When is PHP 8.6 released?
The official schedule sets the final release for 19 November 2026. This date remains a forecast until the project publishes the stable version.
Should you move to PHP 8.6 as soon as it is released?
No, unless you have a specific need. Wait instead until your framework, extensions and hosting provider announce compatibility. Use this time to test and fix deprecations.
My application still runs on PHP 7.4 or 8.1: what should I do?
PHP 7.4 reached end of life on 28 November 2022, and PHP 8.1 on 31 December 2025. These versions no longer receive any fixes. Plan a step-by-step upgrade, with tests at each stage.
Preparing an upgrade or a rebuild of a PHP application? Describe your context, then request a free quote: our experts review your code, dependencies and schedule.
Sources
- PHP.net, 2026 announcements
- PHP wiki, PHP 8.6 schedule
- PHP wiki, PHP 8.6 RFCs
- php-src, UPGRADING file
- RFC “Secure Session Configuration Defaults”
- RFC “Partial Function Application v2”
- PHP.net, supported versions
- PHP.net, end-of-life versions
- Laravel, support policy
- Symfony, releases
- WordPress.org, requirements
