PHP Drops a Critical Security Update Today — and PHP 8.6 Lands on November 19

Two important things are happening in the PHP world right now, and both deserve your attention. First, today — Wednesday, 21 October 2026 — the PHP team is shipping an emergency security release that fixes two critical vulnerabilities. Second, PHP 8.6 is only a month away, with a general release planned for 19 November 2026.

Let us start with the urgent one.

Patch your PHP today

On 20 October, the PHP security team gave advance notice of a critical security release scheduled for today, 21 October, at 14:00 UTC — that is 7:45 PM Nepal time. It fixes two vulnerabilities, both rated CVSS 9.2, which is about as serious as it gets.

The full details, affected versions and fixed version numbers are being published together with the release itself. That is normal practice for critical flaws: the team does not hand attackers a head start. What it means for you is simple — sometime this evening, new patch versions of the supported PHP branches will appear, and you should upgrade your servers to them as soon as you can.

If you run Laravel apps in production, remember that this is a PHP runtime update, not a framework update. Check your version with php -v, update through your server's package manager or rebuild your Docker images, and you are done. Do not skip this one because your app "seems fine". Critical vulnerabilities are exactly the kind that get exploited within hours once the details are public.

PHP 8.6 is one month away

While the security team handles today's fire, the next major version is moving through its final testing rounds. PHP 8.6.0 RC3 was released on 8 October, RC4 arrives tomorrow, 22 October, and RC5 is planned for 5 November. If everything goes to plan, PHP 8.6.0 stable lands on 19 November 2026.

There is even a small human story in this cycle: RC1 never shipped. A packaging mistake meant the team skipped it entirely and released RC2 instead — their announcement literally opens with "It is not a typo." Even the PHP core team has off days.

The headline feature: partial function application

The star of PHP 8.6 is partial function application. It lets you fix some arguments of a function now and get a new function that waits for the rest, using a ? placeholder.

// Before PHP 8.6
$slugs = array_map(fn ($title) => str_replace(' ', '-', $title), $titles);
 
// PHP 8.6
$slugs = array_map(str_replace(' ', '-', ?), $titles);

It shines together with the pipe operator that arrived in PHP 8.5, because you no longer need a throwaway arrow function every time a piped call needs extra arguments. Expect cleaner array_map() and pipeline code everywhere once frameworks adopt it.

Small features you will actually use

Not every improvement needs to be dramatic. PHP 8.6 is full of small, well-designed additions:

• clamp() — one function that keeps a value inside a range, replacing the error-prone min(max($value, $min), $max) pattern. clamp($discount, 0, 50) reads exactly like what it does.
• Time\Duration class — a proper object for time intervals with nanosecond precision, instead of passing bare seconds around and hoping everyone agrees on the unit.
• Default values on readonly properties — previously a compile-time error, now allowed, which makes readonly classes less ceremonial to write.
• A native polling API (Io\Poll) — a modern, cross-platform replacement for the ageing stream_select() when you work with sockets and streams.
• #[\Override] on constants — the attribute that already guards methods now also checks that a child class constant really overrides the parent one.
• Doc comments on parameters and a SortDirection enum round out a release that clearly cares about everyday code quality.

The one change that can break your app

Now the part to test carefully. PHP 8.6 flips three session settings to secure defaults: strict mode on, session cookies HttpOnly, and SameSite set to Lax.

These are good defaults. Strict mode means PHP rejects session IDs it did not create, HttpOnly keeps JavaScript away from the session cookie, and SameSite=Lax stops the cookie from travelling with cross-site POST requests. That last one is the troublemaker: flows that depend on cross-site posts — some payment gateway callbacks are the classic example — can quietly break.

Laravel applications are mostly protected because Laravel sets its session cookie behaviour from config/session.php rather than PHP defaults. But if your app, a package, or an older project handles native PHP sessions by hand, test the login and payment flows properly before upgrading. If you truly need the old behaviour, set the old values explicitly in configuration instead of relying on defaults.

A few smaller tightenings ride along: several functions now throw a ValueError on NUL bytes instead of failing silently, trim() also strips form feeds, and familiar helpers such as spl_object_hash() and is_integer() are deprecated. None of these should scare you — they are exactly why you run your test suite against the release candidates now, while there is still time to fix things calmly.

Still on PHP 8.2? Your deadline is December 31

One more date belongs on your calendar. Security support for PHP 8.2 ends on 31 December 2026. After that, no more patches — including for critical flaws like today's. If any of your projects still run PHP 8.2, move them to 8.4 or 8.5 this quarter, and start testing 8.6 on the side.

How to try PHP 8.6 today

You do not need to wait until November. The official Docker image follows the latest release candidate:

docker run --rm -it php:8.6-rc-cli php -v

Run your test suite against it, check the session flows by hand, and report anything strange to the PHP team on GitHub. One rule never changes, and the PHP team prints it in capitals for a reason: never run a release candidate in production.

The bottom line

Today: patch your current PHP when the security release drops this evening. This month: test your apps against the PHP 8.6 release candidates. November 19: upgrade with confidence. And if you are still on 8.2, December 31 is the day the safety net disappears. PHP 8.6 itself is a friendly release — one elegant headline feature, a basket of small improvements, and safer defaults — as long as you meet it prepared instead of surprised.