PHP 8.6 is scheduled for release on November 19, 2026 and focuses on developer ergonomics: new functional programming tools, small language fixes, better reflection, and a long list of deprecations that prepare the ground for future majors.

The headline feature is Partial Function Application (PFA). Using the ? placeholder, any function can be turned into a partially applied callable: $makeSlug = str_replace(' ', '-', ?); followed by $makeSlug('Hello World') yields "Hello-World". PFA combines with the pipe operator, e.g. 'Hello World' |> str_replace(' ', '-', ?) |> strtolower(...) producing "hello-world".

Readonly properties can now carry default values, e.g. public readonly string $name = '2026-01-01_create_books_table'; — previously impossible. This is especially useful together with the property hooks introduced in PHP 8.4, where immutable defaults become part of an interface contract.

A new low-level Polling API improves PHP internals such as PHP-FPM, signal handling and Zend Thread Safety (ZTS), and is also available to userland code. Libraries like ReactPHP and Amp can use it instead of stream_select(). The API deliberately does not add async/await or an event loop; it is a better abstraction over OS mechanisms like epoll and WSAPoll, improving scalability for high-concurrency applications.

The long-requested clamp() helper is built in: clamp($value, 0, 100) replaces max(0, min(100, $value)). clamp(101, 0, 100) returns 100, clamp(-5, 0, 100) returns 0. It works not only with numbers but also with strings, DateTime objects and any comparable value.

Reflection gains isReadable() and isWriteable() methods so frameworks can determine property accessibility by scope — relevant for readonly properties, property hooks and private setters. Doc comments can now be placed directly on parameters, and ReflectionParameter::getDocComment() exposes them. A built-in enum SortDirection with cases Ascending and Descending is added; core sorting functions do not support it yet, but libraries can adopt it immediately.

Session security defaults are tightened: session.use_strict_mode = 1, session.cookie_httponly = 1 and session.cookie_samesite = Lax. This hardens fresh installs against session fixation, JavaScript cookie access and unintended cross-site cookie use; applications relying on cross-site POSTs or client-side session ID access may need config changes. Enums now support __debugInfo() to customize var_dump() output.

Notable deprecations: returning from a finally block; using let, is, namespace, readonly (as a function name) and _ as identifiers (reserved for future features); legacy aliases is_double(), is_integer(), is_long() and doubleval() in favor of is_float(), is_int() and floatval(); setting properties on unrelated objects and calling static methods via instances via reflection; spl_classes(), spl_object_hash(), SplFileObject CSV methods, mysqli::stmt_init() and mysqli_get_charset(); and returning values from constructors or destructors.