The September 24, 2026 roundup covered 12 PHP internals stories. PHP 8.6 was forked on Tuesday, the feature freeze is active, and the development branch now targets PHP 8.7. The first release candidate was due on September 24. No proposal had entered a vote for the sixth consecutive week.

The Time\Instant and Time\Clock RFC continued to draw discussion after its opening by Tim Düsterhus and Derick Rethans. Time\Instant represents a nanosecond-precise point on the timeline. It carries no timezone and ignores leap seconds by design. It has no method for reading the current time. Time\Clock defines now(), and SystemClock provides the system implementation. Tim said this design supports injecting a clock into code. Seifeddine Gmati proposed a static now() method and the name SystemTime, reserving Instant for a monotonic clock. Tim linked the chosen name to Java and JavaScript’s Temporal API and said a Time\now() function could follow in PHP 8.7. Larry Garfield supported the direction and requested a roadmap for the wider date and time API. He also asked about serialization, while Tim argued that serialized output should rarely need inspection.

The long-running PREG_THROW_ON_ERROR discussion reached a position on callback failures. An exception thrown inside preg_replace_callback should reach the caller unchanged. Osama Aldemeery cited languages like Python and Java as implementations with this behavior. His package scan covered 4,865 projects and found that callbacks account for 4.9 percent of calls to the eight affected functions. Tim Düsterhus still favors wrapping under the general throwable policy, though he said he would not make that a requirement. He requested two related changes: pattern syntax errors should become PcreError, and preg_last_error should keep its existing value.

Gina P. Banyard published a Regex\CompiledRegex pre-RFC with a prototype. The class accepts a bare UTF-8 pattern and named boolean flags such as case-sensitivity and multi-line matching, alongside dot-matches-newline. It removes delimiters and modifier letters, eliminating the need for preg_quote. The D modifier is always enabled, and compilation failures use Regex\CompilationError. The prototype currently supports preg_split and preg_grep. Gina described a possible future object-oriented API with a boolean match result, but has not designed that API. The discussion had received no replies by Wednesday evening.

A proposal to execute a closure returned by a PHP file from the CLI was withdrawn after roughly 24 hours. Tim had prepared it at Gina’s request, with the goal of letting one file serve as an included library and as an executable command. Seifeddine Gmati supported the idea. Rowan Tommins preferred Hack’s #[EntryPoint] attribute because the entry function could appear anywhere in the file. Levi Morrison questioned the CLI-only scope and pointed to Symfony’s runtime, which already returns a closure from a front controller. Larry Garfield considered automatic execution of a returned value too indirect. Tim now plans to examine a __MAIN__ constant containing the path of the first script, while Alexandru Pătrănescu said realpath on the script filename already supplies that information.

Andrey Andreev asked whether PASSWORD_DEFAULT should move from bcrypt to Argon2id. Bcrypt silently truncates passwords after 72 bytes. Argon2 can use libraries like libsodium or OpenSSL, which has supported it since 8.4. Casper Langemeijer described the dependency as both a cost and a benefit because a maintained cryptographic library is preferable to custom code. Anton Smirnov referred to a 2023 discussion that found Argon2 weaker than bcrypt at login-oriented settings. Tim Düsterhus called 500 milliseconds too slow for interactive authentication. Andrey measured PHP’s Argon2 defaults at about 240 milliseconds, similar to bcrypt with cost 12.

Jakub Zelenka noted that OpenSSL is an external shared library and therefore cannot be enabled on every build. Making it mandatory would require a separate RFC. Support for OpenSSL 1.1.1 and 3.0 would also make such a change lengthy. Andrey concluded that the default switch is currently not moving forward.

Sepehr Mahmoudi proposed str_mask one day after withdrawing array_str_contains. The function would replace part of a string with a repeated character for values such as card numbers and phone numbers. Osama Aldemeery compared it with substr_replace combined with str_repeat. Pratik Bhujel found that an out-of-range offset left the value unmasked and that a multibyte mask character could be reduced to one byte. The proposal then changed to throwing ValueError. A #[SensitiveParameter] annotation was added during the discussion and later removed because masked data is not always sensitive. Laravel’s Str::mask and CakePHP’s Text::mask provide related userland APIs, with different multibyte and boundary behavior. Casper Langemeijer called the operation easy to implement in userland, and Weilin Du showed that substr_replace can perform it in one allocation. After 30 messages, no vote was scheduled.

Several replies questioned whether recent proposals and mailing-list messages had been written with AI assistance. The stated concern was the quality of the work and the review time it consumes. Pratik Bhujel proposed establishing the use case, defining the contract and benchmarking the implementation in that order. He withdrew one RFC and said he was now building and testing locally first. Juris Evertovskis said contributors would be judged on the work itself.

The planned IntlRelativeDateTimeFormatter vote received a date of October 8 after Weilin Du revised the RFC to use Tim’s enums. Tim approved the revision. Nick S. planned to open the PEAR vote on September 28 if there were no objections.

Pratik Bhujel’s php-terminal extension gained raw mode and single-key input for Windows tools such as Laravel Prompts. It installs through PIE. After review, the design moved to an Io\Terminal namespace with unbacked enums, terminal restoration when the object is destroyed and a single-object API. The extension is now considered PHP 8.7 material.

David Maye Kitenge asked about request lifecycles and threads for a planned web framework implemented as a PHP extension. Rowan Tommins said the CLI leaves parallel execution to its caller. A thread per request would require a thread-safe ZTS build, while a single thread could handle requests asynchronously.