PHP internals' Oct. 1, 2026 roundup covered 14 discussions. The bcrypt proposal divides on compatibility risk. Sjoerd Langkemper wants PHP to deprecate inputs over 72 bytes in 8.7, then reject them with ValueError in 8.8. FreshRSS ran a 64-character nonce before the password, consuming the entire bcrypt window (CVE-2025-68402). Kamil Tekiela and Tim Düsterhus say length checks belong in application code. Tim also noted the limit counts bytes, so non-ASCII passwords breach it sooner. Rowan Tommins countered that password_* APIs exist to make safe handling accessible without algorithm expertise. Robert Chapin showed a truncated password verifying against its full version's hash. Tim called the fix a worse break than the bug. Derick Rethans opposed it outright. Langkemper asked whether changing the default hash first would buy support.

Gina P. Banyard's CompiledRegex prototype drew 18 replies. Larry Garfield, Casper Langemeijer, Jordi Kroon and Juris Evertovskis all push to drop "Compiled" and use just Regex. The current design has eight boolean flags. Juris noted named arguments help readability; Gina prefers an enum set (PHP lacks one), and Jordi Boggiano wants a factory taking the modifier letters people already know. Osama Aldemeery pointed out that successful compilation doesn't guarantee match-time success. Tim Düsterhus suggested the class could flip throw-on-error globally. Aldemeery may defer his own regex-exceptions RFC until Banyard's reaches a vote.

Pratik Bhujel's Io\Terminal targets 8.7. It reads terminal size, raw mode with auto-restore, single keys and hidden input natively. Symfony Console already approved a pull request using the extension when available. Bhujel adopted a suggestion to keep raw mode active for as long as any terminal token exists, resetting it when the last token is released. Version 0.3 makes Terminal the interface and SystemTerminal the concrete class. Larry Garfield disliked false-on-error and asked for mock support. The RFC gets the full 14-day discussion window before an intent-to-vote announcement.

Time\Instant gained toInstant() methods on DateTime and DateTimeImmutable. ISO output now keeps trailing zeros to show precision. Tim Düsterhus and Derick Rethans won't write a testing-clocks RFC because they're unsure the feature belongs in core, inviting Internals to submit one. Mirco Babin raised eight objections, including a name clash: both Time\Clock and PSR-20 define now(). Tim intends to keep now() and will discuss a possible SystemClock::get() with Derick. He also questioned whether minute-precision values for bus schedules count as instants.

Weilin Du's array-shorthand RFC turns =$x into 'x' => $x in arrays, destructuring and foreach. Syntax started as a colon, switched to equals within an hour because colons conflict with the ternary. Sebastian Bergmann demanded real-world evidence and warned a missing comma could silently turn one valid program into a different one. David Carlier and Anton Smirnov pointed to existing compact and extract functions. Christian Schneider's been using a local patch for years. Du cited Composer, Laravel, PHPUnit and Symfony, but now leans toward withdrawing it.

Jakub Zelenka's IO Hooks RFC makes blocking code run concurrently without rewrites. PHP has Fibers since 8.1, but blocking calls still freeze the whole process, forcing AMPHP, ReactPHP and Revolt to ship their own I/O stacks. IO Hooks hands blocking stream, socket and curl operations plus sleep calls to an event-loop provider, which suspends the Fiber until done. Without a provider, PHP behaves as today; with one, sleep(1) in one Fiber lets others run. The RFC depends on Polling API Additions, which plugs gaps in 8.6's Poll API—sockets, timers, signals. Both are early-stage with no replies yet.

The Internals list removed Sepehr Mahmoudi. Derick Rethans warned him Sept. 15 for AI-generated posts and thread volume. Moderator Ilija Tovilo imposed one new thread/month and three emails/week Sept. 21, calling it final. When Mahmoudi posted an intl_date_format RFC anyway, Rethans blocked the address from php.net, revoked wiki access and unsubscribed him Sept. 28.

PHP 8.6.0RC2 shipped after RC1 was dropped for a packaging defect; RC2 is now the first candidate, RC3 due Oct. 8. Security updates hit 8.5, 8.4, 8.3 and 8.2: PHP 8.5.11, 8.4.26, 8.3.35, 8.2.34.

Other RFCs shifted ground. Langkemper's number-base RFC now throws a plain Exception instead of ValueError for invalid input—bad data doesn't signal a program bug. intval stays unchanged. Juliette Reinders Folmer wants the b string prefix (PHP 6 holdover) deprecated; Tim proposed adding it to 8.7 deprecations. Pedro Veloso floated an engine-enforced #[Pure] attribute, but Larry Garfield said it needs memoization or similar—static analysis can't add that. Karoly Negyesi posted a pre-RFC and implementation for implements … by, delegating interface methods to a property via Kotlin-style syntax. Alexander Danilov found much post-quantum OpenSSL already works in PHP and offered small PRs for gaps. The PEAR endorsement RFC stalled in discussion; the Sept. 28 vote never opened. Week seven straight with no RFC in voting.