On October 8, 2026, the PHP internals roundup covered 13 developments. The main update concerns bcrypt. Sjoerd Langkemper has put the `bcrypt_max_password_length` RFC on hold after compatibility objections. Jeff Dafoe found the underlying issue in older PHP code and responded by forcing password resets.

Tim Düsterhus proposed borrowing bcrypt-sha256 from Passlib, the Python password library. Langkemper’s new RFC adds `PASSWORD_BCRYPT_SHA256`. It applies HMAC-SHA-256 before bcrypt, so bcrypt receives a 44-byte key without null bytes or a 72-byte limit. An example accepts a 200-character password and rejects the same password shortened by one character. The algorithm is opt-in, leaves the default unchanged, lists no breaking changes, and produces hashes compatible with Passlib. The hashes are longer, so applications may need wider database columns. Making the algorithm the default remains future scope.

Two RFC votes are open. Nick S. opened the End PEAR Project Endorsement vote on Monday after missing his planned date. The proposal would archive the PEAR site, remove its installer from PHP 8.7, and point php.net to Composer. It stood at 26 votes to 0 when recorded and closes on October 19. Weilin Du’s `IntlRelativeDateTimeFormatter` vote also reopened after an earlier September vote ended at 4 to 1. The revised proposal adopts Tim Düsterhus’s enum design, has 7 votes to 0 including Tim’s, and closes on October 22. It formats values such as “yesterday” and “in 2 weeks”.

The `Time\Instant` proposal still has no agreed JSON representation. `json_encode` currently produces an empty object, and the authors, Tim Düsterhus and Derick Rethans, argue that the JSON extension should define the solution. A 15-point review changed `getUnixTimestamp` methods to `toUnixTimestamp`, made `SystemClock` a singleton, and added `DateTimeInterface::toInstant` after an omission was identified. A request to rename `now()` remains disputed because of PSR-20 compatibility. Larry Garfield sees the proposal as a possible successor to PSR-20.

Pratik Bhujel’s Io\Terminal version 0.4 removes the interfaces added in the previous revision. The stream is treated as the real I/O boundary, which allows in-memory streams to test terminal input. Scripted streams now work for key and secret reads, a forked child no longer resets its parent’s terminal, and Insert and Shift-Tab have new key values. Pratik plans to move toward a vote after further review.

Matthieu Napoli’s single-binary RFC would embed FPM in the `php` binary. Users could start it with `--fpm` or a symlink. Measurements with Bref on AWS Lambda showed an 18 percent reduction in zipped package size and a 70 millisecond, or 25 percent, improvement in cold-start time for a minimal FPM application. Discussion covers the meaning of `-F`, the role of FPM as FrankenPHP and Swoole gain adoption, and a possible design that embeds the CLI in the FPM binary.

IO Hooks received a safety review from Ilia, who reproduced crashes in Jakub Zelenka’s branch. C code can assume that no PHP code runs during a blocking wait, and one test freed a DOM document in one Fiber while another Fiber was still saving it. Ilia wants hooked calls to remain blocking by default, with call sites declaring when suspension is safe. Jakub describes the branch as a proof of concept and considers the failures fixable. A design document now covers the three related RFCs. Sebastian Bergmann sees a path to child-process orchestration in PHPUnit, and Edmond Dantes is testing the work with his pluggable scheduler RFC.

Karoly Negyesi’s delegation proposal would pass interface methods to a property. Larry Garfield supports it after Drupal query classes accumulated about 100 lines of forwarding code, and James Gilliland cited Laravel’s `ForwardsCalls` trait. Sebastian Bergmann warned that later interface methods could become silently forwarded and that fluent calls would return the inner object. Larry suggested a mask keyword. Rowan Tommins said similar proposals tend to gain special cases that weaken the original shorthand.

The remaining updates are smaller. Weilin Du moved the array shorthand back to a colon because the parser can distinguish it from a ternary expression. Juliette Reinders Folmer will not pursue deprecation of the `b` string prefix without broader interest, and Daniel Scherzer offered C implementation work for the PHP 8.7 deprecations RFC. Muhammed Arshid changed his filter proposal to backed enums named `Filter\Filter` and `Filter\Flag`; Derick Rethans wants the deprecation of the filter extension’s default input filtering reversed. Máté Kocsis is seeking a vote on query parameter manipulation. David Carlier proposed ICU-skeleton-based unit formatting for `intl`, including values such as 5 kilometers per hour. PHP 8.6 RC3 was scheduled for October 8, with general availability set for November 19.