Partial function application

RFCs: partial_function_application_v2, partial_function_application_optional_placeholder

Call a function with ? in place of some arguments and PHP hands back a Closure for the rest. Named placeholders reorder parameters, ... collects everything not yet given, and the resulting Closure keeps the original types, defaults and by-reference flags for reflection.

This is the missing half of first-class callables from 8.1 and the natural partner of the 8.5 pipe operator. array_map(str_replace('a', 'b', ?), $list) replaces a line of arrow-function boilerplate, and static analysers see the real signature. A follow-up RFC made every ? placeholder a required parameter, so the arity you write is the arity you get.

// Fix some arguments now, supply the rest later
$greet = str_replace('hello', 'hi', ?);
echo $greet('hello world');              // hi world

// Placeholders compose with the 8.5 pipe operator
$slugs = ['Hello World', 'PHP 8.6']
    |> array_map(strtolower(...), ?)
    |> array_map(str_replace(' ', '-', ?), ?);
print_r($slugs);                         // hello-world, php-8.6

// "..." keeps the remaining parameters, defaults included
$encode = json_encode(?, JSON_THROW_ON_ERROR, ...);
echo $encode(['ok' => true]);            // {"ok":true}

Default values for readonly properties

RFC: readonly_property_defaults 24–0 accepted

Readonly properties may now declare a default value; the default counts as the one and only initialisation. Combined with interface properties from 8.4 this gives you contractual constants per class without constructor assignments.

The original readonly RFC called defaults “not particularly useful”. Interface properties changed that: a readonly default satisfies a { get; } contract with zero boilerplate. Careful: an assignment in the constructor is now a modification and throws, and unset() on such a property is an error.

interface Ingestor
{
    public string $name { get; }
    public array $steps { get; }
}

// Fixed metadata without constructor boilerplate:
// the default IS the initialising assignment
final readonly class ChangelogIngestor implements Ingestor
{
    public string $name = 'changelog';
    public array $steps = [ParseMarkdown::class, ExtractVersions::class];
}

echo new ChangelogIngestor()->name;      // changelog

Property writes on objects held in constants

RFC: const_object_property_write 17–2 accepted

Objects have been allowed in constants since 8.1, but any write such as CONST->prop = 1 died with “Cannot use temporary expression in write context”. PHP 8.6 lifts that restriction for property writes, compound assignments, increments, isset(), unset() and by-reference passing.

The constant binding stays immutable; only the object’s state changes, which is how objects always behaved elsewhere. Array constants are unchanged (copy-on-write). One side effect: writing to an enum case’s property now throws the regular readonly error instead of a compile-time fatal.

const REGISTRY = new stdClass();

// PHP 8.5: Fatal error: Cannot use temporary expression in write context
// PHP 8.6: the constant still binds the same object, its state may change
REGISTRY->hits = 0;
REGISTRY->hits++;
REGISTRY->hits += 10;

class Config
{
    const SETTINGS = REGISTRY;
}

Config::SETTINGS->debug = true;
var_dump(REGISTRY->hits, isset(Config::SETTINGS->debug)); // int(11) bool(true)

Time\Duration

RFC: duration_class 35–1 accepted 30 multiplyBy, divideBy, neg… · 2 mul, divBy, neg, abs decided

A final, readonly stop-watch duration with nanosecond precision: factories from seconds down to nanoseconds and from ISO 8601 strings, add/sub/multiplyBy/divideBy, comparison operators, and an overflow-safe range of about 292 years.

Timeouts, back-off and scheduling were int-in-some-unit or fragile floats. DateInterval carries calendar units that cannot be converted to seconds reliably. Duration is unit-safe by construction and is already the timeout type of the new polling API; expect more internal APIs to accept it. sleep() and friends still take int.

use Time\Duration;

// Stop-watch time with nanosecond precision, no calendar semantics
$timeout = Duration::fromMilliseconds(1_500);
$backoff = $timeout->multiplyBy(2)->add(Duration::fromSeconds(1));

var_dump($backoff->seconds, $backoff->nanoseconds); // int(4) int(0)
var_dump($timeout < $backoff);                       // bool(true)

// ISO 8601 without date parts: hours are the largest unit
$limit = Duration::fromIso8601DurationString('PT1H30M');
var_dump(Duration::compare($backoff, $limit));       // int(-1)

#[\Override] on class constants

RFC: override_constants

The attribute introduced for methods in 8.3 and extended to properties in 8.5 now covers class constants and enum cases. The compiler errors if nothing is actually being overridden.

Overriding a parent constant by accident is a classic silent bug. Marking the intent makes refactorings safe: rename the parent constant and the child fails to compile instead of quietly defining a new one.

class Base
{
    protected const RETRIES = 3;
}

class Worker extends Base
{
    #[\Override]                 // compile error if Base had no RETRIES
    public const RETRIES = 5;
}

enum Level: int implements HasDefault
{
    #[\Override]                 // enum cases may override interface constants
    case Default = 0;
}

__debugInfo() on enums

RFC: debugable-enums

Enums may now implement __debugInfo(); var_dump() keeps the enum(Foo::Bar) header and appends whatever the method returns.

Enum output in dumps and debuggers was fixed and terse. Backed enums with meaningful values, or cases that map to configuration, can now explain themselves. __toString() on enums was discussed and rejected in favour of this narrower change.

enum Status: string
{
    case Active = 'active';

    public function __debugInfo(): array
    {
        return [self::class . '::' . $this->name . ' = ' . $this->value];
    }
}

var_dump(Status::Active);
// enum(Status::Active) (1) {
//   [0]=>
//   string(23) "Status::Active = active"
// }

Doc comments on parameters

RFC: parameter-doccomments

A /** … */ comment placed before or after a parameter is preserved by the engine and returned by the new ReflectionParameter::getDocComment().

Parameter documentation no longer has to repeat name and type in a @param line above the function, where it silently drifts out of sync. Attribute-driven frameworks and API generators get the text straight from reflection.

/** Search for entries matching a query */
function search(
    /** Terms to look for in the index */
    string $query,
    /** Maximum number of entries returned */
    int $limit = 10,
): array {
    return [];
}

foreach (new ReflectionFunction('search')->getParameters() as $p) {
    echo $p->name, ': ', $p->getDocComment(), PHP_EOL;
}
// query: /** Terms to look for in the index */
// limit: /** Maximum number of entries returned */

Stateless closures are cached

RFC: closure-optimizations

A static closure that captures no variables and declares no static variables is created once and reused. Two such closures from the same source location are now identical objects.

Hot paths that create the same closure per iteration stop allocating. The second part of the RFC, inferring static for closures that never use $this, was pulled after the vote when an edge case with callable strings surfaced; mark closures static yourself to get the full benefit.

function handler(): Closure
{
    // static, captures nothing, no static variables => cached
    return static fn (int $x): int => $x * 2;
}

// PHP 8.5: two instances. PHP 8.6: the same cached Closure.
var_dump(handler() === handler());       // bool(true)

clamp()

RFC: clamp_v2

clamp($value, $min, $max) returns the value if it lies within the bounds, otherwise the nearest bound. It accepts anything comparable, including strings and DateTime objects, and throws a ValueError when $min is greater than $max or either bound is NAN.

The usual max($min, min($max, $v)) idiom hides two bugs: swapped bounds and NAN passing through silently. The native version validates both and is slightly faster than the userland ternary.

var_dump(clamp(150, min: 0, max: 100));  // int(100)
var_dump(clamp(42, 0, 100));             // int(42)
var_dump(clamp(2.5, 1, 3));              // float(2.5)

// Any comparable type follows the usual comparison rules
echo clamp(
    new DateTimeImmutable('2026-12-24'),
    new DateTimeImmutable('2026-11-19'),
    new DateTimeImmutable('2026-12-01'),
)->format('Y-m-d');                      // 2026-12-01

clamp(4, 8, 6);   // ValueError: $min must be smaller than or equal to $max

Structured stream errors

RFC: stream_errors

A stream context can now switch error handling to exceptions or to silent collection: error_mode (Error, Exception, Silent), error_store and an error_handler callback. Errors arrive as StreamError value objects with a StreamErrorCode enum case, wrapper name, severity and the affected path.

Until now file_get_contents() and friends reported failure through warnings you had to trap with an error handler and parse as text. With StreamErrorMode::Exception a failed open is a StreamException with machine-readable codes; the defaults are untouched, so nothing changes unless you ask.

$ctx = stream_context_create([
    'stream' => ['error_mode' => StreamErrorMode::Exception],
]);

try {
    $config = file_get_contents('/etc/app/missing.ini', false, $ctx);
} catch (StreamException $e) {
    foreach ($e->getErrors() as $error) {
        echo $error->code->name, ': ', $error->message, PHP_EOL;
        // OpenFailed: Failed to open stream: No such file or directory
    }
}

// Or stay silent and inspect afterwards
$ctx = stream_context_create(['stream' => ['error_mode' => StreamErrorMode::Silent]]);
@file_get_contents('/nope', false, $ctx);
var_dump(stream_last_errors()[0]->code === StreamErrorCode::OpenFailed); // bool(true)

Polling API (Io\Poll)

RFC: poll_api

A native multiplexing API on top of epoll, kqueue, event ports, WSAPoll or poll(): Io\Poll\Context watches handles for Read, Write, Error and HangUp events, supports one-shot and edge-triggered modes and returns the triggered watchers from wait().

stream_select() is O(n), capped at 1024 descriptors on many systems and knows nothing about modern kernels. Event loops such as Revolt, ReactPHP or AMPHP can now run on a built-in backend instead of ext-uv or ext-event, and FrankenPHP-style runtimes get a shared internal API. Only stream resources are pollable in this first version.

use Io\Poll\{Context, Event};
use Time\Duration;

$poll = new Context();                              // epoll / kqueue / WSAPoll
$server = stream_socket_server('tcp://127.0.0.1:8080');
stream_set_blocking($server, false);
$poll->add(new StreamPollHandle($server), [Event::Read], 'server');

while ($watchers = $poll->wait(Duration::fromSeconds(1))) {
    foreach ($watchers as $w) {
        if ($w->getData() === 'server') {
            $client = stream_socket_accept($w->getHandle()->getStream(), 0);
            $poll->add(new StreamPollHandle($client), [Event::Read], 'client');
        } elseif ($w->hasTriggered(Event::Read)) {
            $stream = $w->getHandle()->getStream();
            fwrite($stream, 'echo: ' . fread($stream, 8192));
        }
    }
}

ext/uri: builders and type detection

RFC: uri_followup

Uri\Rfc3986\UriBuilder and Uri\WhatWg\UrlBuilder assemble a URI in one object and validate on build(); getUriType() distinguishes absolute URIs from path and network references, getHostType() reports IPv4, IPv6, domain or opaque hosts, and isSpecialScheme() tells you whether WHATWG special-scheme rules apply.

The 8.5 URI classes were immutable withers only, so building a URI from scratch allocated an object per step and depended on call order. The builder removes both problems. The percent-encoding helper from the same RFC has not landed in the beta yet.

// One object instead of a wither chain that allocates per step
$uri = new Uri\Rfc3986\UriBuilder()
    ->setScheme('https')
    ->setHost('php-net.pro')
    ->setPath('/en/php-8.6')
    ->setQuery('utm_source=dispatch')
    ->build();

echo $uri->toRawString();                // https://php-net.pro/en/php-8.6?utm_source=dispatch
echo $uri->getUriType()->name;           // Uri (vs. RelativePathReference ...)

$url = Uri\WhatWg\Url::parse('https://[2001:db8::1]/');
echo $url->getHostType()->name;          // IPv6
var_dump($url->isSpecialScheme());       // bool(true) for http(s), ws(s), ftp, file

enum SortDirection

RFC: sort_direction_enum

A global unbacked enum with the cases Ascending and Descending, meant as the one sort-direction type PHP, frameworks and libraries converge on.

Doctrine, query builders and every ORM ship their own Order enum. A shared type makes signatures interoperable; a union with the old string or int flags keeps existing APIs compatible while they migrate.

// One shared type instead of SORT_ASC, 'DESC', bool $ascending ...
function orderBy(string $column, SortDirection $direction = SortDirection::Ascending): string
{
    return sprintf('ORDER BY %s %s', $column, match ($direction) {
        SortDirection::Ascending => 'ASC',
        SortDirection::Descending => 'DESC',
    });
}

echo orderBy('created_at', SortDirection::Descending);   // ORDER BY created_at DESC

ReflectionProperty::isReadable() and isWritable()

RFC: isreadable-iswriteable

Both methods answer whether a read or write would succeed from a given scope, optionally for a concrete object. They understand readonly, asymmetric visibility, hooks and magic accessors, which isPublic() never did.

Since readonly (8.1) and private(set) (8.4) a public flag no longer means writable. Serializers, hydrators and mappers had to reimplement the engine’s rules; now they ask the engine.

final class Money
{
    public function __construct(
        public readonly int $amount,
        public private(set) string $currency = 'EUR',
    ) {}
}

$amount = new ReflectionProperty(Money::class, 'amount');
$currency = new ReflectionProperty(Money::class, 'currency');

// isPublic() says "true" for both; the new methods answer the real question
var_dump($amount->isWritable(null));                 // bool(false) from global scope
var_dump($currency->isWritable(Money::class));       // bool(true) from inside
var_dump($currency->isReadable(null));               // bool(true)

pack()/unpack() endianness modifiers

RFCs: pack-unpack-endianness-signed-integers-support, pack-unpack-float-endianness-modifier

The Perl-style modifiers < and > now work on the signed and unsigned integer codes s, l, q, S, L, Q and on the float codes f and d. Applying them to codes with inherent endianness throws a ValueError.

Reading a signed little-endian int32 used to take three unpack() calls and bit shifts. Binary protocol and file-format parsers become one format string. Watch the naming rule: unpack('s<value') now yields the key value, not <value.

// Signed little-endian int32 used to need a manual bit dance
$bytes = pack('l<', -16909060);
print_r(unpack('l<value', $bytes));      // [value] => -16909060

// Modifiers work on s/S, l/L, q/Q and (new) f/d
$frame = pack('s>l<d>', -258, 1024, 3.14159);
[$id, $len, $ratio] = array_values(unpack('s>id/l<len/d>ratio', $frame));

pack('a<', 'x');   // ValueError: modifier not allowed on "a"

mysqli::quote_string()

RFC: mysqli_quote_string

Escapes and wraps a string in single quotes in one step, the mysqli counterpart of PDO::quote(). Available as mysqli::quote_string() and mysqli_quote_string().

real_escape_string() only ever worked correctly inside single quotes; combined with double quotes and NO_BACKSLASH_ESCAPES it was an injection hole. The new function removes the manual quoting step where prepared statements are not an option, as in query builders that must render full SQL.

// Before: quotes by hand, injection possible under NO_BACKSLASH_ESCAPES
$sql = sprintf("SELECT id FROM users WHERE name = '%s'", $mysqli->real_escape_string($name));

// PHP 8.6: escaped AND quoted, always single quotes (like PDO::quote())
$sql = sprintf('SELECT id FROM users WHERE name = %s', $mysqli->quote_string($name));
// SELECT id FROM users WHERE name = 'Don\'t!'

TLS session resumption, PSK and 0-RTT

RFC: tls_session_resumption_api

Stream contexts gain session_data, session_new_cb, session_cache and related options with an Openssl\Session object that can be exported and imported; psk_client_cb/psk_server_cb enable external pre-shared keys, and early_data adds TLS 1.3 0-RTT.

Every PHP request used to start a fresh TLS handshake. Persisting the session in Redis or APCu saves a round trip per outgoing HTTPS call, and servers written in PHP can back their session cache with any store.

// Skip the full handshake on the next request by persisting the session
$stored = $cache->get('tls:api.example.com');

$ctx = stream_context_create(['ssl' => [
    'peer_name'      => 'api.example.com',
    'session_data'   => $stored ? Openssl\Session::import($stored) : null,
    'session_new_cb' => function ($stream, Openssl\Session $session) use ($cache): void {
        $cache->set('tls:api.example.com', $session->export(), $session->getTimeout());
    },
]]);

$fp = stream_socket_client('tls://api.example.com:443', context: $ctx);

Intl: grapheme_strrev() and more

RFCs: grapheme_strrev, getdisplaykeyword_and_getdisplaykeywordvalue

grapheme_strrev() reverses by grapheme cluster, so emoji sequences and combining marks stay intact. Locale::getDisplayKeyword() and getDisplayKeywordValue() localise locale keywords, IntlNumberRangeFormatter formats numeric ranges, SpoofChecker learns bidirectional confusables and IntlDatePatternGenerator can return skeletons.

The intl extension keeps closing gaps against ICU. Most of these are small, but the display-keyword pair completes a family that has been incomplete since PHP 5.3.

// Reverses grapheme clusters, so family emoji and combining marks survive
echo grapheme_strrev("PHP 👨‍👩‍👧 8.6");        // 6.8 👨‍👩‍👧 PHP

// Localised labels for locale keywords
echo Locale::getDisplayKeyword('calendar', 'de');                 // Kalender
echo Locale::getDisplayKeywordValue('ja@calendar=japanese', 'calendar', 'en'); // Japanese Calendar

// Number ranges with ICU collapsing rules ("1–5 km")
$f = new IntlNumberRangeFormatter('measure-unit/length-kilometer', 'en');
echo $f->format(1, 5);

Smaller additions worth knowing

The changelog is long; these are the entries most likely to show up in application code.

• json_last_error_msg() and JsonException now name the offset of the failing token.
• curl_getinfo() reports size_delivered, and CURLOPT_SEEKFUNCTION lets libcurl rewind a streamed request body on redirects.
• PDO_PGSQL: Pdo\Pgsql::ATTR_CHUNK_SIZE fetches rows in chunks with libpq 17.
• Stream sockets accept so_keepalive, tcp_keepidle, tcp_keepintvl, tcp_keepcnt, so_linger and so_reuseaddr context options.
• openssl_sign()/openssl_verify() take a $salt_length for RSA-PSS; openssl_x509_parse() lists critical extensions.
• ZipArchive::openString() and closeString() work on in-memory archives.
• gmp_prevprime() and the side-channel resistant gmp_powm_sec().
• Reference assignment into a WeakMap no longer requires the key to exist.
• ini_get_all() exposes builtin_default_value per directive.
• The CLI development server answers the HTTP QUERY method.
• array_filter() gains the explicit ARRAY_FILTER_USE_VALUE constant; finfo_file() works on remote streams.

Secure session defaults

RFC: session_security_defaults

Three INI defaults change: session.use_strict_mode=1 rejects session IDs the server did not issue, session.cookie_httponly=1 hides the cookie from JavaScript and session.cookie_samesite=Lax stops it travelling with cross-site POSTs.

This is the one 8.6 change most likely to reach production unnoticed. Frameworks set these years ago, plain PHP applications often did not. Cross-subdomain hand-offs of a session ID, JavaScript reading PHPSESSID and cross-site form posts break; each has an explicit opt-out in php.ini.

; PHP 8.6 ships these as built-in defaults (were 0 / 0 / unset)
session.use_strict_mode = 1     ; unknown session IDs are rejected (fixation)
session.cookie_httponly = 1     ; document.cookie can no longer read it
session.cookie_samesite = Lax   ; not sent on cross-site POSTs

; Only if you really depend on the old behaviour:
; session.cookie_samesite = None  (requires session.cookie_secure = 1)

Function arguments in error messages

RFC: display_error_function_args

With error_include_args=1 warnings raised by built-in functions include the arguments they were called with, using the same machinery as exception backtraces: #[\SensitiveParameter] values stay masked and zend.exception_string_param_max_len trims long strings.

chmod(): Operation not permitted tells you nothing; chmod('/var/app/cache', 511) does. The setting ships off by default in the beta because of log size and PII concerns, so enable it deliberately in staging first.

$ php -d error_include_args=1 -r 'chmod("/var/app/cache", 0777);'
Warning: chmod('/var/app/cache', 511): Operation not permitted in ...

# #[\SensitiveParameter] values stay masked, long strings are cut
# by zend.exception_string_param_max_len; the INI defaults to 0 (off)

php://filter chains capped at 16

RFC: limit-maximum-number-of-filter-chains

A php://filter URL with more than 16 filters now emits E_DEPRECATED; the limit can be raised per context via filter.max_filter_count and stream_filter_append() remains unlimited.

Chains of convert.iconv and base64 filters are the standard tool to turn a local file inclusion into remote code execution. Legitimate code rarely stacks more than three filters, so the cap removes the exploit class without an INI switch to forget.

// Still fine: two filters
file_get_contents('php://filter/string.toupper|string.rot13/resource=data://text/plain,hello');

// 17+ filters in one URL (the LFI-to-RCE gadget) now emits E_DEPRECATED,
// a later version turns it into an error. Raise the cap only on purpose:
$ctx = stream_context_create(['php' => ['filter.max_filter_count' => 32]]);

Returning from __construct()/__destruct() is deprecated

RFC: deprecate-return-value-from-construct

return with a value in a constructor or destructor emits a compile-time deprecation, as does turning either into a generator with yield. A bare return; to skip the rest of the body remains legal.

Constructors cannot declare a return type, so nothing stopped return $this; from creeping in; an audit of the top 4000 Composer packages found 77 such statements. PHP 9 turns the deprecation into an error.

class Connection
{
    public function __construct()
    {
        return $this;   // Deprecated: Returning a value from a constructor is deprecated
    }

    public function __destruct()
    {
        if (!$this->open) {
            return;     // bare "return;" stays legal
        }
    }
}

mb_ereg*() deprecated: Oniguruma is end-of-life

RFC: eol-oniguruma

All mbregex functions (mb_ereg, mb_ereg_replace, mb_split, mb_eregi, …), the mbstring.regex_* INI settings and MB_ONIGURUMA_VERSION are deprecated in 8.6 and scheduled for removal in 9.0 because the Oniguruma library stopped being maintained in April 2025.

PCRE with the u modifier covers UTF-8 use cases. Code that relies on non-UTF-8 multibyte regex will need the external mb_onig package the RFC author maintains. Grep for mb_ereg and mb_split now; 147 occurrences were found across the top Composer packages.

// Deprecated in 8.6, removed in 9.0 (Oniguruma is unmaintained since 2025-04)
$parts = mb_split('\s+', $text);
$clean = mb_ereg_replace('[^\w]', '', $text);

// PCRE with the /u modifier covers the same ground
$parts = preg_split('/\s+/u', $text);
$clean = preg_replace('/[^\w]/u', '', $text);

Minimum versions and platforms

RFC: min_supported_versions_php_8_6 27–2 accepted 26–0 accepted

Building from git needs autoconf 2.71, persistent MySQL connections require MySQL 5.7.3 or MariaDB 10.2.4 for COM_RESET_CONNECTION, and the official Windows builds move to Visual Studio 2026, OpenSSL 4 and libxml2 2.15.

• autoconf 2.71 (only for builds from git; release tarballs ship configure)
• MySQL ≥ 5.7.3 / MariaDB ≥ 10.2.4 for persistent connections in mysqlnd and PDO
• Windows: VS 2026 (VS18) toolchain, OpenSSL 4, libxml2 2.15.3
• PHP_OS_FAMILY gains the value AIX

Performance

Several patterns now compile to cheaper opcodes, ZTS builds got faster across the board and the JIT reaches Apple Silicon in threaded builds.

• printf() with only %s and %d compiles to string interpolation.
• array_map() with a first-class callable or partial application compiles to a foreach loop without intermediate Closures.
• Arguments to known constructors (new self()) are passed more efficiently.
• The TAILCALL VM is faster and now available on Windows with Clang 19+.
• JIT for ZTS builds on Apple Silicon; general ZTS speed-ups.
• Faster str_ends_with(), str_split(), array_fill_keys(), array_intersect(), array_sum()/array_product() on int arrays, array_unshift(), array_walk(), json_encode() with pretty print.

// Both lines compile to the same string interpolation, no function call
printf("%s has %d items\n", $name, $count);
echo "$name has $count items\n";

// First-class callables and partials in array_map() become a plain loop:
// no intermediate Closure, no userland-callback overhead, JIT-friendly
$upper = array_map(strtoupper(...), $names);
$prefixed = array_map(str_replace('_', '-', ?), $keys);

SNMP

RFC: snmp_improvements_2026

AES192/AES256 security protocols for SNMPv3 where net-snmp supports them, snmp_init_mib() to reset the MIB tree, and new MIB parsing and output controls (snmp_set_mib_option(), snmp_set_output_option(), OID and string output formats).