PHP 8.6.0 RC7 landed on 12 November 2026, one week before the planned general availability release on 19 November. It is a small build, but the release candidates around it carry one change every PHP 8.6 tester must act on: the PHP API number was bumped, so compiled extensions built against earlier 8.6 test builds need rebuilding. This guide explains what changed in RC6 and RC7, how to rebuild and verify extensions, and gives you a quick smoke-test script for three PHP 8.6 features you will probably adopt first.

Why there were extra release candidates

RC5 was meant to be the last candidate. On 9 November, release manager Matteo Beccati told the internals list that the team would add another one, because the php2shell security fix had introduced an ABI incompatibility in the 8.6 branch only. As quoted by PHP News:

The php2shell fix introduced an ABI incompatibility in PHP 8.6, but not in older versions, which is why it was missed. Per our release policy, the API version number therefore needs to be bumped, requiring extensions to be rebuilt.

That produced RC6 and now RC7. The PHP 8.2-8.5 branches are not affected by this ABI change.

What is in RC6 and RC7

According to the NEWS file at the RC7 tag, both are bug-fix-only:

RC6

  • Core: padding added to globals so future patch releases can add fields without breaking ABI.
  • Date: timelib updated to 2026.03.
  • Fileinfo: fixes for TrueType fonts detected as application/octet-stream since libmagic 5.48 (GH-25051), and wrong MIME types for HWPX files.
  • Streams: a use-after-free of the previous request’s default stream context when a stream error is raised during request startup.

RC7

  • Core: an array_map() optimisation not resolving the function name of a first-class callable.
  • OpenSSL: a use-after-free in TLS server ALPN and Windows certificate checks when the stream passed to stream_socket_enable_crypto() is closed before the handshake.

In the source tree, PHP_API_VERSION in main/php.h was 20260924 at the RC5 tag and is 20261112 at RC7, and ZEND_MODULE_API_NO is also 20261112. That is the number your extensions must match.

Step 1: Install RC7 in a test environment

The php.net announcement is clear: do not use RC7 in production. Download the source from the release candidates page, or use your usual container or CI tooling for pre-releases. A plain source build looks like this:

tar xf php-8.6.0RC7.tar.xz && cd php-8.6.0RC7
./configure --prefix=$HOME/php86 --enable-mbstring --with-openssl --with-zlib
make -j"$(nproc)" && make install
$HOME/php86/bin/php -v

Step 2: Rebuild every compiled extension

Any .so or .dll built against RC5 or earlier 8.6 builds will refuse to load after the API bump. That covers PECL modules (Redis, Imagick, APCu and others), in-house extensions and anything installed with PIE. First confirm the API numbers your toolchain sees:

$HOME/php86/bin/php -i | grep -E "PHP API|PHP Extension"
$HOME/php86/bin/php-config --extension-dir

Then rebuild each extension against the RC7 headers:

cd redis-src
$HOME/php86/bin/phpize
./configure --with-php-config=$HOME/php86/bin/php-config
make clean && make -j"$(nproc)" && make install

Finally, verify everything loads with no startup warnings:

$HOME/php86/bin/php -m
$HOME/php86/bin/php -r 'var_dump(extension_loaded("redis"));'

If you see “Module compiled with module API=…” errors, a stale binary is still in your extension directory. For closed-source loaders and commercial extensions, check that the vendor publishes builds for the final 8.6 API before you plan a production switch.

Step 3: Smoke-test new 8.6 features

While RC7 is installed, try a few features from the UPGRADING notes. We covered partial function application in an earlier post, so this script focuses on three others.

clamp()

The clamp RFC adds clamp(mixed $value, mixed $min, mixed $max): mixed. It returns the value if it is in range, otherwise the nearest bound, and throws ValueError if $min is greater than $max or either bound is NAN. It follows normal PHP comparison rules, so it also works with strings and DateTimeImmutable.

Readonly property defaults

The readonly defaults RFC lets readonly properties declare a default value. That is useful for classes implementing get-only interface properties without boilerplate constructors.

SortDirection

A new global SortDirection enum is listed in UPGRADING (RFC), so libraries no longer need their own ASC/DESC constants. Check the RFC for its exact case names before using it widely.

<?php
// smoke86.php — run with: $HOME/php86/bin/php smoke86.php
declare(strict_types=1);

// 1. clamp()
var_dump(clamp(150, min: 0, max: 100));   // int(100)
var_dump(clamp(-5, 0, 100));              // int(0)
var_dump(clamp("d", "c", "g"));           // string(1) "d"

try {
    clamp(4, 8, 6);
} catch (ValueError $e) {
    echo "ValueError: ", $e->getMessage(), PHP_EOL;
}

// 2. Readonly property defaults with a get-only interface property
interface HasDriver
{
    public string $driver { get; }
}

final class RedisCache implements HasDriver
{
    public readonly string $driver = 'redis';
}

$cache = new RedisCache();
echo $cache->driver, PHP_EOL;              // redis

try {
    $cache->driver = 'file';
} catch (Error $e) {
    echo get_class($e), ": ", $e->getMessage(), PHP_EOL;
}

// 3. SortDirection exists as a global enum
var_dump(enum_exists(SortDirection::class)); // bool(true)
var_dump(array_map(fn($c) => $c->name, SortDirection::cases()));

Run your own test suite on RC7 too. Release candidates exist so that problems surface before 19 November, and the team asks for issues to be filed on GitHub.

Upgrade checklist for 19 November

  • Rebuild all compiled extensions against RC7 now, and again against 8.6.0 GA.
  • Confirm third-party extension vendors support the final 8.6 API.
  • Run your test suite and static analysis against RC7.
  • Keep production on 8.5 or earlier until GA ships and your dependencies declare 8.6 support.
  • Remember that the php2shell fixes for supported older branches came in separate releases. Make sure those servers are patched as well.

Takeaway

RC7 is not exciting, and that is good news: the 8.6 release is in its final stabilisation week. The one action item is the API bump. Rebuild and verify your extensions today so release day is a version change, not a debugging session.

Sources: php.net news, php-src NEWS (RC7 tag), PHP News on the extra RC.