The php.net release schedule is down to its last checkpoint: RC5 on November 5, GA on November 19, 2026. Here's the full timeline from alpha to release, and what the one-RC-left milestone actually means for anyone planning a production upgrade.
Two GitHub advisories published November 2 describe two ways to defeat Craft's guard against attacker-chosen classes — one via isset()'s blind spot on null, one via an incomplete DOMDocument blocklist that forgot ZipArchive and XMLWriter. Both were quietly fixed in 5.11.4, weeks before anyone outside Craft knew they existed.
I already wrote about PFA's footguns on RC3. With feature freeze behind it and GA set for 19 November, here's the quieter PHP 8.6 RFCs that will actually change day-to-day code: readonly property defaults, hardened session settings by default, a Duration class, and clamp().
The Bound-Erased Generic Types RFC had a working implementation and a real syntax proposal, and it still failed its primary vote by a wide margin. I read the RFC to see what PHP generics would have looked like, why it lost, and whether PHPDoc templates are actually fine in the meantime.
PHP pre-announced an emergency release on 20 Oct, then shipped 8.5.12/8.4.27/8.3.36/8.2.35 fixing two critical RCEs the next day. My Dockerfile already pointed at the right base image tag — and that still wasn't good enough. Here's why, and the one-line fix.
PHP 8.6 adds partial function application — load('node', ?) returns a closure. I ran it on the RC and hit three sharp edges: arguments evaluate at creation not call, extra args are silently ignored, and the ... placeholder leaks keys into optional parameters. Plus why Drupal contrib can't use it for years.
PHP 8.6 RC3's long deprecation list is just log noise. The sneaky changes are the filesystem functions that used to return false on a NUL byte and now throw a ValueError — a 500 you won't catch in a unit test. Plus where Drupal's 8.6 support actually stands.
PHP 8.6 turns on strict mode, httponly and SameSite=Lax by default. For a Drupal box that's a non-event for web traffic — Drupal forces all three. The real exposure is CLI scripts and SSO flows. Test, don't assume.
![The PHP attribute that yells at you for ignoring a return value: #[\NoDiscard] in 8.5](https://blog.bms.ovh/sites/default/files/styles/bluemoose_cover/public/covers/jxOzEZVtcTz2OYP0-OenUUmj3oe7VSWKvPW1xZ2XLl0.jpg?itok=xqjr3Xg7)
PHP 8.5's #[\NoDiscard] makes the engine warn you when you call a function and throw away its result — the classic immutable-API footgun ($url->withScheme('https') that quietly did nothing). Why it's the rare attribute that improves your code by nagging you, where it fits in Drupal (Url, cache metadata, fluent withX() setters), the (void)-cast escape hatch, and why it only helps if your CI fails on warnings.
Craft 6 (alpha since May 2026) is a ground-up port from Yii onto Laravel, and can embed in an existing Laravel app. I lived Drupal's Symfony 'get off the island' in Drupal 8, so I have a haunted perspective: the framework swap is the right long-term bet and a short-term ecosystem earthquake. The questions that decide it aren't about Laravel — they're about the plugins.
