PHP 8.6 is due 19 November: what it means for Moodle

The next PHP release is PHP 8.6, scheduled for 19 November 2026. It is not PHP 9.0. You will not be able to run it under a supported Moodle for a long while, because Moodle has not finished supporting PHP 8.5 yet, and 8.5 came out a year ago.

This post covers what 8.6 contains, which parts will break old plugin code, what happened to PHP’s support calendar this year, what the PHP Foundation has been doing, and what Moodle plugin developers should do now. Everything here was checked on 31 October 2026.

Why is it 8.6 and not 9.0?

Because nobody proposed a major version. For two years, RFC threads on the internals list kept asking whether the next release would be “8.6 or 9.0”. The answer came from the release process, not from a vote. When the 8.5 branch was cut in September 2025, Alexandre Daubois answered the question in one of those threads: “The next version is likely to be 8.6. The 8.5 branch has been cut this week and the NEWS file now targets 8.6 on master.”¹1 PHP internals, Re: [RFC] Add pack()/unpack() support for signed integers with specific endianness, Alexandre Daubois, 26 September 2025.

That is how it went. The PHP-8.6 branch was created on 22 September 2026, and main/php_version.h on php-src master now reads 8.7.0-dev.²2 GitHub, php/php-src main/php_version.h on master and on PHP-8.6, checked 31 October 2026. So the release after 8.6 is planned as 8.7, not 9.0.

PHP 9.0 still exists as an idea. The RFC index keeps a group of accepted changes marked “PHP 9.0”, such as turning undefined variable and undefined property warnings into errors, waiting for a major version with no date.³3 PHP Wiki, Requests for Comments, and Exempt input type and value validation from BC Break policy. Some 8.6 RFCs had their target moved from 9.0 to 8.6 during discussion, the form feed change to trim() among them.⁴4 PHP internals, [Vote] Add Form Feed in Trim Functions, February 2026.

Where is the release right now?

The schedule on the PHP wiki targets general availability on 19 November 2026.⁵5 PHP Wiki, PHP 8.6 release managers’ todo and timetable. The release managers are Daniel Scherzer (veteran), Matteo Beccati and Joe Ferguson.⁵

RC1 was skipped after a packaging script got the internal API numbers wrong; Scherzer wrote it up.⁶6 Daniel Scherzer, No PHP 8.6.0RC1, 23 September 2026. RC4 also carries the fixes for the two critical php2shell bugs, and the announcement tells anyone running earlier 8.6 builds to update immediately.⁷7 PHP internals, PHP 8.6.0RC4 is available for testing, Matteo Beccati, 21 October 2026. Our php2shell breakdown covers those.

GA dates can slip by a week or two. Treat 19 November as the plan until the release is tagged.

What does PHP 8.6 add that you would actually use?

The UPGRADING file on the 8.6 branch is the reference.⁸8 GitHub, php/php-src UPGRADING, PHP-8.6 branch. The changes most PHP developers will notice:

• Partial function application. Write a call with ? placeholders and you get a closure back instead of a result. It passed 33 to 0.⁹9 PHP internals, [Vote] Partial Function Application v2, and PHP Wiki, Partial Function Application v2. It pairs with the pipe operator from 8.5:

$slug = $title
    |> trim(...)
    |> strtolower(...)
    |> str_replace(' ', '-', ?);

• Readonly properties can have default values.
• clamp(), which returns a value forced into a range.
• A Time\Duration class in the date extension.
• #[\Override] on class constants, and __debugInfo() on enums.
• A polling API and a new stream error API. Both came out of the stream layer work paid for by Germany’s Sovereign Tech Fund.¹⁰10 The PHP Foundation, Impact and Transparency Report 2025.
• Function arguments in error messages, behind a new error_include_args INI setting that is off by default.
• Performance work, including faster versions of many array and string functions.

PHP 8.6 is also the first release under the Modified BSD license. The license RFC passed 51 to 0 and replaces the old PHP License and Zend Engine License from the next 8.x version.¹¹11 PHP Wiki, PHP License Update, and GitHub, php/php-src LICENSE, PHP-8.6 branch. The LICENSE file on the 8.6 branch already has the new text. Your rights as a user do not change. Lawyers who flagged the old license as non-standard can stop doing that.

Which changes will break old plugin code?

Two kinds of change matter here: deprecations, which only add notices for now, and changed behaviour, which can break code on day one.

Changed behaviour first. The one Moodle people should read twice is session defaults. Three INI defaults flip to safer values:⁸

Moodle core sets its own session cookie parameters, SameSite included, in core\session\manager, so we would not expect core to break.¹²12 GitHub, moodle/moodle public/lib/classes/session/manager.php, main branch. Custom session handlers, SSO plugins and anything that relies on a session cookie being sent with a cross-site POST should be tested, not assumed safe. Custom handlers that implement SessionHandlerInterface without create_sid() and validateId() also get a deprecation notice.

Many functions now throw ValueError or TypeError where they used to warn and carry on. A separate accepted RFC exempts this kind of input validation from the usual rule against breaking changes in minor releases, and that is one reason section 1 of UPGRADING is long for a “.6”.³ Examples include number_format() with an out-of-range $decimals, array_filter() with an invalid mode, and file_exists() or is_file() with a filename containing a NUL byte.

Deprecations that show up in older PHP code:

• is_integer(), is_long(), is_double() and doubleval(). Use is_int(), is_float() and floatval().
• spl_object_hash(). Use spl_object_id().
• return inside a finally block.
• Returning a value from __construct() or __destruct().
• strcoll() and the SORT_LOCALE_STRING sort flag. Use the intl Collator class.
• The mb_ereg* family, because the Oniguruma library behind it is no longer maintained.
• SplFileObject::fgetcsv() and fputcsv().
• Passing objects to array_walk() or http_build_query().
• mysqli_stmt_init() and mysqli_get_charset().
• A third argument to define(), and metaphone().

None of these stop a plugin from running on 8.6. They fill the logs with notices and mark what a future major version can remove.

What about PHP 8.5?

PHP 8.5.0 came out on 20 November 2025.¹³13 GitHub, php/php-src NEWS, PHP-8.5 branch. The headline was the pipe operator (|>). It also added the always-on URI extension for parsing URLs to RFC 3986 and WHATWG rules, clone() with property overrides, array_first() and array_last(), and the #[\NoDiscard] attribute. Its deprecations included backticks as an alias for shell_exec() and the non-standard casts (integer), (boolean), (double) and (binary).¹⁴14 GitHub, php/php-src UPGRADING, PHP-8.5 branch, and The PHP Foundation, PHP 8.5 adds pipe operator.

Which PHP versions lose support at the end of 2026?

PHP gives each release two years of bug fixes and two more years of security fixes, with every deadline on 31 December.¹⁵15 PHP Group, Supported versions. On 31 December 2026:

1. PHP 8.2 reaches end of life. No more security fixes.
2. PHP 8.4 leaves active support. It gets security fixes only, until the end of 2028.
3. PHP 8.3 is already security-only, since the end of 2025.

By the same rule, 8.6 should get bug fixes until the end of 2028 and security fixes until the end of 2030. php.net will publish its exact dates at release. We covered what running unsupported PHP under Moodle costs in an earlier post, so we won’t repeat it here.

What has the PHP Foundation been doing?

The PHP Foundation pays developers to work on PHP itself. Its 2025 report, published in May 2026, gives the numbers: $730,534 from 536 sponsors and individual donors in 2025, 11 contracted developers at the start of 2026, and roughly 42% of all commits to PHP’s core authored by foundation people.¹⁰ The July quarterly report put the core team at 13 people in 8 countries.¹⁶16 The PHP Foundation, Quarterly Report Q2 2026.

The year’s notable moves:

• New leadership. Elizabeth Barron took over as executive director in February 2026 from founding director Roman Pronskiy.¹⁷17 The PHP Foundation, Welcoming Elizabeth Barron as our new Executive Director.
• An ecosystem security team. In May the foundation announced an Alpha-Omega grant to fund an “Ecosystem AI Security Engineer in Residence” for six months, with Volker Dusch in the role. The stated reason is blunt: AI tools are finding real bugs faster, and maintainers are also drowning in low-quality AI-generated reports.¹⁸18 The PHP Foundation, Announcing the PHP Ecosystem Security Team.
• An honest php2shell post-mortem. On the day of the October security release, the foundation explained that one of the two bugs was first spotted in 2024, during a fix for an issue from an external audit, and that the fix stalled for months. In their words: “the delay was a structural failure.”¹⁹19 The PHP Foundation, Today’s PHP Security Release, and How We’re Strengthening PHP Security.
• PIE reached 1.5 in October. It is the new extension installer meant to replace PECL.²⁰20 The PHP Foundation, PIE 1.5 Released.

If your organisation makes money on PHP, sponsoring this team is cheap insurance.

Which PHP versions does each Moodle branch accept?

From each release’s notes on moodledev.io:²¹21 Moodle HQ, Releases and release notes for 4.5, 5.1, 5.2 and 5.3.

No supported Moodle release accepts PHP 8.5, let alone 8.6. Moodle’s PHP policy page, last updated 15 September 2026, says 8.5 support “is currently being implemented for Moodle 5.3 and later releases” and is “only for development purposes”.²²22 Moodle HQ, PHP policy page, last updated 15 September 2026.

From January 2027, the newest PHP any Moodle supports is 8.4, and 8.4 drops to security fixes only on 31 December 2026. Every supported Moodle site will run on a PHP branch that no longer gets bug fixes. That is still safe if you take the security releases. It is not where Moodle used to be.

How long until Moodle supports PHP 8.6?

Look at the pattern in Moodle’s own tracker. PHP 8.3 came out in November 2023 and was supported from Moodle 4.4 in April 2024. PHP 8.4 came out in November 2024 and was supported from Moodle 5.0 in April 2025.²² So Moodle used to support each new PHP about five months after its release.

PHP 8.5 broke that pattern. It missed Moodle 5.2 in April 2026 and 5.3 in October 2026. The epic, MDL-84684 “Prepare Moodle for PHP 8.5”, was still open on 29 October 2026. Some subtasks have landed in 5.3, others are still in development or review, such as converting core away from the soft-deprecated __sleep() and __wakeup() methods.²³23 Moodle Tracker, MDL-84684: Prepare Moodle for PHP 8.5 and its subtasks, checked 31 October 2026. We found no “Prepare Moodle for PHP 8.6” epic.

Our reading: Moodle will support 8.5 first, probably in a 2027 release. PHP 8.6 support comes after that. If you are planning servers, plan on PHP 8.4 for Moodle through 2027, and treat 8.6 under Moodle as a 2028 question. That is our estimate, not a Moodle commitment.

What should plugin developers check now?

You don’t need PHP 8.6 in production to get ready for it. You need it in CI.

1. Add 8.5 and 8.6 to your CI matrix as allowed failures. With moodle-plugin-ci, that means extra PHP versions in your GitHub Actions matrix, marked continue-on-error, running against Moodle’s main branch. Its changelog only mentions running with PHP up to 8.4 so far, so expect rough edges.²⁴24 Moodle HQ, moodle-plugin-ci change log.
2. Run PHPCompatibility against the new versions. moodle-plugin-ci phpcs takes a --test-version option that passes a version or range to PHPCompatibility.²⁵25 Moodle HQ, moodle-plugin-ci CLI commands. Static analysis with PHPStan or Psalm set to a newer PHP version catches more.
3. Grep for the cheap ones. is_integer, is_long, is_double, doubleval, spl_object_hash, mb_ereg, SORT_LOCALE_STRING, strcoll, backticks. These are a few minutes each to fix today and a pile of log noise later.
4. Test login and SSO flows with the new session defaults. Set the three session INI values above on a PHP 8.4 test server. You don’t have to wait for 8.6 to see whether anything depends on the old behaviour.
5. Keep the minimum where Moodle’s is. A plugin for Moodle 5.2 or 5.3 can use PHP 8.3 syntax. Don’t use 8.5 or 8.6 features like the pipe operator or partial application in plugin code until the oldest Moodle you support requires them. That is years away.

Why we track this

Custom Moodle plugins are often written against one PHP version and never touched again. Each PHP release adds a few more notices, and one day an upgrade fails on them. We follow PHP so the plugins we build and maintain are ready before Moodle moves; our care plan does the same for yours. Related: Moodle 5 requirements, Symfony in 2026 and Laravel 13.