The Future of PHP

In short: The future of PHP is largely fixed and can be read publicly. Every version receives four years of support, two of them with security fixes only, in each case until 31 December. According to the schedule, PHP 8.6 is planned for 19 November 2026 and brings, among other things, more secure session defaults. For PHP 9.0 there are accepted change proposals but no announced date. For companies this means: plannable upgrades instead of surprises, as long as they use supported versions.

How is the future of PHP decided?

In PHP, new features and rules come about through RFCs (Request for Comments). A proposal is published in the PHP wiki, discussed on the mailing list and then voted on. For the new session defaults, for example, a two-thirds majority was required according to the RFC. Only an accepted and implemented RFC is documented planning; proposals under discussion are ideas, not commitments.

This is an advantage for decision-makers: anyone who wants to know what is coming can read the list in the wiki instead of relying on rumours. On this page we therefore name only accepted or implemented RFCs and official dates.

Fixed support periods: four years per version

In 2024, the PHP project adjusted the release cycle by RFC. Since then the following applies: two years of active support with bug and security fixes, then two years for critical security problems only. The deadlines end uniformly on 31 December. Release candidates may no longer contain new features.

The values for 8.2 to 8.5 come from php.net; those for 8.6 we derived from the current rule; they are binding only once php.net publishes them. What this means for older versions is described in PHP versions and release cycle and PHP end of life: risks of outdated versions.

PHP 8.6: what has been decided

According to the schedule in the PHP wiki, the release of PHP 8.6.0 is planned for 19 November 2026. On 21 October 2026 the fourth release candidate appeared, which according to php.net already contains the fixes for the two PHP2Shell vulnerabilities; earlier 8.6 test versions are to be replaced. The next release candidate is announced for 5 November 2026. Test versions do not belong in production.

A selection of the RFCs listed in the wiki as implemented for PHP 8.6:

1. Secure session defaults: session.use_strict_mode and session.cookie_httponly are switched on by default, session.cookie_samesite is set to Lax.
2. Function arguments in error messages: additional details that help with troubleshooting.
3. Limiting filter chains: an upper limit on the number of chained filters.
4. New language features: among others clamp(), partial function application and default values for readonly properties.
5. Deprecation: return values from __construct() and __destruct() are marked as deprecated.

What already came with PHP 8.0 to 8.5 is summarised in PHP 8.0 to 8.5: the key new features.

PHP 9.0: accepted proposals, no date

Several RFCs expressly provide for changes in PHP 9.0 and are accepted but not yet implemented. These include: an error instead of a warning for undefined variables and properties, the removal of the ${} notation in strings, the removal of session IDs via GET and POST, and the end of implicitly nullable parameter types. No release date for PHP 9.0 has been announced on php.net.

For planning this means: code that produces warnings about deprecated features today should be cleaned up now. Then the later jump will not be a major project.

The wiki also lists many proposals under discussion, such as a shared binary for command line and FPM or concurrency in the engine. Whether they will come is open.

Who sustains PHP

PHP is maintained by volunteers and paid developers. For each version there is a team of release managers; for PHP 8.6 the wiki names Daniel Scherzer, Matteo Beccati and Joe Ferguson. The PHP Foundation describes its mission as ensuring the long-term prosperity of the language and, by its own account, commissions a team of part-time and full-time developers for maintenance, security and new features.

The infrastructure is also being modernised: since PHP 8.5, OPcache is built in permanently, and an RFC decided to recommend PIE for extensions and to mark PECL as deprecated.

What the future of PHP means for your security

PHP2Shell has shown how important support periods are. For 8.2 to 8.5, official fixes arrived on 21 October 2026; for 8.1 and older there were only minimal source backports. PHP 8.2 ends on 31 December 2026. Anyone planning today should hold on to three things:

• Every version in use needs a known end of support in the calendar.
• The switch to the next supported version belongs in good time before that date.
• New defaults such as the secure session settings in 8.6 are welcome but do not replace deliberate configuration.

How does PHP SOS help?

For the migration to a supported PHP version, we proceed as follows:

• Inventory and deadlines: We record all PHP versions and enter their end of support in your plan.
• Check upgrade readiness: We show which applications and extensions block a new version.
• Carry out the switch: Test, changeover, restart and verification, version by version.
• Look ahead: We follow RFCs and release dates and notify you when a change affects your systems.

Frequently asked questions

Sources

• php.net: Supported versions
• PHP RFC: Release cycle update
• PHP RFCs (overview)
• PHP RFC: Secure Session Configuration Defaults