# PHP 8.6.0RC4 is available for testing

- Thread: https://externals.io/message/132894
- Original archive: https://news-web.php.net/php.internals/132894
- Started by Matteo Beccati on 2026-10-21T16:21:03+00:00
- Messages: 1
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · RFCs at https://externals.io/rfc.md · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #132894 — Matteo Beccati — 2026-10-21T16:21:03+00:00

URL: https://externals.io/message/132894#132894

PHP 8.6.0RC4 has just been released and may be downloaded from
https://downloads.php.net/~mbeccati/

Or use the git tag: php-8.6.0RC4

This version also contains the fixes for two critical vulnerabilities 
that can allow unauthenticated remote code execution. Everyone running 
earlier builds of PHP 8.6.0 is strongly encouraged to update immediately.

This is an early test release and not intended for production use.

Windows binaries are available at: 
https://www.php.net/pre-release-builds.php#windows

Please test it carefully, and report any bugs at
https://github.com/php/php-src/issues/new?template=bug_report.yml
on GitHub.

8.6.0RC5 should be expected in ~2 weeks, i.e. on 5 Nov 2026.

Hash values and PGP signatures can be found below or at
https://gist.github.com/mbeccati/39f97a084c818707537c9316206eb74f

Thank you, and happy testing!

Regards,
Matteo Beccati, Joe Ferguson & Daniel Scherzer



php-8.6.0RC4.tar.bz2
SHA256 hash: 
60d433d768e9c017632a0402048b0d189979d7659483db65df6790018e10d306
PGP signature:
-----BEGIN PGP SIGNATURE-----

iHUEABYKAB0WIQQBaJXemkdREdU3puaRNP8wvFqZtQUCatjPwAAKCRCRNP8wvFqZ
tYpbAQCNKU7pP3CYk7m/V7HqJPE38BAuxRPSBsCHh6yKEGBRnwEA9UzLO1WLNcTB
VjMJrBMTkvCzhK0VxrwbffAKh7qL6wU=
=UU3o
-----END PGP SIGNATURE-----


php-8.6.0RC4.tar.gz
SHA256 hash: 
ac4e19a92fc2d8a6a3b5310b149330475e602a8fd8f9278976bb1ee1b6b6665e
PGP signature:
-----BEGIN PGP SIGNATURE-----

iHUEABYKAB0WIQQBaJXemkdREdU3puaRNP8wvFqZtQUCatjPwAAKCRCRNP8wvFqZ
tcJLAPwPRYRuJ1oJoRvBxBp3MMWokuV6y6jeYeHoC2EVIKozVQEAi3FOu/zGM6YA
vQRUHxI7WyYBxfdSoDJVN846Zu3lkAk=
=Rz8p
-----END PGP SIGNATURE-----


php-8.6.0RC4.tar.xz
SHA256 hash: 
93f208da9ae059bf6863b0e1d101e6c6475a7b0f0acbf6c084950ab522f514d8
PGP signature:
-----BEGIN PGP SIGNATURE-----

iHUEABYKAB0WIQQBaJXemkdREdU3puaRNP8wvFqZtQUCatjPwAAKCRCRNP8wvFqZ
tSmpAQDoZzynreTcJG4x8ORk/37jLFkpYanVUs5AfQoUriSFlwEA2AnSbnXiDtae
mZtN087ADtwF9DjmDNz1stVLbjHA0QE=
=ubPo
-----END PGP SIGNATURE