GoKawiilPHP 8.6.0 RC4 ships with fixes for two remote code execution bugs
The PHP team released PHP 8.6.0 RC4, the third release candidate in the 8.6 cycle, which patches two critical vulnerabilities that could allow unauthenticated remote code execution. Users running earlier 8.6.0 builds are urged to update immediately, though the team stresses RC4 remains a test build not meant for production use. A further release candidate, RC5, is planned for 5 November 2026.
GoKawiil's interpretation of the reporting above, not reported fact.
Remote code execution flaws are among the most severe class of software vulnerabilities, and their presence in pre-release PHP builds highlights how testing phases can still expose real security risks to early adopters. The advisory's urgency suggests the PHP team views the issue as serious enough to warrant immediate patching even in a non-production release candidate.
- PHP 8.6.0 RC4 fixes two critical unauthenticated RCE vulnerabilities
- Users on earlier PHP 8.6.0 builds should update immediately
- RC4 is still a test version; production use is discouraged, with RC5 due 5 November 2026
Source: php.net, 2026-10-23
Published there as: “PHP advisory: disable session upload progress to prevent another unlikely RCE”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.