PHP 8.6 enters the home stretch, with the final release featuring partial function application due on 19 November
New test builds are out, and they also include the fixes for the serious PHP2Shell flaws from late October.
PHP's developers this week released a new release candidate of PHP 8.6, together with test builds of maintenance releases 8.5.13 and 8.4.28. According to Warp2Search, it is the last candidate before the final version, which is scheduled for 19 November. Laravel News gives the same date, although that site numbers the candidates differently. This is test software not intended for production.
The most notable new feature is partial function application: using a question mark as a placeholder for one argument, or three dots for all remaining arguments, creates a closure with some of the arguments already filled in. An earlier proposal was rejected in 2021; the second version passed 33 to 0, according to Laravel News. Other additions include a clamp() function, a Time\Duration class with nanosecond precision, a common polling API on top of systems such as epoll and kqueue, and default values for readonly properties.
New installations also get safer default session settings, such as strict mode and cookies that cannot be read through JavaScript. The test builds contain the fixes for PHP2Shell, two critical flaws patched on 21 October that allowed an unauthenticated attacker to run code. According to Tenable, they were already being actively exploited at the time, and the US cyber agency CISA added them to its list of exploited vulnerabilities.