PHP 8.6 is coming: what WordPress site owners should know
Short answer
PHP 8.6 is in release candidates, with the final release planned for 19 November 2026. For a live WordPress site, there’s nothing to do yet: WordPress’s compatibility table doesn’t list 8.6 so far, and your plugins need time to follow. What it changes for plugin code, according to PHP’s own upgrade notes: mostly new deprecation notices, such as spl_object_hash(), a third argument to define(), mysqli_get_charset() and the mb_ereg*() functions. Meanwhile, the priority is the October 2026 security update on the version you run now.
When
From the PHP wiki’s timetable for 8.6: release candidates RC2 on 24 September, RC3 on 8 October and RC4 on 21 October 2026, RC5 planned for 5 November, and the general release on 19 November 2026 (wiki.php.net). The timetable notes: “Individual releases may be added or removed to accommodate development progress.”
php.net, announcing RC4 on 21 October: “This version also contains the fixes for two critical vulnerabilities that can allow unauthenticated remote code execution.” And: “Please DO NOT use this version in production, it is an early test version.” (php.net)
What WordPress says so far
The WordPress core team’s compatibility table lists PHP versions up to 8.5. Until 8.6 appears there, treat it as untested with WordPress itself, before even looking at plugins.
What changes for plugin code
PHP’s upgrade notes for 8.6 list mostly deprecations for the kind of code plugins contain (UPGRADING):
| In the code | On PHP 8.6 |
|---|---|
spl_object_hash() | Deprecated: use spl_object_id() |
define() with a third argument | Deprecated |
mysqli_get_charset(), mysqli_stmt_init() | Deprecated |
The mb_ereg*() functions (mbregex) | Deprecated |
return inside a finally block | Deprecated |
Returning a value from __construct() or __destruct() | Deprecated |
The upgrade notes on the first one: “The spl_object_hash() function is now deprecated. Use spl_object_id() instead.” (UPGRADING) WordPress itself is already past it: since WordPress 7.1, its hook system “Uses spl_object_id() instead of spl_object_hash() for performance.” (WordPress 7.1.2 source)
The same notes list a few behaviour changes in PHP’s core, such as by-reference foreach loops visiting elements differently after an array is compacted. Those depend on values and code paths; your error log will show their effects.
What to do now
- Patch the version you run: 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or later (check it). That’s what protects your site today.
- If you’re on 8.2 or older, move to 8.3, 8.4 or 8.5 first; all three are supported for years (which one).
- Leave 8.6 for later: after its release, after WordPress lists it, and after a check of your plugins.
For PHP 8.5, the newest version WordPress supports today, what changes and how to check: WordPress and PHP 8.5.
Key takeaways
- PHP 8.6.0 RC4 came out on 21 October 2026; the final release is planned for 19 November 2026.
- WordPress’s compatibility table lists PHP up to 8.5 so far.
- For plugin code, 8.6 mostly adds deprecation notices: spl_object_hash(), define() with 3 arguments, mbregex and more.
- WordPress 7.1 already moved from spl_object_hash() to spl_object_id().
- Don’t run release candidates in production; patch your current version first.
Frequently asked questions
Should I move to PHP 8.6 when it’s released?
Not on day one. Wait until WordPress lists it as compatible and your plugins have been checked for it; meanwhile 8.4 and 8.5 are supported for years.
Is PHP 8.6 affected by PHP2Shell?
php.net says RC4 contains the fixes, and asks everyone running earlier 8.6 test builds to update immediately.
Can CompatNav check for PHP 8.6?
Today CompatNav checks upgrades to PHP 8.0 through 8.5, with 58 checks. PHP 8.6 isn’t among them.
Check your own site before you upgrade
CompatNav is a free WordPress plugin. It reads the code of your plugins and themes on your own server and tells you, in plain words, what will break and what will only show notices on the PHP version you choose. It never changes your code. It can’t see problems that only appear while code runs with real data, so a quick check of your site after the upgrade still matters.
Sources
- PHP wiki: PHP 8.6 timetable
- php-src: UPGRADING notes for PHP 8.6
- php.net: News archive 2026
- make.wordpress.org: PHP Compatibility and WordPress Versions
About the code examples: each output is the real output of the code shown, run with the official PHP builds, without a php.ini, with all errors reported and displayed. Only the file path was replaced by a neutral server path.