Patched

Two critical PHP remote code execution flaws (CVE-2026-109618, CVE-2026-109619) are fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. ForgeKit ships them out of the box.

← All guides

Guide · Last updated: November 2026

PHP 8.6 on Windows: Release Date, Download, XAMPP Support and What Changes

PHP 8.6 is scheduled for 19 November 2026. Here's what that means on Windows: where the official build comes from, the one new requirement it brings, whether XAMPP will have it, what might break in older projects, and how to run it next to the PHP you already use.

The short answer

  • PHP 8.6 is scheduled for Thursday 19 November 2026. The official Windows build will be on windows.php.net, usually on release day or shortly after.
  • It's built with Visual Studio 2026, so it may need a newer Visual C++ Redistributable than PHP 8.5 did.
  • XAMPP has no PHP 8.6 build and hasn't announced one. Its PHP 8.5 build came about eleven months after PHP 8.5.
  • Most code written for PHP 8.5 runs on 8.6. The things to check are stricter session defaults and a batch of deprecations, mostly in older code.

When is PHP 8.6 released?

The official PHP 8.6 schedule sets general availability for 19 November 2026, following alphas from July, betas from August and release candidates from September.

Dates can move by a week if a last-minute bug turns up. This page will be updated on release day with the final version and download links.

Installing PHP 8.6 on Windows

The official release comes on 19 November. You don't have to wait for it.

A pre-release version is available now: php-8.6.0RC7-Win32-vs18-x64.zip. This is the x64 Thread Safe build, the one that works with Apache. Avoid the zips with nts or x86 in the name. It's fine for testing on your own machine, not for live sites.

In ForgeKit (made by me), for the pre-release:

  • Download the zip from the link above.
  • Extract it into ForgeKit's bin folder, for example C:\ForgeKit\bin\php-8.6.0-pre-release.
  • ForgeKit detects it automatically, so just use it: click Switch PHP on one of your web servers, or add web server for a new one on PHP 8.6.

For the official release, there's nothing to extract: PHP 8.6 will be in Manage Binaries, ready to install and use with one click.

Otherwise, extract it into its own folder, such as C:\php86, copy php.ini-development to php.ini and turn on the extensions you need. Check it with C:\php86\php.exe -v, then test a project with C:\php86\php.exe -S localhost:8086. If php.exe complains about VCRUNTIME140.dll, install the latest Visual C++ Redistributable (x64).

Will XAMPP support PHP 8.6?

Probably, eventually, but not on release day. As of 12 November 2026, apachefriends.org offers XAMPP for Windows with PHP 8.5.12, 8.4.27 and 8.3.36, and doesn't mention 8.6.

  • PHP 8.5 came out on 20 November 2025. XAMPP's PHP 8.5 build arrived on 23 October 2026.
  • Before that, XAMPP 8.2.12 (November 2023) was the newest XAMPP for Windows for almost three years.

Once PHP 8.6 is out, you can swap it into XAMPP yourself. It replaces XAMPP's PHP rather than adding a second one:

  1. Stop Apache in the XAMPP Control Panel and copy the xampp\php folder somewhere safe.
  2. Download the x64 Thread Safe zip of PHP 8.6. Apache's PHP module, php8apache2_4.dll, only comes in the Thread Safe build.
  3. Replace the contents of xampp\php with the files from the zip.
  4. Recreate php.ini from php.ini-development and copy across your settings and extensions (mysqli, pdo_mysql, intl, gd and so on).
  5. Check that the LoadModule line in xampp\apache\conf\extra\httpd-xampp.conf points at php8apache2_4.dll, then start Apache.

If Apache won't start, xampp\apache\logs\error.log usually says why: the Non Thread Safe zip, a wrong LoadModule path, or an outdated Visual C++ runtime. To go back, put your saved php folder back.

What changes in PHP 8.6

What might break in existing projects

  • Session defaults are stricter. session.use_strict_mode and session.cookie_httponly are now on, and session.cookie_samesite defaults to Lax. Sites that rely on the session cookie in a cross-site POST, such as some payment gateway callbacks or embedded iframes, need SameSite=None and Secure set explicitly.
  • trim(), ltrim() and rtrim() now also strip the form feed character (\f) by default.
  • Stricter argument checks: array_filter() with an invalid mode, filenames containing NUL bytes, and sleep() above the platform limit now throw ValueError.
  • Deprecations that show up in older code: is_integer(), is_long(), is_double(), doubleval(), strcoll(), spl_object_hash(), mysqli_stmt_init(), return inside finally, returning a value from a constructor, and the third argument of define(). Deprecations are warnings, not errors, but old plugins can fill your logs with them.

New features

  • Partial function application: create a new callable by fixing some arguments of a function, using ? and ... placeholders.
  • clamp() keeps a value between a minimum and a maximum.
  • Default values for readonly properties, #[\Override] on class constants, __debugInfo() on enums, Time\Duration, the SortDirection enum and the Io\Poll polling API.

Source: the PHP 8.6 UPGRADING notes, checked 12 November 2026. The full list is longer; check it if you maintain a library.

Running PHP 8.6 next to your current PHP

New projects can start on 8.6 while older ones stay on the version they were built for. For that you want a web server with each site on its own PHP version:

  • With Apache or Nginx yourself: run PHP 8.6 through FastCGI next to your existing PHP. The multiple PHP versions guide shows how, including for XAMPP.
  • With ForgeKit (made by me): runs several PHP versions side by side, each site on its own version, under Apache or Nginx with MySQL or MariaDB. Its catalogue covers PHP 7.4 to 8.5 today, and I'll add PHP 8.6 once the official Windows build is out. Until then you can add 8.6 yourself, as shown above. Free, including for commercial work, and it doesn't need XAMPP uninstalled.

Frequently asked questions

When is PHP 8.6 released?

PHP 8.6 is scheduled for general availability on 19 November 2026, according to the official PHP 8.6 release schedule.

Where do I download PHP 8.6 for Windows?

From windows.php.net/download once it is released. Choose the x64 Thread Safe zip for Apache's PHP module (as in XAMPP); for Nginx, IIS, FastCGI or the command line either build works. PHP 8.6 is built with Visual Studio 2026 (vs18), so install the latest Visual C++ Redistributable if php.exe won't start. Before release, x64 Thread Safe release candidates for testing are on php.net's pre-release builds page.

Does XAMPP support PHP 8.6?

Not yet. As of 12 November 2026, XAMPP for Windows offers PHP 8.5.12, 8.4.27 and 8.3.36, with no PHP 8.6 build announced. Its PHP 8.5 build arrived about eleven months after PHP 8.5 was released.

Can I use PHP 8.6 with XAMPP?

Once PHP 8.6 is released, yes, by replacing XAMPP's php folder with the x64 Thread Safe build and recreating php.ini. This replaces XAMPP's PHP version rather than adding a second one, so back up the php folder first.

Will my PHP 8.5 project break on PHP 8.6?

Usually not. The main things to check are the new session defaults (strict mode, HttpOnly cookies and SameSite=Lax), trim() now stripping form feeds, and deprecation warnings in older code such as is_integer(), strcoll() and spl_object_hash().

Can I run PHP 8.6 next to PHP 8.5 or older on Windows?

Yes. Unzip PHP 8.6 into its own folder and call it by its full path, run it through FastCGI next to your existing PHP, or use a tool such as ForgeKit that runs several PHP versions side by side.

Several PHP versions, side by side, on Windows

ForgeKit is a free, native Windows environment that runs several PHP versions at once, so one project can move to a new version while the rest stay where they are.