RFC Tracker

Adds AES192 and AES256 SNMPv3 protocols, an snmp_init_mib() function to reset loaded MIBs, and more output controls to ext/snmp.

Limits php://filter URLs to 16 chained filters by default, blocking attacks that use long chains to turn file reads into code execution.

Adds an opt-in __exists() magic method that says if a magic property exists, separate from whether it's null, used by isset(), empty() and ??.

Deprecates the metaphone() function in PHP 8.6, pointing users to Composer libraries that implement Double Metaphone and Metaphone 3.

Deprecates the mb_ereg* regex functions in PHP 8.6 and removes them in PHP 9.0, since the Oniguruma library behind them is no longer maintained.

Makes every ? placeholder in partial function application a required parameter, instead of copying the original parameter's default.

Lets enums define __debugInfo() to control what var_dump() shows for an enum case.

Adds array_path_get() and array_path_exists() to read or check a value deep in a nested array using an array of keys.

Changes the session defaults to use_strict_mode=1, cookie_httponly=1 and cookie_samesite=Lax so new installs are safer out of the box.

Removes the NUL byte (\0) from the default characters that trim(), ltrim() and rtrim() strip.

Adds a global SortDirection enum with Ascending and Descending cases as a shared, type-safe way to express sort order.

Lets you put a doc comment on each function parameter and read it with the new ReflectionParameter::getDocComment().

Adds array_only_keys() and array_except_keys() to keep or drop the listed keys of an array without the array_flip() workaround.

Lets pack() and unpack() take < and > byte order markers on the f and d float codes, matching the integer syntax added in PHP 8.6.

Makes closures cheaper by inferring static when $this is unused and caching stateless closures, though only the caching part was merged.

Lets a constructor reassign a promoted readonly property exactly once, so you can validate or normalize it without dropping promotion.

Adds six str_prefix_* and str_suffix_* functions to ensure, remove or replace a string's prefix or suffix in one call.

Adds grapheme_strrev() to intl, which reverses a string by grapheme cluster so emoji and combined characters stay intact.

Adds the form feed character (\f) to the default set of characters that trim(), ltrim() and rtrim() strip.

Adds a TLS session class and stream context options so clients and servers can save, store and resume TLS sessions.