Archive for category: PHP

Scheduled for late 2026, PHP 8.6 is expected to bring numerous improvements, especially in diagnostics, security, and performance.

Here are several PHP 8.6 highlights that I see as helpful for IBM i users and a note about PHP 8.2 going end-of-life.

Seiden Group’s Contribution to PHP 8.6

One of the proposed PHP 8.6 enhancements came from our own team. Calvin Buckley of Seiden Group wrote the RFC to display function arguments in PHP error messages:

https://wiki.php.net/rfc/display_error_function_args

This improvement is designed to make debugging easier by showing more information when a built-in function fails.

For example, instead of seeing only that a file operation failed, developers may be able to see which argument caused the problem. That kind of detail can save time when troubleshooting production issues.

Easier JSON Troubleshooting

PHP 8.6 should help when looking for invalid JSON. Before PHP 8.6, json_last_error_msg() would describe the error, but not tell where in the JSON string to find the invalid portion.  Now, in 8.6, if json_decode() fails, error and exception messages can indicate where the JSON problem occurred. Courtesy of the php.watch site, here is an example:

For applications that exchange data with APIs, web services, JavaScript front ends, and vendor systems, this should make testing and support easier.

Safer Defaults and Security Hardening

PHP 8.6 also includes security improvements. More secure session defaults are planned, including strict session mode, HttpOnly session cookies, and SameSite=Lax cookies:

https://wiki.php.net/rfc/session_security_defaults

These settings help reduce common risks such as session fixation, stolen cookies through JavaScript, and some cross-site request forgery scenarios.

Other security-related changes include tighter handling of invalid inputs, safer SQL string quoting for mysqli, and limits on long php://filter chains that have been abused in certain attack techniques:

https://wiki.php.net/rfc/policy-exempt-type-value-error-bc-policy

https://wiki.php.net/rfc/mysqli_quote_string

https://wiki.php.net/rfc/limit-maximum-number-of-filter-chains

JSON Performance Improvements

There are performance improvements as well, including faster JSON encoding of arrays and objects, and better performance when using json_encode() with PHP_JSON_PRETTY_PRINT.

True Async: A Direction to Watch

Another area to watch is True Async, which prepares PHP to compete with other languages that natively support concurrent tasks, services, and I/O operations. For IBM i teams, that direction is worth watching as PHP continues to be used for more than traditional web pages.

PHP 8.2 End of Life Is Approaching

While PHP 8.6 develops, PHP 8.2 is approaching end of life. Its security support ends on December 31, 2026. After that, PHP 8.2 will no longer receive upstream security fixes from the PHP project.

Running an end-of-life PHP version can create security exposures, audit concerns, dependency problems, and a harder migration later.

The best approach is to stay current before the situation becomes urgent.

How Seiden Group Can Help

With Seiden PHP+ Server and our support services, we help clients plan PHP migrations, resolve compatibility issues, and keep production environments stable. We also contribute directly to PHP’s future, as Calvin’s RFC demonstrates.

PHP 8.6 brings improvements, while staying current protects your applications, reduces risk, and keeps your IBM i environment ready for the future.

If you are running PHP 8.2 or older releases, or are not sure which PHP versions you have, now is a good time to review your options. Contact Seiden Group to assess your current PHP setup, plan your next migration, and keep your applications secure and supported.