PHP 8.5: what's new, how long it is supported, and where to get it on Debian and Ubuntu

PHP 8.5 was released on 20 November 2025. It is the newest stable branch of the language, and as of 31 October 2026 its current patch release is 8.5.12. It brings a handful of features that change how everyday code reads, plus several operational changes that matter to whoever runs the servers.

This article summarises the release from the official announcement and migration guide, gives the support dates published on php.net, and explains where Debian and Ubuntu users can get it.

At a glance

The headline features

Pipe operator

The new |> operator passes a value from left to right through a chain of callables. Nested calls such as strtolower(str_replace(' ', '-', trim($title))) can be written in the order they run:

$slug = $title
    |> trim(...)
    |> (fn($s) => str_replace(' ', '-', $s))
    |> strtolower(...);

A built-in URI extension

A new, always-available URI extension parses and modifies URLs according to RFC 3986 (Uri\Rfc3986\Uri) and the WHATWG URL standard (Uri\WhatWg\Url). It is powered by the uriparser and Lexbor libraries. For code that validates, normalises or rewrites URLs, it is a standards-based alternative to parse_url().

Clone with

clone() now accepts an array of properties to change on the copy, for example clone($this, ['alpha' => $alpha]). This makes the usual "with-er" methods on readonly classes much shorter.

The #[\NoDiscard] attribute

A function marked #[\NoDiscard] makes PHP emit a warning when its return value is not used. A (void) cast marks a value as intentionally ignored. It is aimed at APIs where forgetting the result is almost always a bug.

Smaller additions

• array_first() and array_last() return the first or last value of an array, or null when it is empty.
• Static closures and first-class callables can be used in constant expressions, including attribute arguments and default values.
• curl_share_init_persistent() creates cURL share handles that survive across requests, so DNS and connection data can be reused instead of initialised every time.
• Fatal errors, such as exceeding the maximum execution time, now include a backtrace.
• Properties can be declared final through constructor promotion, attributes can target constants, #[\Override] can be applied to properties, and static properties support asymmetric visibility.
• setcookie() and setrawcookie() accept a partitioned key, and new get_error_handler() and get_exception_handler() functions are available.

Changes that matter to server operators

• OPcache is always built in and always loaded. The build no longer produces opcache.so, and a leftover zend_extension=opcache.so line now emits a warning. The opcache.enable and opcache.enable_cli directives are still honoured.
• The disable_classes INI setting has been removed, because it broke assumptions inside the engine. If a hardening guide added it to your configuration, it no longer has any effect, so review what you were relying on it for.
• A new max_memory_limit setting (startup only) caps the memory_limit that can be configured at startup or at runtime. Asking for more emits a warning and the cap is applied instead.
• fatal_error_backtraces controls whether fatal errors include the new backtrace.
• php --ini=diff prints only the INI settings that differ from the built-in defaults, which is handy when comparing two servers.
• PHP-FPM gains a fastcgi.script_path_encoded setting for Apache ProxyPass setups, and its access log now respects log_limit.
• opcache.file_cache_read_only allows a read-only OPcache file cache, intended for read-only container images.

Deprecations to watch

PHP 8.5 deprecates a number of old patterns. Deprecations do not stop code from running, but they fill logs and signal what a future version may remove. The ones most likely to appear in real projects:

• The backtick operator as an alias of shell_exec().
• The cast names (boolean), (integer), (double) and (binary); use (bool), (int), (float) and (string).
• Ending a case statement with a semicolon instead of a colon.
• Using null as an array offset or as the key in array_key_exists().
• __sleep() and __wakeup() are soft-deprecated in favour of __serialize() and __unserialize().
• curl_close(), finfo_close(), imagedestroy() and xml_parser_free(), because those objects are now freed automatically.

PHP 8.5 also adds new warnings: when casting NAN to another type, when casting a float that cannot be represented as an integer, and when destructuring a non-array value with [] or list(). The complete list is in the official migration guide.

Where to get PHP 8.5 on Debian and Ubuntu

• Ubuntu 26.04 LTS ships php8.5 as its default PHP (the php metapackage is 2:8.5+99ubuntu1), and so does Ubuntu 26.10. Ubuntu keeps its package versions stable and backports security fixes into them.
• Debian 13 (trixie) ships PHP 8.4 as its default; php8.5 is currently only in Debian's experimental suite, which is not meant for production. On Debian, running 8.5 today means a third-party repository such as packages.sury.org.
• Ubuntu 24.04 LTS, Ubuntu 22.04 LTS and Debian 12 ship PHP 8.3, 8.1 and 8.2 respectively. PHP 8.5 there means either a third-party repository or an operating-system upgrade.

To see what your configured sources offer before you change anything:

apt update
apt policy php8.5-fpm php8.5-cli
php -v

Should you upgrade now?

For a new project, starting on 8.5 gives the longest runway: security fixes until the end of 2029. For an existing application, the deciding factor is usually the framework and libraries, so confirm that they declare PHP 8.5 support before switching production. If you are on 8.4, active support runs until 31 December 2026 and security fixes until 31 December 2028, so there is time to test properly. If you are still on 8.2, its security support ends on 31 December 2026, which makes a move to 8.4 or 8.5 a near-term task rather than a nice-to-have.

What you should do

• Record the dates: PHP 8.5 receives security fixes until 31 December 2029.
• Run your test suite on 8.5 in a staging copy with every deprecation logged (error_reporting = E_ALL, log_errors = On, display_errors = Off).
• Remove any zend_extension=opcache.so and disable_classes lines from 8.5 configuration and review the hardening that depended on them.
• Check whether your distribution ships 8.5 (Ubuntu 26.04 LTS does, Debian 13 does not) and choose your package source deliberately.
• Once you are on 8.5, keep up with its patch releases: security fixes arrive as 8.5.x updates.

Sources

• php.net/releases/8.5/en.php
• php.net/manual/en/migration85.php
• php.net/manual/en/migration85.incompatible.php
• php.net/manual/en/migration85.deprecated.php
• php.net/manual/en/migration85.other-changes.php
• php.net/supported-versions.php
• php.net/ChangeLog-8.php
• php.net/releases
• packages.ubuntu.com/resolute/php8.5-fpm
• people.canonical.com/~ubuntu-archive/madison.cgi?package=php&text=on
• packages.debian.org/trixie/php
• qa.debian.org/madison.php?package=php8.5&text=on