PHP 8.0 to 8.5: The Most Important New Features

In short: PHP 8.0 (November 2020) brought named arguments, attributes, union types, match, the nullsafe operator and a JIT compiler. Annual releases followed: 8.1 with enums and fibers, 8.2 with readonly classes, 8.3 with typed class constants, 8.4 with property hooks and 8.5 with the pipe operator and URI extension. Each version also deprecates old features. When upgrading, tests therefore matter, and for security what matters most is running a supported branch at the current patch level.

The PHP 8 new features at a glance

The table summarises the key points of the release pages on php.net. First-release dates according to php.net.

PHP 8.0 and 8.1: the big step

PHP 8.0 made the language noticeably stricter and more expressive. According to the release page, internal functions now consistently throw TypeError or ValueError instead of merely emitting warnings. Comparisons between numbers and strings follow cleaner rules.

<?php
// PHP 8.0: match compares strictly and needs no break
$status = 404;
echo match (true) {
    $status >= 500 => 'Serverfehler',
    $status >= 400 => 'Anfragefehler',
    default        => 'in Ordnung',
};

// PHP 8.0: nullsafe operator
$land = $bestellung?->kunde?->adresse?->land;

PHP 8.1 brought enums, that is, enumeration types with fixed values, and readonly properties that can be set only once:

<?php
enum Rolle: string {
    case Leser = 'leser';
    case Redakteur = 'redakteur';
    case Admin = 'admin';
}

final class Benutzer {
    public function __construct(
        public readonly string $name,
        public readonly Rolle $rolle,
    ) {}
}

$b = new Benutzer('Erika', Rolle::from('redakteur'));

Rolle::from() throws an error for unknown values. This prevents arbitrary strings from forms from slipping through as a role. Anyone who needs an empty value instead of an error uses Rolle::tryFrom(), which returns null for unknown values.

Also new in 8.1 are fibers, a foundation for concurrent processes on which libraries for asynchronous processing build. In normal website operation you notice little of this, but in modern frameworks and queues you do.

PHP 8.2 and 8.3: tidying up and securing

PHP 8.2 deprecated dynamic properties. Anyone who assigns an undeclared property to an object receives a notice; with #[\AllowDynamicProperties] this can be permitted for individual classes. Older plugins therefore often generate many messages in the log.

Of interest for security are the new Random extension, whose default randomizer, according to the release page, uses a cryptographically secure random number generator, and the attribute #[\SensitiveParameter], which hides values such as passwords in stack traces. More on secure random values under Secure random numbers and tokens in PHP.

PHP 8.3 added typed class constants, the attribute #[\Override] against typing errors when overriding methods, and json_validate(), which checks JSON without fully decoding it.

PHP 8.4 and 8.5: modern language features

PHP 8.4 introduced property hooks, that is, logic directly on properties, and asymmetric visibility such as public private(set). In addition came a new DOM API with HTML5 support and functions such as array_find(), array_any() and array_all(). According to the release page, the extensions IMAP, OCI8, PDO_OCI and pspell were moved out of the core to PECL. Applications that use IMAP, for example, then need a separate package.

PHP 8.5 brought the pipe operator, which chains calls from left to right:

<?php
$slug = '  Neue Produkte 2026  '
    |> trim(...)
    |> strtolower(...)
    |> (fn(string $s): string => str_replace(' ', '-', $s));
// Result: "neue-produkte-2026"

Also new is a URI extension that parses addresses according to RFC 3986 and the WHATWG URL standard. This is relevant for security because inconsistently parsed URLs are a known cause of bypassed checks. The backtick operator as shorthand for shell_exec() is deprecated, and the disable_classes setting was removed. Anyone who used it should adjust their hardening.

New features, upgrades and PHP2Shell

New language features do not close flaws in the interpreter. Against PHP2Shell, only the current patch level of the respective branch helps: 8.5.12, 8.4.27, 8.3.36 or 8.2.35. For PHP 8.1 and 8.0 there are no more official updates. Anyone stuck there must upgrade, and the new features help little in doing so, whereas the breaking changes matter a great deal.

A safe upgrade path in five steps:

1. Decide on the target version, matching the vendor's system requirements and the release cycle.
2. Bring dependencies via Composer and plugins to compatible versions.
3. Check the code against the target version with static analysis and tests.
4. Try it in a test environment with a copy of production data and evaluate the logs for deprecations.
5. Switch over, restart all PHP processes and document the state.

Background on types is provided by The PHP type system.

How does PHP SOS help?

• Check compatibility: We analyse your code and your extensions for breaking changes against the target version.
• Carry out the upgrade: With the migration to a supported PHP version we lift applications, tested beforehand.
• Adapt hardening: We replace removed settings such as disable_classes with effective alternatives.
• Keep the patch level: After the upgrade we keep the branch current and document every restart.

Frequently asked questions

Sources

• php.net: PHP 8.0 Release
• php.net: PHP 8.4 Release
• php.net: PHP 8.5 Release
• PHP 8 ChangeLog
• php.net: Supported Versions