Typed properties

This is the one. Since PHP 7.0, you could type function parameters and return values. But class properties? Still untyped:

class User {
    public int $id;
    public string $name;
    public ?DateTimeInterface $deletedAt;
}

7.4 changes that. Typed properties enforce types at assignment, not just at call sites. Classes become self-documenting in a way that docblocks never quite managed, and the engine catches type errors before they propagate through half your stack.

One subtlety: typed properties are uninitialized by default (not null). Accessing an uninitialized property throws an Error. This trips people up: ?string doesn’t imply a default of null. You still need an explicit = null for that.

Arrow functions

Closures in PHP have always required explicitly importing outer scope variables with use:

$multiplier = 3;
$fn = fn($x) => $x * $multiplier; // no use() needed

Arrow functions capture the enclosing scope automatically. Single expression, implicit return, no boilerplate. They don’t replace full closures for complex logic, but for short callbacks they eliminate a class of noise that had been accumulating for years.

Opcache preloading

For long-lived PHP-FPM setups, preloading allows a script to load and compile PHP files into opcache memory at server startup. Those files are available to all requests without compilation overhead.

The gain varies by application. On large frameworks where the same files are loaded on every request, it’s real. On smaller apps, negligible. Worth benchmarking before adding the configuration complexity.

The small ones that add up

The features mentioned in passing deserve more than a line. The null coalescing assignment operator ??= solves a pattern that was annoying enough to write every single time but never annoying enough to bother abstracting:

$config['timeout'] ??= 30;
// equivalent to: $config['timeout'] = $config['timeout'] ?? 30;

Spread operator in array literals does what you’d expect from the function call version — unpack an iterable into an array literal:

$defaults = ['color' => 'blue', 'size' => 'M'];
$options = ['size' => 'L', ...$defaults, 'weight' => 1.2];
// ['size' => 'M', 'color' => 'blue', 'weight' => 1.2]

Note: string keys weren’t supported in 7.4 for array unpacking. That came later.

Covariant return types and contravariant parameter types close a gap that made some inheritance patterns needlessly awkward. A child class can now narrow its return type to a subtype of the parent’s, without hitting a fatal error:

class Producer {
    public function get(): Iterator {}
}
class ChildProducer extends Producer {
    public function get(): ArrayIterator {} // ArrayIterator implements Iterator
}

Reading numbers at 3am

The numeric literal separator is one of those features you don’t know you wanted until the first time you write a large constant and immediately lose track of the magnitude:

$earthMass    = 5_972_168_000_000_000_000_000_000; // kg
$lightSpeed   = 299_792_458;                        // m/s
$planck       = 6.626_070_15e-34;                  // J·s
$hexMask      = 0xFF_EC_D5_08;
$binaryFlags  = 0b0001_1111_0010_0000;

The underscore is purely syntactic. The engine strips it before parsing the value. You can put it anywhere between digits, though convention follows the natural grouping of the number system you’re working in.

Holding without owning

WeakReference lets you hold a reference to an object without preventing the garbage collector from destroying it. The use case is caches and registries: you want to know an object is alive, but you don’t want to be the reason it stays alive:

$object = new HeavyObject();
$ref = WeakReference::create($object);

var_dump($ref->get()); // object(HeavyObject)

unset($object);

var_dump($ref->get()); // NULL — GC collected it

Before 7.4 you had WeakRef via an extension, and some frameworks were doing SplObjectStorage tricks that didn’t quite behave the same way. The native class is just straightforward.

Serialization without surprise

Custom object serialization before 7.4 went through the Serializable interface: implement serialize() and unserialize(), return a string, reconstruct from it. The problem is that serialize() triggered __sleep(), unserialize() triggered __wakeup(), and the interaction between these hooks was fragile, especially in inheritance hierarchies.

7.4 introduces __serialize() and __unserialize(), which work with arrays instead of strings and don’t interact with the old hooks:

class Session {
    private string $token;
    private \DateTime $createdAt;

    public function __serialize(): array {
        return ['token' => $this->token, 'created' => $this->createdAt->getTimestamp()];
    }

    public function __unserialize(array $data): void {
        $this->token = $data['token'];
        $this->createdAt = (new \DateTime())->setTimestamp($data['created']);
    }
}

When both the new and old methods exist on the same class, __serialize() wins. The old Serializable interface gets deprecated in 8.1.

What the standard library quietly got

mb_str_split() does what str_split() does but correctly for multibyte strings. The gap was genuinely embarrassing for a language used in as many locales as PHP:

mb_str_split('héllo', 1); // ['h', 'é', 'l', 'l', 'o']
str_split('héllo', 1);    // ['h', 'Ã', '©', 'l', 'l', 'o'] — broken

strip_tags() now accepts an array of allowed tags, which is cleaner than the string format it used to require:

strip_tags($html, ['p', 'br', 'strong']); // was: '<p><br><strong>'

proc_open() now accepts an array command, bypassing shell interpretation entirely. Same idea as Python’s subprocess with shell=False. Worth knowing whenever you’re passing user-supplied arguments to an external process.

The FFI chapter

The Foreign Function Interface extension landed in 7.4 after spending time in a feature branch. It lets PHP call native C functions by loading a shared library and declaring the signatures:

$ffi = FFI::cdef("int strlen(const char *s);", "libc.so.6");
var_dump($ffi->strlen("hello")); // int(5)

The practical applications are narrow but real: calling platform APIs with no PHP binding, wrapping performance-critical C code without writing a full extension, or just poking at native libraries directly. Not a replacement for proper extensions in production, but it removes the “write a C extension” barrier for exploration.

What got deprecated

A few things that should have been cleaned up a while ago finally got the deprecation treatment in 7.4.

Nested ternaries without parentheses have been ambiguous forever. PHP evaluated them left-to-right while pretty much every other language with a ternary evaluates right-to-left:

// Was ambiguous, now deprecated:
$a ? $b : $c ? $d : $e;

// Make it explicit:
($a ? $b : $c) ? $d : $e;

Curly brace offset access for strings and arrays — $str{0} instead of $str[0] — is deprecated and gone in 8.0. It was always an alias, never a separate feature.

implode() with reversed argument order (array first, glue second) is deprecated. The function has accepted both orders since the beginning, which was a mistake. The correct order is implode(string $separator, array $array).

What comes next

7.4 is the last 7.x release. The deprecations are mostly ground-clearing for removals in 8.0. The RFC backlog for 8.0 is substantial: JIT, attributes, named arguments, match expressions. 7.4 is a solid place to land while waiting for all that to arrive.

The headline number is 2x faster than PHP 5.6. That’s not a benchmark cherry-pick — it’s the median across real applications. The Zend Engine was rewritten to use a new internal value representation that cuts memory usage significantly and reduces allocations. On one project, average response time dropped by 40% with zero code changes. You just upgrade and it goes faster.

But performance isn’t the most interesting part.

Types, finally

PHP has had type hints for objects since 5.0, for arrays since 5.1. In 7.0, you can finally declare scalar types for function parameters and return values:

function add(int $a, int $b): int {
    return $a + $b;
}

In strict mode (declare(strict_types=1)), passing a float to that function throws a TypeError. In the default coercive mode, PHP converts the value. That distinction matters: strict mode is per-file, so you can adopt it gradually without nuking your whole codebase at once.

Return type declarations are the other half. Putting intent in the signature rather than a docblock means the engine enforces it, not a code reviewer who might be half-asleep.

The null coalescing operator

?? is small but used constantly:

$username = $_GET['user'] ?? 'guest';

That replaces isset($_GET['user']) ? $_GET['user'] : 'guest'. It chains too: $a ?? $b ?? $c. After years of isset() noise, this alone was worth upgrading.

The breaking part

The error handling overhaul is the real upgrade risk. Many fatal errors are now Error exceptions, catchable but different from Exception. Code that relied on fatal errors to halt execution silently now needs explicit handling. Legacy error suppression with @ also works differently in places.

Read the migration guide before touching a production app. The payoff is real, but the gap between 5.6 and 7.0 is the widest PHP has ever had.

The spaceship operator

<=> is a combined comparison operator that returns -1, 0, or 1. It’s mostly there for sorting:

usort($users, function ($a, $b) {
    return $a->age <=> $b->age;
});

Before this, a custom sort comparator was a small exercise in remembered arithmetic. $a - $b works for integers but silently breaks for floats. <=> does the right thing for every comparable type.

Anonymous classes

You can now instantiate a class defined inline, on the spot, without giving it a name:

$logger = new class($config) implements LoggerInterface {
    public function __construct(private array $config) {}

    public function log(string $message): void {
        file_put_contents($this->config['path'], $message . PHP_EOL, FILE_APPEND);
    }
};

The canonical use case is test doubles and one-off interface implementations that don’t deserve a file. It removes a real friction point: the gap between “I need an object” and “I have to create a class file for a 10-line thing”.

Cryptographically secure randomness

PHP 5’s rand() and mt_rand() were never meant for security. 7.0 adds two functions that are:

$token = bin2hex(random_bytes(32)); // 64-character hex token
$pin   = random_int(100000, 999999);

random_bytes() pulls from the OS CSPRNG. random_int() wraps that for integers. These replace every home-grown token generation scheme that was quietly doing it wrong, which is most of them.

Group use declarations

Before 7.0, importing five things from the same namespace meant five use statements. Now:

use App\Model\{User, Order, Product};
use function App\Helpers\{formatDate, slugify};
use const App\Config\{MAX_RETRIES, TIMEOUT};

Small ergonomic improvement, but it reduces the visual noise at the top of files with deep namespace hierarchies.

Generators grew up

Generators in 5.5 were interesting but incomplete. 7.0 adds two things. First, a generator can now have a return value, accessible after iteration ends:

function process(): Generator {
    yield 'step 1';
    yield 'step 2';
    return 'done';
}

$gen = process();
foreach ($gen as $step) { /* ... */ }
echo $gen->getReturn(); // "done"

Second, yield from delegates to another generator or iterable, transparently passing values and return values through:

function inner(): Generator {
    yield 1;
    yield 2;
    return 'inner done';
}

function outer(): Generator {
    $result = yield from inner();
    echo $result; // "inner done"
    yield 3;
}

This makes composing generators practical without manually plumbing values between them.

Closure::call()

A more direct way to bind a closure to an object and call it immediately:

class Counter {
    private int $count = 0;
}

$increment = function (int $by): void {
    $this->count += $by;
};

$increment->call(new Counter(), 5);

bindTo() existed before but required two steps. call() collapses them and is faster at runtime because it skips the intermediate closure creation.

Unicode escape syntax in strings

You can now embed Unicode characters directly in double-quoted strings or heredocs using a codepoint:

echo "\u{1F418}"; // 🐘
echo "\u{00E9}";  // é

Beats copy-pasting characters from a Unicode table into source files, which is what people were actually doing.

Safer unserialize()

unserialize() has a long history of being a vector for object injection attacks. 7.0 adds an allowed_classes option:

$data = unserialize($input, ['allowed_classes' => false]);
$data = unserialize($input, ['allowed_classes' => [User::class, Order::class]]);

Passing false prevents any object from being instantiated during deserialization. This is the default you want when deserializing untrusted input.

:1234: Integer division

intdiv() is explicit integer division with no float intermediate:

$pages = intdiv(count($items), $perPage); // int, no casting needed

Yes, you could cast the result of a division. intdiv() makes the intent clear and avoids the float precision edge cases that casting introduces for large numbers.

Constants as arrays

Before 7.0, define() only accepted scalar values. Arrays worked with const at class or namespace scope but not with define(). Now they do:

define('HTTP_METHODS', ['GET', 'POST', 'PUT', 'DELETE', 'PATCH']);

Useful for configuration that needs to be a constant but lives outside a class.

Assertions with teeth

assert() got a proper redesign. In PHP 5, assertions were a runtime eval of strings. Now they can throw exceptions and be completely removed in production with zero overhead:

// In php.ini or at bootstrap:
// assert.active = 1 (dev), 0 (prod)
// assert.exception = 1

assert($user->isVerified(), new \LogicException('Unverified user reached checkout'));

When assert.active = 0, the expression is never evaluated. When it’s on, a failing assertion throws the provided exception directly. This is finally a tool worth reaching for, without the embarrassment of admitting you used it.

The session_start() overhaul

session_start() now accepts an array of options that override php.ini directives for that call:

session_start([
    'cookie_lifetime' => 86400,
    'cookie_secure'   => true,
    'cookie_httponly'  => true,
    'cookie_samesite' => 'Lax',
]);

Before this, you either set options globally in php.ini or called ini_set() before session_start(). Neither was great when you needed different session configurations in different parts of an app.