From 658cd4c616e9bc5cf8ad11677c571714a3b68314 Mon Sep 17 00:00:00 2001
From: Jack Worman <jworman@healthcall.com>
Date: Fri, 26 Jun 2026 20:14:52 -0500
Subject: [PATCH 01/17] opcache-file-permission-setting

---
 ext/opcache/ZendAccelerator.h         | 1 +
 ext/opcache/zend_accelerator_module.c | 3 +++
 ext/opcache/zend_file_cache.c         | 2 +-
 php.ini-development                   | 3 +++
 php.ini-production                    | 3 +++
 5 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/ext/opcache/ZendAccelerator.h b/ext/opcache/ZendAccelerator.h
index 91642e288d31..df7a41b1e8ad 100644
--- a/ext/opcache/ZendAccelerator.h
+++ b/ext/opcache/ZendAccelerator.h
@@ -176,6 +176,7 @@ typedef struct _zend_accel_directives {
 	char          *lockfile_path;
 #endif
 	char          *file_cache;
+	mode_t    file_cache_permissions;
 	bool      file_cache_read_only;
 	bool      file_cache_only;
 	bool      file_cache_consistency_checks;
diff --git a/ext/opcache/zend_accelerator_module.c b/ext/opcache/zend_accelerator_module.c
index 465b15cd9576..a5f06c1fe88f 100644
--- a/ext/opcache/zend_accelerator_module.c
+++ b/ext/opcache/zend_accelerator_module.c
@@ -18,6 +18,7 @@
 */
 
 #include <time.h>
+#include <fcntl.h>
 
 #include "php.h"
 #include "ZendAccelerator.h"
@@ -320,6 +321,7 @@ ZEND_INI_BEGIN()
 #endif
 
 	STD_PHP_INI_ENTRY("opcache.file_cache"                    , NULL  , PHP_INI_SYSTEM, OnUpdateFileCache, accel_directives.file_cache,                    zend_accel_globals, accel_globals)
+	STD_PHP_INI_ENTRY("opcache.file_cache_permissions", "384" /* S_IRUSR | S_IWUSR */, PHP_INI_SYSTEM, OnUpdateLong, accel_directives.file_cache_permissions, zend_accel_globals, accel_globals)
 	STD_PHP_INI_BOOLEAN("opcache.file_cache_read_only"          , "0"   , PHP_INI_SYSTEM, OnUpdateBool,    accel_directives.file_cache_read_only,          zend_accel_globals, accel_globals)
 	STD_PHP_INI_BOOLEAN("opcache.file_cache_only"               , "0"   , PHP_INI_SYSTEM, OnUpdateBool,	   accel_directives.file_cache_only,               zend_accel_globals, accel_globals)
 	STD_PHP_INI_BOOLEAN("opcache.file_cache_consistency_checks" , "1"   , PHP_INI_SYSTEM, OnUpdateBool,	   accel_directives.file_cache_consistency_checks, zend_accel_globals, accel_globals)
@@ -845,6 +847,7 @@ ZEND_FUNCTION(opcache_get_configuration)
 #endif
 
 	add_assoc_string(&directives, "opcache.file_cache",                    ZCG(accel_directives).file_cache ? ZCG(accel_directives).file_cache : "");
+	add_assoc_long(&directives,   "opcache.file_cache_permissions",        ZCG(accel_directives).file_cache_permissions);
 	add_assoc_bool(&directives,   "opcache.file_cache_read_only",          ZCG(accel_directives).file_cache_read_only);
 	add_assoc_bool(&directives,   "opcache.file_cache_only",               ZCG(accel_directives).file_cache_only);
 	add_assoc_bool(&directives,   "opcache.file_cache_consistency_checks", ZCG(accel_directives).file_cache_consistency_checks);
diff --git a/ext/opcache/zend_file_cache.c b/ext/opcache/zend_file_cache.c
index af59b9b2c34a..412cbc3c817f 100644
--- a/ext/opcache/zend_file_cache.c
+++ b/ext/opcache/zend_file_cache.c
@@ -1171,7 +1171,7 @@ int zend_file_cache_script_store(zend_persistent_script *script, bool in_shm)
 		return FAILURE;
 	}
 
-	fd = zend_file_cache_open(filename, O_CREAT | O_EXCL | O_RDWR | O_BINARY, S_IRUSR | S_IWUSR);
+	fd = zend_file_cache_open(filename, O_CREAT | O_EXCL | O_RDWR | O_BINARY, ZCG(accel_directives).file_cache_permissions);
 	if (fd < 0) {
 		if (errno != EEXIST) {
 			zend_accel_error(ACCEL_LOG_WARNING, "opcache cannot create file '%s', %s\n", filename, strerror(errno));
diff --git a/php.ini-development b/php.ini-development
index afabe74ba0e4..7837a2d70590 100644
--- a/php.ini-development
+++ b/php.ini-development
@@ -1777,6 +1777,9 @@ ldap.max_links = -1
 ; SHM reset. The default "" disables file based caching.
 ;opcache.file_cache=
 
+; The permissions of the files cached.
+;opcache.file_cache_permissions=384 (0o600)
+
 ; Enables or disables read-only mode for the second level cache directory.
 ; It should improve performance for read-only containers,
 ; when the cache is pre-warmed and packaged alongside the application.
diff --git a/php.ini-production b/php.ini-production
index 04a7b699dadd..52d8a86f0d4b 100644
--- a/php.ini-production
+++ b/php.ini-production
@@ -1779,6 +1779,9 @@ ldap.max_links = -1
 ; SHM reset. The default "" disables file based caching.
 ;opcache.file_cache=
 
+; The permissions of the files cached.
+;opcache.file_cache_permissions=384 (0o600)
+
 ; Enables or disables read-only mode for the second level cache directory.
 ; It should improve performance for read-only containers,
 ; when the cache is pre-warmed and packaged alongside the application.

From 726c89b24d3e24fa26b8caf6b1aae27e1116043b Mon Sep 17 00:00:00 2001
From: Jack Worman <jworman@healthcall.com>
Date: Sat, 27 Jun 2026 16:46:24 -0500
Subject: [PATCH 02/17] opcache-file-permission-setting

---
 ext/opcache/tests/file_cache_permissions.phpt | 75 +++++++++++++++++++
 1 file changed, 75 insertions(+)
 create mode 100644 ext/opcache/tests/file_cache_permissions.phpt

diff --git a/ext/opcache/tests/file_cache_permissions.phpt b/ext/opcache/tests/file_cache_permissions.phpt
new file mode 100644
index 000000000000..c79638bdbe37
--- /dev/null
+++ b/ext/opcache/tests/file_cache_permissions.phpt
@@ -0,0 +1,75 @@
+--TEST--
+opcache.file_cache_permissions sets file cache mode
+--EXTENSIONS--
+opcache
+--SKIPIF--
+<?php
+if (substr(PHP_OS, 0, 3) === 'WIN') {
+    die('skip not for Windows');
+}
+if (ini_parse_quantity(ini_get('opcache.jit_buffer_size')) !== 0) {
+    die('skip File cache is disabled when JIT is on');
+}
+?>
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_cache="{TMP}/file_cache_permissions"
+opcache.file_cache_only=1
+opcache.file_cache_permissions=420
+opcache.jit=disable
+--FILE--
+<?php
+$file = __DIR__ . '/file_cache_permissions.inc';
+file_put_contents($file, '<?php return 42;');
+touch($file, time() - 3600);
+
+register_shutdown_function(static function () use ($file) {
+    @unlink($file);
+});
+
+require $file;
+
+$cacheRoot = opcache_get_configuration()['directives']['opcache.file_cache'];
+$iterator = new RecursiveIteratorIterator(
+    new RecursiveDirectoryIterator($cacheRoot, FilesystemIterator::SKIP_DOTS)
+);
+
+$foundMode = null;
+foreach ($iterator as $entry) {
+    if (!$entry->isFile()) {
+        continue;
+    }
+
+    if (str_ends_with($entry->getPathname(), 'file_cache_permissions.inc.bin')) {
+        $foundMode = fileperms($entry->getPathname()) & 0777;
+        break;
+    }
+}
+
+var_dump($foundMode);
+?>
+--CLEAN--
+<?php
+$file = __DIR__ . '/file_cache_permissions.inc';
+@unlink($file);
+
+$dir = sys_get_temp_dir() . '/file_cache_permissions';
+if (is_dir($dir)) {
+    $iterator = new RecursiveIteratorIterator(
+        new RecursiveDirectoryIterator($dir, RecursiveDirectoryIterator::SKIP_DOTS),
+        RecursiveIteratorIterator::CHILD_FIRST
+    );
+    foreach ($iterator as $entry) {
+        $path = $entry->getPathname();
+        if ($entry->isDir()) {
+            @rmdir($path);
+        } else {
+            @unlink($path);
+        }
+    }
+    @rmdir($dir);
+}
+?>
+--EXPECT--
+int(420)

From ca4174bf31694c21a2706cb60e9a5680c1525057 Mon Sep 17 00:00:00 2001
From: Jack Worman <jworman@healthcall.com>
Date: Sat, 27 Jun 2026 16:47:09 -0500
Subject: [PATCH 03/17] Update file_cache_permissions.phpt

---
 ext/opcache/tests/file_cache_permissions.phpt | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/ext/opcache/tests/file_cache_permissions.phpt b/ext/opcache/tests/file_cache_permissions.phpt
index c79638bdbe37..cb6718ffcc70 100644
--- a/ext/opcache/tests/file_cache_permissions.phpt
+++ b/ext/opcache/tests/file_cache_permissions.phpt
@@ -7,9 +7,6 @@ opcache
 if (substr(PHP_OS, 0, 3) === 'WIN') {
     die('skip not for Windows');
 }
-if (ini_parse_quantity(ini_get('opcache.jit_buffer_size')) !== 0) {
-    die('skip File cache is disabled when JIT is on');
-}
 ?>
 --INI--
 opcache.enable=1
@@ -17,7 +14,6 @@ opcache.enable_cli=1
 opcache.file_cache="{TMP}/file_cache_permissions"
 opcache.file_cache_only=1
 opcache.file_cache_permissions=420
-opcache.jit=disable
 --FILE--
 <?php
 $file = __DIR__ . '/file_cache_permissions.inc';
@@ -42,7 +38,7 @@ foreach ($iterator as $entry) {
     }
 
     if (str_ends_with($entry->getPathname(), 'file_cache_permissions.inc.bin')) {
-        $foundMode = fileperms($entry->getPathname()) & 0777;
+        $foundMode = fileperms($entry->getPathname());
         break;
     }
 }

From 5203f21e09d3058a7b6b62c4f3ba12bf0a3c0de7 Mon Sep 17 00:00:00 2001
From: Jack Worman <jworman@healthcall.com>
Date: Sat, 27 Jun 2026 17:10:19 -0500
Subject: [PATCH 04/17] fix test

---
 ext/opcache/tests/file_cache_permissions.phpt | 64 +++++++++----------
 1 file changed, 30 insertions(+), 34 deletions(-)

diff --git a/ext/opcache/tests/file_cache_permissions.phpt b/ext/opcache/tests/file_cache_permissions.phpt
index cb6718ffcc70..91136c696752 100644
--- a/ext/opcache/tests/file_cache_permissions.phpt
+++ b/ext/opcache/tests/file_cache_permissions.phpt
@@ -1,70 +1,66 @@
 --TEST--
-opcache.file_cache_permissions sets file cache mode
+opcache.file_cache_permissions set
 --EXTENSIONS--
 opcache
 --SKIPIF--
 <?php
-if (substr(PHP_OS, 0, 3) === 'WIN') {
-    die('skip not for Windows');
+@mkdir(__DIR__ . "/opcache", 0777, true);
+if (substr(PHP_OS, 0, 3) === "WIN") {
+    die("skip not for Windows");
 }
 ?>
 --INI--
 opcache.enable=1
 opcache.enable_cli=1
-opcache.file_cache="{TMP}/file_cache_permissions"
+opcache.file_cache="{PWD}/opcache"
 opcache.file_cache_only=1
 opcache.file_cache_permissions=420
 --FILE--
 <?php
-$file = __DIR__ . '/file_cache_permissions.inc';
-file_put_contents($file, '<?php return 42;');
-touch($file, time() - 3600);
+$phpFile = __DIR__ . "/foo.php";
+file_put_contents($phpFile, "<?php return 42;");
+touch($phpFile, time() - 3600);
+require $phpFile;
 
-register_shutdown_function(static function () use ($file) {
-    @unlink($file);
-});
-
-require $file;
-
-$cacheRoot = opcache_get_configuration()['directives']['opcache.file_cache'];
+$opcacheDirectory = __DIR__ . "/opcache";
 $iterator = new RecursiveIteratorIterator(
-    new RecursiveDirectoryIterator($cacheRoot, FilesystemIterator::SKIP_DOTS)
+    new RecursiveDirectoryIterator(
+        $opcacheDirectory,
+        FilesystemIterator::SKIP_DOTS,
+    ),
 );
-
-$foundMode = null;
-foreach ($iterator as $entry) {
-    if (!$entry->isFile()) {
+foreach ($iterator as $splFileInfo) {
+    if (!$splFileInfo->isFile()) {
         continue;
     }
-
-    if (str_ends_with($entry->getPathname(), 'file_cache_permissions.inc.bin')) {
-        $foundMode = fileperms($entry->getPathname());
+    if (str_ends_with($splFileInfo->getPathname(), "foo.php.bin")) {
+        var_dump(fileperms($splFileInfo->getPathname()));
         break;
     }
 }
-
-var_dump($foundMode);
 ?>
 --CLEAN--
 <?php
-$file = __DIR__ . '/file_cache_permissions.inc';
-@unlink($file);
+@unlink(__DIR__ . "/foo.php");
 
-$dir = sys_get_temp_dir() . '/file_cache_permissions';
-if (is_dir($dir)) {
+$opcacheDirectory = __DIR__ . "/opcache.php";
+if (is_dir($opcacheDirectory)) {
     $iterator = new RecursiveIteratorIterator(
-        new RecursiveDirectoryIterator($dir, RecursiveDirectoryIterator::SKIP_DOTS),
-        RecursiveIteratorIterator::CHILD_FIRST
+        new RecursiveDirectoryIterator(
+            $opcacheDirectory,
+            RecursiveDirectoryIterator::SKIP_DOTS,
+        ),
+        RecursiveIteratorIterator::CHILD_FIRST,
     );
-    foreach ($iterator as $entry) {
-        $path = $entry->getPathname();
-        if ($entry->isDir()) {
+    foreach ($iterator as $splFileInfo) {
+        $path = $splFileInfo->getPathname();
+        if ($splFileInfo->isDir()) {
             @rmdir($path);
         } else {
             @unlink($path);
         }
     }
-    @rmdir($dir);
+    @rmdir($opcacheDirectory);
 }
 ?>
 --EXPECT--

From e0f1089799fe64c0d62fae6da9e346431d5e5f52 Mon Sep 17 00:00:00 2001
From: Jack Worman <jworman@healthcall.com>
Date: Sat, 27 Jun 2026 17:29:21 -0500
Subject: [PATCH 05/17] Update file_cache_permissions.phpt

---
 ext/opcache/tests/file_cache_permissions.phpt | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/ext/opcache/tests/file_cache_permissions.phpt b/ext/opcache/tests/file_cache_permissions.phpt
index 91136c696752..ee7d40e2940f 100644
--- a/ext/opcache/tests/file_cache_permissions.phpt
+++ b/ext/opcache/tests/file_cache_permissions.phpt
@@ -1,5 +1,5 @@
 --TEST--
-opcache.file_cache_permissions set
+opcache.file_cache_permissions
 --EXTENSIONS--
 opcache
 --SKIPIF--
@@ -34,7 +34,7 @@ foreach ($iterator as $splFileInfo) {
         continue;
     }
     if (str_ends_with($splFileInfo->getPathname(), "foo.php.bin")) {
-        var_dump(fileperms($splFileInfo->getPathname()));
+        var_dump(sprintf("%o", fileperms($splFileInfo->getPathname())));
         break;
     }
 }
@@ -64,4 +64,4 @@ if (is_dir($opcacheDirectory)) {
 }
 ?>
 --EXPECT--
-int(420)
+string(6) "100644"

From fba56703852b0d4935f312261cc80a73fa35977a Mon Sep 17 00:00:00 2001
From: Jack Worman <jworman@healthcall.com>
Date: Sat, 27 Jun 2026 20:15:15 -0500
Subject: [PATCH 06/17] Update file_cache_permissions.phpt

---
 ext/opcache/tests/file_cache_permissions.phpt | 29 ++++++++++---------
 1 file changed, 16 insertions(+), 13 deletions(-)

diff --git a/ext/opcache/tests/file_cache_permissions.phpt b/ext/opcache/tests/file_cache_permissions.phpt
index ee7d40e2940f..99016c76e566 100644
--- a/ext/opcache/tests/file_cache_permissions.phpt
+++ b/ext/opcache/tests/file_cache_permissions.phpt
@@ -4,9 +4,9 @@ opcache.file_cache_permissions
 opcache
 --SKIPIF--
 <?php
-@mkdir(__DIR__ . "/opcache", 0777, true);
-if (substr(PHP_OS, 0, 3) === "WIN") {
-    die("skip not for Windows");
+@mkdir(__DIR__ . '/opcache', 0777, true);
+if (substr(PHP_OS, 0, 3) === 'WIN') {
+    die('skip not for Windows');
 }
 ?>
 --INI--
@@ -14,15 +14,18 @@ opcache.enable=1
 opcache.enable_cli=1
 opcache.file_cache="{PWD}/opcache"
 opcache.file_cache_only=1
+opcache.file_update_protection=0
 opcache.file_cache_permissions=420
 --FILE--
 <?php
-$phpFile = __DIR__ . "/foo.php";
-file_put_contents($phpFile, "<?php return 42;");
-touch($phpFile, time() - 3600);
+$phpFile = __DIR__ . '/foo.php';
+file_put_contents($phpFile, '<?php return 42;');
 require $phpFile;
+register_shutdown_function(static function () use ($phpFile): void {
+    @unlink($phpFile);
+});
 
-$opcacheDirectory = __DIR__ . "/opcache";
+$opcacheDirectory = __DIR__ . '/opcache';
 $iterator = new RecursiveIteratorIterator(
     new RecursiveDirectoryIterator(
         $opcacheDirectory,
@@ -33,17 +36,17 @@ foreach ($iterator as $splFileInfo) {
     if (!$splFileInfo->isFile()) {
         continue;
     }
-    if (str_ends_with($splFileInfo->getPathname(), "foo.php.bin")) {
-        var_dump(sprintf("%o", fileperms($splFileInfo->getPathname())));
+    if (str_ends_with($splFileInfo->getPathname(), '/foo.php.bin')) {
+        var_dump(sprintf('%o', fileperms($splFileInfo->getPathname())));
         break;
     }
 }
 ?>
 --CLEAN--
 <?php
-@unlink(__DIR__ . "/foo.php");
+@unlink(__DIR__ . '/foo.php');
 
-$opcacheDirectory = __DIR__ . "/opcache.php";
+$opcacheDirectory = __DIR__ . '/opcache.php';
 if (is_dir($opcacheDirectory)) {
     $iterator = new RecursiveIteratorIterator(
         new RecursiveDirectoryIterator(
@@ -53,7 +56,7 @@ if (is_dir($opcacheDirectory)) {
         RecursiveIteratorIterator::CHILD_FIRST,
     );
     foreach ($iterator as $splFileInfo) {
-        $path = $splFileInfo->getPathname();
+        $path = $splFileInfo->getRealPath();
         if ($splFileInfo->isDir()) {
             @rmdir($path);
         } else {
@@ -64,4 +67,4 @@ if (is_dir($opcacheDirectory)) {
 }
 ?>
 --EXPECT--
-string(6) "100644"
+string(6) '100644'

From e5dc2bda36c3ed59ba7d242e7fb7b98edcc6bd55 Mon Sep 17 00:00:00 2001
From: Jack Worman <jworman@healthcall.com>
Date: Sat, 27 Jun 2026 20:30:13 -0500
Subject: [PATCH 07/17] use octal notation

---
 ext/opcache/tests/file_cache_permissions.phpt |  6 +++---
 ext/opcache/zend_accelerator_module.c         | 20 ++++++++++++++++++-
 php.ini-development                           |  4 ++--
 php.ini-production                            |  4 ++--
 4 files changed, 26 insertions(+), 8 deletions(-)

diff --git a/ext/opcache/tests/file_cache_permissions.phpt b/ext/opcache/tests/file_cache_permissions.phpt
index 99016c76e566..c8d6c7fda896 100644
--- a/ext/opcache/tests/file_cache_permissions.phpt
+++ b/ext/opcache/tests/file_cache_permissions.phpt
@@ -15,7 +15,7 @@ opcache.enable_cli=1
 opcache.file_cache="{PWD}/opcache"
 opcache.file_cache_only=1
 opcache.file_update_protection=0
-opcache.file_cache_permissions=420
+opcache.file_cache_permissions=0644
 --FILE--
 <?php
 $phpFile = __DIR__ . '/foo.php';
@@ -37,7 +37,7 @@ foreach ($iterator as $splFileInfo) {
         continue;
     }
     if (str_ends_with($splFileInfo->getPathname(), '/foo.php.bin')) {
-        var_dump(sprintf('%o', fileperms($splFileInfo->getPathname())));
+        var_dump(sprintf('%o', substr(fileperms($splFileInfo->getPathname()), -3)));
         break;
     }
 }
@@ -67,4 +67,4 @@ if (is_dir($opcacheDirectory)) {
 }
 ?>
 --EXPECT--
-string(6) '100644'
+string(6) "644"
diff --git a/ext/opcache/zend_accelerator_module.c b/ext/opcache/zend_accelerator_module.c
index a5f06c1fe88f..d80ff91dd5ea 100644
--- a/ext/opcache/zend_accelerator_module.c
+++ b/ext/opcache/zend_accelerator_module.c
@@ -19,6 +19,7 @@
 
 #include <time.h>
 #include <fcntl.h>
+#include <errno.h>
 
 #include "php.h"
 #include "ZendAccelerator.h"
@@ -194,6 +195,23 @@ static ZEND_INI_MH(OnUpdateFileCache)
 	return SUCCESS;
 }
 
+static ZEND_INI_MH(OnUpdateFileCachePermissions)
+{
+	mode_t *p = ZEND_INI_GET_ADDR();
+	char *end;
+	unsigned long val;
+
+	errno = 0;
+	val = strtoul(ZSTR_VAL(new_value), &end, 8);
+	if (errno != 0 || end != ZSTR_VAL(new_value) + ZSTR_LEN(new_value) || val > 0777) {
+		zend_accel_error(ACCEL_LOG_WARNING, "opcache.file_cache_permissions must be a valid octal mode between 0000 and 0777.\n");
+		return FAILURE;
+	}
+
+	*p = (mode_t) val;
+	return SUCCESS;
+}
+
 #ifdef HAVE_JIT
 static ZEND_INI_MH(OnUpdateJit)
 {
@@ -321,7 +339,7 @@ ZEND_INI_BEGIN()
 #endif
 
 	STD_PHP_INI_ENTRY("opcache.file_cache"                    , NULL  , PHP_INI_SYSTEM, OnUpdateFileCache, accel_directives.file_cache,                    zend_accel_globals, accel_globals)
-	STD_PHP_INI_ENTRY("opcache.file_cache_permissions", "384" /* S_IRUSR | S_IWUSR */, PHP_INI_SYSTEM, OnUpdateLong, accel_directives.file_cache_permissions, zend_accel_globals, accel_globals)
+	STD_PHP_INI_ENTRY("opcache.file_cache_permissions", "0600", PHP_INI_SYSTEM, OnUpdateFileCachePermissions, accel_directives.file_cache_permissions, zend_accel_globals, accel_globals)
 	STD_PHP_INI_BOOLEAN("opcache.file_cache_read_only"          , "0"   , PHP_INI_SYSTEM, OnUpdateBool,    accel_directives.file_cache_read_only,          zend_accel_globals, accel_globals)
 	STD_PHP_INI_BOOLEAN("opcache.file_cache_only"               , "0"   , PHP_INI_SYSTEM, OnUpdateBool,	   accel_directives.file_cache_only,               zend_accel_globals, accel_globals)
 	STD_PHP_INI_BOOLEAN("opcache.file_cache_consistency_checks" , "1"   , PHP_INI_SYSTEM, OnUpdateBool,	   accel_directives.file_cache_consistency_checks, zend_accel_globals, accel_globals)
diff --git a/php.ini-development b/php.ini-development
index 7837a2d70590..835220d6b17a 100644
--- a/php.ini-development
+++ b/php.ini-development
@@ -1777,8 +1777,8 @@ ldap.max_links = -1
 ; SHM reset. The default "" disables file based caching.
 ;opcache.file_cache=
 
-; The permissions of the files cached.
-;opcache.file_cache_permissions=384 (0o600)
+; The permissions of the files cached, in octal notation.
+;opcache.file_cache_permissions=0600
 
 ; Enables or disables read-only mode for the second level cache directory.
 ; It should improve performance for read-only containers,
diff --git a/php.ini-production b/php.ini-production
index 52d8a86f0d4b..ca9097010f73 100644
--- a/php.ini-production
+++ b/php.ini-production
@@ -1779,8 +1779,8 @@ ldap.max_links = -1
 ; SHM reset. The default "" disables file based caching.
 ;opcache.file_cache=
 
-; The permissions of the files cached.
-;opcache.file_cache_permissions=384 (0o600)
+; The permissions of the files cached, in octal notation.
+;opcache.file_cache_permissions=0600
 
 ; Enables or disables read-only mode for the second level cache directory.
 ; It should improve performance for read-only containers,

From cd36869a4e33478cf68845eeed3a71193385ecc1 Mon Sep 17 00:00:00 2001
From: Jack Worman <jworman@healthcall.com>
Date: Sat, 27 Jun 2026 20:30:24 -0500
Subject: [PATCH 08/17] use octal notation

---
 ext/opcache/zend_accelerator_module.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/ext/opcache/zend_accelerator_module.c b/ext/opcache/zend_accelerator_module.c
index d80ff91dd5ea..eb31050646d7 100644
--- a/ext/opcache/zend_accelerator_module.c
+++ b/ext/opcache/zend_accelerator_module.c
@@ -19,7 +19,6 @@
 
 #include <time.h>
 #include <fcntl.h>
-#include <errno.h>
 
 #include "php.h"
 #include "ZendAccelerator.h"

From dbd5b34351bff4c4d0e32ab94f40c5ca948cd1e9 Mon Sep 17 00:00:00 2001
From: Jack Worman <jworman@healthcall.com>
Date: Sat, 27 Jun 2026 21:09:57 -0500
Subject: [PATCH 09/17] Update zend_accelerator_module.c

---
 ext/opcache/zend_accelerator_module.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ext/opcache/zend_accelerator_module.c b/ext/opcache/zend_accelerator_module.c
index eb31050646d7..52a22fa38a53 100644
--- a/ext/opcache/zend_accelerator_module.c
+++ b/ext/opcache/zend_accelerator_module.c
@@ -201,7 +201,7 @@ static ZEND_INI_MH(OnUpdateFileCachePermissions)
 	unsigned long val;
 
 	errno = 0;
-	val = strtoul(ZSTR_VAL(new_value), &end, 8);
+	val = ZEND_STRTOL(ZSTR_VAL(new_value), &end, 8);
 	if (errno != 0 || end != ZSTR_VAL(new_value) + ZSTR_LEN(new_value) || val > 0777) {
 		zend_accel_error(ACCEL_LOG_WARNING, "opcache.file_cache_permissions must be a valid octal mode between 0000 and 0777.\n");
 		return FAILURE;

From bea5d17cf96c0ee1b2112562515906fa6de99020 Mon Sep 17 00:00:00 2001
From: Jack Worman <jworman@healthcall.com>
Date: Sun, 28 Jun 2026 09:07:47 -0500
Subject: [PATCH 10/17] Update file_cache_permissions.phpt

---
 ext/opcache/tests/file_cache_permissions.phpt | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/ext/opcache/tests/file_cache_permissions.phpt b/ext/opcache/tests/file_cache_permissions.phpt
index c8d6c7fda896..ab4a0f536289 100644
--- a/ext/opcache/tests/file_cache_permissions.phpt
+++ b/ext/opcache/tests/file_cache_permissions.phpt
@@ -18,6 +18,8 @@ opcache.file_update_protection=0
 opcache.file_cache_permissions=0644
 --FILE--
 <?php
+var_dump(ini_get('opcache.file_cache_permissions')); echo "\n";
+
 $phpFile = __DIR__ . '/foo.php';
 file_put_contents($phpFile, '<?php return 42;');
 require $phpFile;
@@ -67,4 +69,5 @@ if (is_dir($opcacheDirectory)) {
 }
 ?>
 --EXPECT--
+string(6) "0644"
 string(6) "644"

From ffcfb1db85037c10d89948f509a7c1276f43c762 Mon Sep 17 00:00:00 2001
From: Jack Worman <jworman@healthcall.com>
Date: Sun, 28 Jun 2026 09:28:46 -0500
Subject: [PATCH 11/17] Update file_cache_permissions.phpt

---
 ext/opcache/tests/file_cache_permissions.phpt | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/ext/opcache/tests/file_cache_permissions.phpt b/ext/opcache/tests/file_cache_permissions.phpt
index ab4a0f536289..39c1cc798c6b 100644
--- a/ext/opcache/tests/file_cache_permissions.phpt
+++ b/ext/opcache/tests/file_cache_permissions.phpt
@@ -15,10 +15,10 @@ opcache.enable_cli=1
 opcache.file_cache="{PWD}/opcache"
 opcache.file_cache_only=1
 opcache.file_update_protection=0
-opcache.file_cache_permissions=0644
+opcache.file_cache_permissions=0660
 --FILE--
 <?php
-var_dump(ini_get('opcache.file_cache_permissions')); echo "\n";
+umask(0o000);
 
 $phpFile = __DIR__ . '/foo.php';
 file_put_contents($phpFile, '<?php return 42;');
@@ -39,7 +39,7 @@ foreach ($iterator as $splFileInfo) {
         continue;
     }
     if (str_ends_with($splFileInfo->getPathname(), '/foo.php.bin')) {
-        var_dump(sprintf('%o', substr(fileperms($splFileInfo->getPathname()), -3)));
+        var_dump(sprintf('%o', fileperms($splFileInfo->getPathname()) & 0o777));
         break;
     }
 }
@@ -69,5 +69,4 @@ if (is_dir($opcacheDirectory)) {
 }
 ?>
 --EXPECT--
-string(6) "0644"
-string(6) "644"
+string(6) "660"

From 5c7eab1ae80e47a15cbf4c8f0cbb05948ac2ed15 Mon Sep 17 00:00:00 2001
From: Jack Worman <jworman@healthcall.com>
Date: Sun, 28 Jun 2026 09:44:00 -0500
Subject: [PATCH 12/17] Update file_cache_permissions.phpt

---
 ext/opcache/tests/file_cache_permissions.phpt | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/ext/opcache/tests/file_cache_permissions.phpt b/ext/opcache/tests/file_cache_permissions.phpt
index 39c1cc798c6b..f196f7c41cc1 100644
--- a/ext/opcache/tests/file_cache_permissions.phpt
+++ b/ext/opcache/tests/file_cache_permissions.phpt
@@ -4,6 +4,7 @@ opcache.file_cache_permissions
 opcache
 --SKIPIF--
 <?php
+umask(0o000);
 @mkdir(__DIR__ . '/opcache', 0777, true);
 if (substr(PHP_OS, 0, 3) === 'WIN') {
     die('skip not for Windows');
@@ -18,8 +19,6 @@ opcache.file_update_protection=0
 opcache.file_cache_permissions=0660
 --FILE--
 <?php
-umask(0o000);
-
 $phpFile = __DIR__ . '/foo.php';
 file_put_contents($phpFile, '<?php return 42;');
 require $phpFile;
@@ -69,4 +68,4 @@ if (is_dir($opcacheDirectory)) {
 }
 ?>
 --EXPECT--
-string(6) "660"
+string(3) "660"

From 840007a6674d6bdad22432a5b328c32824d109f7 Mon Sep 17 00:00:00 2001
From: Jack Worman <jworman@healthcall.com>
Date: Sun, 28 Jun 2026 10:00:49 -0500
Subject: [PATCH 13/17] Update file_cache_permissions.phpt

---
 ext/opcache/tests/file_cache_permissions.phpt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ext/opcache/tests/file_cache_permissions.phpt b/ext/opcache/tests/file_cache_permissions.phpt
index f196f7c41cc1..c7af735d9907 100644
--- a/ext/opcache/tests/file_cache_permissions.phpt
+++ b/ext/opcache/tests/file_cache_permissions.phpt
@@ -68,4 +68,4 @@ if (is_dir($opcacheDirectory)) {
 }
 ?>
 --EXPECT--
-string(3) "660"
+string(3) "640"

From 1c159b06f5544a4a110ba8d0c6bf8f155cd2951d Mon Sep 17 00:00:00 2001
From: Jack Worman <jworman@healthcall.com>
Date: Sun, 28 Jun 2026 13:33:00 -0500
Subject: [PATCH 14/17] opcache.file_cache_permissions

---
 ext/opcache/tests/file_cache_permissions.phpt | 25 +++++--------------
 ext/opcache/zend_accelerator_module.c         |  1 -
 ext/opcache/zend_file_cache.c                 |  3 +++
 3 files changed, 9 insertions(+), 20 deletions(-)

diff --git a/ext/opcache/tests/file_cache_permissions.phpt b/ext/opcache/tests/file_cache_permissions.phpt
index c7af735d9907..ad572ab82ba5 100644
--- a/ext/opcache/tests/file_cache_permissions.phpt
+++ b/ext/opcache/tests/file_cache_permissions.phpt
@@ -4,11 +4,7 @@ opcache.file_cache_permissions
 opcache
 --SKIPIF--
 <?php
-umask(0o000);
-@mkdir(__DIR__ . '/opcache', 0777, true);
-if (substr(PHP_OS, 0, 3) === 'WIN') {
-    die('skip not for Windows');
-}
+mkdir(__DIR__ . '/opcache', 0777, true);
 ?>
 --INI--
 opcache.enable=1
@@ -19,13 +15,6 @@ opcache.file_update_protection=0
 opcache.file_cache_permissions=0660
 --FILE--
 <?php
-$phpFile = __DIR__ . '/foo.php';
-file_put_contents($phpFile, '<?php return 42;');
-require $phpFile;
-register_shutdown_function(static function () use ($phpFile): void {
-    @unlink($phpFile);
-});
-
 $opcacheDirectory = __DIR__ . '/opcache';
 $iterator = new RecursiveIteratorIterator(
     new RecursiveDirectoryIterator(
@@ -37,7 +26,7 @@ foreach ($iterator as $splFileInfo) {
     if (!$splFileInfo->isFile()) {
         continue;
     }
-    if (str_ends_with($splFileInfo->getPathname(), '/foo.php.bin')) {
+    if (str_ends_with($splFileInfo->getPathname(), '.bin')) {
         var_dump(sprintf('%o', fileperms($splFileInfo->getPathname()) & 0o777));
         break;
     }
@@ -45,8 +34,6 @@ foreach ($iterator as $splFileInfo) {
 ?>
 --CLEAN--
 <?php
-@unlink(__DIR__ . '/foo.php');
-
 $opcacheDirectory = __DIR__ . '/opcache.php';
 if (is_dir($opcacheDirectory)) {
     $iterator = new RecursiveIteratorIterator(
@@ -59,13 +46,13 @@ if (is_dir($opcacheDirectory)) {
     foreach ($iterator as $splFileInfo) {
         $path = $splFileInfo->getRealPath();
         if ($splFileInfo->isDir()) {
-            @rmdir($path);
+            rmdir($path);
         } else {
-            @unlink($path);
+            unlink($path);
         }
     }
-    @rmdir($opcacheDirectory);
+    rmdir($opcacheDirectory);
 }
 ?>
 --EXPECT--
-string(3) "640"
+string(3) "660"
diff --git a/ext/opcache/zend_accelerator_module.c b/ext/opcache/zend_accelerator_module.c
index 52a22fa38a53..17aafc2eb210 100644
--- a/ext/opcache/zend_accelerator_module.c
+++ b/ext/opcache/zend_accelerator_module.c
@@ -18,7 +18,6 @@
 */
 
 #include <time.h>
-#include <fcntl.h>
 
 #include "php.h"
 #include "ZendAccelerator.h"
diff --git a/ext/opcache/zend_file_cache.c b/ext/opcache/zend_file_cache.c
index 412cbc3c817f..3595ade467e1 100644
--- a/ext/opcache/zend_file_cache.c
+++ b/ext/opcache/zend_file_cache.c
@@ -1179,6 +1179,9 @@ int zend_file_cache_script_store(zend_persistent_script *script, bool in_shm)
 		efree(filename);
 		return FAILURE;
 	}
+	if (fchmod(fd, ZCG(accel_directives).file_cache_permissions) == -1) {
+		zend_accel_error(ACCEL_LOG_WARNING, "Unable to change opcache file permissions in %s: %s (%d)", filename, strerror(errno), errno);
+	}
 
 	if (zend_file_cache_flock(fd, LOCK_EX) != 0) {
 		close(fd);

From 72c284c3a993072a044a1a67be85bfddfc96ec1c Mon Sep 17 00:00:00 2001
From: Jack Worman <jworman@healthcall.com>
Date: Sun, 28 Jun 2026 14:39:06 -0500
Subject: [PATCH 15/17] opcache

---
 ext/opcache/tests/file_cache_permissions.phpt | 44 ++++---------------
 .../file_cache_permissions_validation.phpt    | 21 +++++++++
 2 files changed, 29 insertions(+), 36 deletions(-)
 create mode 100644 ext/opcache/tests/file_cache_permissions_validation.phpt

diff --git a/ext/opcache/tests/file_cache_permissions.phpt b/ext/opcache/tests/file_cache_permissions.phpt
index ad572ab82ba5..03bbb148433a 100644
--- a/ext/opcache/tests/file_cache_permissions.phpt
+++ b/ext/opcache/tests/file_cache_permissions.phpt
@@ -4,24 +4,18 @@ opcache.file_cache_permissions
 opcache
 --SKIPIF--
 <?php
-mkdir(__DIR__ . '/opcache', 0777, true);
+mkdir(ini_get('opcache.file_cache'), 0777, true);
 ?>
 --INI--
-opcache.enable=1
-opcache.enable_cli=1
-opcache.file_cache="{PWD}/opcache"
-opcache.file_cache_only=1
-opcache.file_update_protection=0
-opcache.file_cache_permissions=0660
+opcache.enable="1"
+opcache.enable_cli="1"
+opcache.file_cache="{TMP}/9664b02e-6f64-42dd-b088-99f3dccc3422"
+opcache.file_cache_only="1"
+opcache.file_update_protection="0"
+opcache.file_cache_permissions="0660"
 --FILE--
 <?php
-$opcacheDirectory = __DIR__ . '/opcache';
-$iterator = new RecursiveIteratorIterator(
-    new RecursiveDirectoryIterator(
-        $opcacheDirectory,
-        FilesystemIterator::SKIP_DOTS,
-    ),
-);
+$iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator(ini_get('opcache.file_cache'), FilesystemIterator::SKIP_DOTS));
 foreach ($iterator as $splFileInfo) {
     if (!$splFileInfo->isFile()) {
         continue;
@@ -32,27 +26,5 @@ foreach ($iterator as $splFileInfo) {
     }
 }
 ?>
---CLEAN--
-<?php
-$opcacheDirectory = __DIR__ . '/opcache.php';
-if (is_dir($opcacheDirectory)) {
-    $iterator = new RecursiveIteratorIterator(
-        new RecursiveDirectoryIterator(
-            $opcacheDirectory,
-            RecursiveDirectoryIterator::SKIP_DOTS,
-        ),
-        RecursiveIteratorIterator::CHILD_FIRST,
-    );
-    foreach ($iterator as $splFileInfo) {
-        $path = $splFileInfo->getRealPath();
-        if ($splFileInfo->isDir()) {
-            rmdir($path);
-        } else {
-            unlink($path);
-        }
-    }
-    rmdir($opcacheDirectory);
-}
-?>
 --EXPECT--
 string(3) "660"
diff --git a/ext/opcache/tests/file_cache_permissions_validation.phpt b/ext/opcache/tests/file_cache_permissions_validation.phpt
new file mode 100644
index 000000000000..801f0969ec7c
--- /dev/null
+++ b/ext/opcache/tests/file_cache_permissions_validation.phpt
@@ -0,0 +1,21 @@
+--TEST--
+opcache.file_cache_permissions validation
+--EXTENSIONS--
+opcache
+--INI--
+opcache.file_cache_permissions="bogus"
+--FILE--
+<?php
+$iterator = new RecursiveIteratorIterator(new RecursiveDirectoryIterator(ini_get('opcache.file_cache'), FilesystemIterator::SKIP_DOTS));
+foreach ($iterator as $splFileInfo) {
+    if (!$splFileInfo->isFile()) {
+        continue;
+    }
+    if (str_ends_with($splFileInfo->getPathname(), '.bin')) {
+        var_dump(sprintf('%o', fileperms($splFileInfo->getPathname()) & 0o777));
+        break;
+    }
+}
+?>
+--EXPECTF--
+%s: Warning opcache.file_cache_permissions must be a valid octal mode between 0000 and 0777.

From b1c8d3747acba9d5fe33f9568a368f167b17d833 Mon Sep 17 00:00:00 2001
From: Jack Worman <jworman@healthcall.com>
Date: Sun, 28 Jun 2026 15:10:19 -0500
Subject: [PATCH 16/17] Update file_cache_permissions.phpt

---
 ext/opcache/tests/file_cache_permissions.phpt | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/ext/opcache/tests/file_cache_permissions.phpt b/ext/opcache/tests/file_cache_permissions.phpt
index 03bbb148433a..3abd94726a32 100644
--- a/ext/opcache/tests/file_cache_permissions.phpt
+++ b/ext/opcache/tests/file_cache_permissions.phpt
@@ -4,7 +4,8 @@ opcache.file_cache_permissions
 opcache
 --SKIPIF--
 <?php
-mkdir(ini_get('opcache.file_cache'), 0777, true);
+//@mkdir(ini_get('opcache.file_cache'), 0777, true);
+mkdir(sys_get_temp_dir() . '/9664b02e-6f64-42dd-b088-99f3dccc3422', 0777, true);
 ?>
 --INI--
 opcache.enable="1"

From 7e158c0c8c99b34b45d20e2bfd74e80a8cba2e47 Mon Sep 17 00:00:00 2001
From: Jack Worman <jworman@healthcall.com>
Date: Sun, 28 Jun 2026 15:16:23 -0500
Subject: [PATCH 17/17] Update zend_file_cache.c

---
 ext/opcache/zend_file_cache.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/ext/opcache/zend_file_cache.c b/ext/opcache/zend_file_cache.c
index 3595ade467e1..2a8ec5272942 100644
--- a/ext/opcache/zend_file_cache.c
+++ b/ext/opcache/zend_file_cache.c
@@ -1179,9 +1179,11 @@ int zend_file_cache_script_store(zend_persistent_script *script, bool in_shm)
 		efree(filename);
 		return FAILURE;
 	}
+#ifndef ZEND_WIN32
 	if (fchmod(fd, ZCG(accel_directives).file_cache_permissions) == -1) {
 		zend_accel_error(ACCEL_LOG_WARNING, "Unable to change opcache file permissions in %s: %s (%d)", filename, strerror(errno), errno);
 	}
+#endif
 
 	if (zend_file_cache_flock(fd, LOCK_EX) != 0) {
 		close(fd);