The PHP Podcast 2026.11.05

PHP Podcast – November 5, 2026 Hosts: Eric Van Johnson & Joe Ferguson (John Congdon) Two months, a dozen new stream buttons, and a 6 AM crypto-mining emergency. Eric falls in love with a developer-only social network, the PHP2Shell CVE tests the team, and PHP Tek season kicks off. Welcome to the Boss Level. Back After Two Months — and Everything Is On Fire (Audio-Wise) After nearly two months off the air, Eric and John opened the Boss Level episode the only way they know how: with a full-blown audio meltdown. Eric was on the wrong mic, and as usual, his connection kept cutting in and out while the crew wrestled with a fresh stack of stream widgets, pop-up reactions, and survey overlays nobody fully understood. Once they got the sound working, they reintroduced the show. This is the monthly “Boss Level” episode where the two people behind PHP Architect pull back the curtain on the magazine, the conference, and the consulting business — with a little more candor than usual, since, as Eric put it, John can’t fire him and he can’t fire John. Leaked AWS Keys and a 6 AM Bitcoin-Mining Nightmare John’s week started at 6:10 AM with pager alerts about a Lambda function failing to post to Slack. What looked like a trivial memory leak turned out to be something far worse: a leaked AWS key with permission to spin up instances. An attacker had launched 32x and 64x large machines in every single region to mine Bitcoin. The team rallied — four or five people each terminating instances region by region — and disabled the compromised key before new instances could spawn. Using AI tools to dig through the logs, they discovered the key had first been quietly tested back in September, likely by whoever was selling it to prove it was valid before putting it on the market. Identifying and rectifying took about 20 minutes, but it was not a fun morning. /Dev/Null: A Social Network Built for Developers in a Day Eric gushed about /dev/null, a brand-new developer-centric social network built on Laravel in roughly a day or two by Nuno, Brent, Matthew, and Pauline Voss. Everything about it is geared to developers: the main feed is “the log,” posting is “making a commit,” your VIM bindings work inside it, and sign-up ties directly to your GitHub account to pull in your profile. He’s begging the creators to keep the walled garden intact and not make it easier for the “normies.” He also highlighted a TUI built by Wendell (a Laravel employee and PHP Architect columnist) that mirrors the web app so closely it’s become Eric’s home for DevNull right inside his Tmux setup. That led into a tour of his terminal-centric workflow — one Tmux session per project (a trick from Jess Archer), panes for Claude, nvim, and dev servers, lazygit for commits — and why he quietly retired PHPStorm earlier this year in favor of nvim and the terminal. Pauline, a fantastic conference speaker known for Git talks, has even started livestreaming on Twitch following the build. PHP Tech 2027: Call for Speakers Closed, Evaluation Begins The call for speakers has closed, and talk evaluation is underway. John is changing the process this year so reviewers judge fewer talks at a time — one smaller track took him about three minutes. Anyone in the community, ideally planning to attend, can reach out to John on Discord to get added and help pick what gets presented. You rank three anonymized talks side by side, with the title doing most of the heavy lifting since that’s what attendees see on the website. Eric reminded listeners that submitting multiple talks improves their odds of being selected when narrowing the final list. Speakers with more than one accepted talk get priority since they’re the biggest bang for the buck. This year’s third track rotates: a JavaScript day, a Laravel day, and a DevOps day. John noted it was exactly that deployment knowledge gap that first drew him to PHP Tech back in 2010, when he had no idea how to actually deploy an application. All the details live at phptek.io. The PHP-to-Shell CVE and Why a DevOps Person Matters PHP had a rough couple of weeks due to a major “PHP2shell” CVE. Joe, a release manager for the upcoming PHP 8.6, had sensed something was brewing and started preparing rollout plans before the details dropped. When it hit, the team patched nearly everything across their clients within 24 hours, with only a couple of third-party-dependent servers trailing. Eric and John reflected that after 14 years of running their consulting arm (the DiegoDev Group, now PHP Architect Consulting), finally having a dedicated DevOps person has made the difference between night and day. The fallout rippled outward: NativePHP published a candid write-up about having to issue its first-ever security advisory, since a PHP vulnerability affects anything that compiles PHP into a mobile app. The hosts wondered how projects like NativePHP can get into the “consortium” that receives early patch access alongside the big distros. They also pushed back on the “PHP is dead” crowd — this was a memory bug that has lived in the code for 20 years and affects roughly 70% of the web, but memory bugs happen in every language, from Node to npm. The silver lining: a visible spike in PHP Foundation financial contributions, with Eric clarifying that the Foundation funds internal developers but doesn’t dictate PHP’s direction. Git Workflows, SVN War Stories, and the Specialization of Developers The conversation wandered into deployment history — FTP and rsync in the SVN/CVS days — and Eric’s war stories from a Java/WebSphere enterprise shop where developers had no idea where their apps were even hosted. His takeaway: developers today are extremely specialized, and you shouldn’t be surprised when a brilliant Java dev can’t navigate a command line. Eric defended his fork-based Git workflow: a single clean “upstream” repo that only deploys to servers, with everyone forking into their own private GitHub account and sending back only clean, deployment-ready code, essentially the open-source model. The chat gave him grief, including jabs about failing at Git worktrees, which Eric conceded he understands in principle but finds painful in a PHP workflow with its multiple Composer and npm installs and environment files. Links from the show: PHP Tech 2027 — Call for speakers closed; register now PHP Architect Consulting store.phparch.com — PHP Architect merch & elephants PHP Foundation Office Hours (streamed on our channel) Dev-Null.sh PHP 8.6.0 RC5 available for testing Linux Kernel TCP Flaw PHP 8.6’s soft feature freeze PHP Foundation Community Hour Podcast NativePHP first security advisories Host: Eric Van Johnson /dev/null: @ericvanjohsnon X: @shocm Mastodon: @eric@phparch.social Bluesky: @ericvanjohnson.bsky.social PHPArch.me: @eric John Congdon /dev/null: @johncongdon X: @johncongdon Mastodon: @john@phparch.social Bluesky: @johncongdon.bsky.social PHPArch.me: @john Streams: Youtube Channel Twitch Connect & Hire PHP Architect Website Twitter/X Mastodon Hire PHP Developers Looking to hire PHP developers? Email support@phparch.com – Joe and the team are available for consulting, infrastructure work, Ansible playbooks, and code review. Partner This podcast is made a little better thanks to our partners OurCVEs Your security posture, on autopilot with OurCVEs   CodeRabbit   Cut code review time & bugs in half instantly with CodeRabbit.   PHP Architect Consulting   Your PHP codebase deserves a partner, not a contractor PHP Architect provides long-term technical partnerships for organizations that need senior-level PHP expertise that you can depend on. https://www.phparch.com/consulting/ Music Provided by Epidemic Sound https://www.epidemicsound.com/ Join Us Live Next Week Youtube Channel Got feedback? Join us on Discord at discord.phparch.com The post The PHP Podcast 2026.11.05 appeared first on PHP Architect.

Community Corner Podcast: cakePHP with Jamison Bryant

 In this episode, Scott talks with Jamison Bryant about what sets CakePHP apart from Laravel and Symfony, the plugin ecosystem, and how he moved TicketSauce from CakePHP 2 to 5 with the strangler fig pattern. Links: Our Discord – https://discord.gg/aMTxunVx Buy our shirts – https://store.phparch.com/products/community-corner-podcast-t-shirt Mentioned in this episode: CakePHP – https://cakephp.org/ CakePHP on GitHub – https://github.com/cakephp/cakephp Bake console – https://book.cakephp.org/5/en/bake.html CakePHP plugins directory – https://plugins.cakephp.org/ Awesome CakePHP – https://github.com/FriendsOfCake/awesome-cakephp SwaggerBake plugin – https://github.com/cnizzardini/cakephp-swagger-bake CakePHP Preloader (OPcache) – https://github.com/cnizzardini/cakephp-preloader CakePHP Authentication – https://github.com/cakephp/authentication CakePHP Authorization – https://github.com/cakephp/authorization CakePHP app template – https://github.com/cakephp/app Strangler Fig Application by Martin Fowler – https://martinfowler.com/bliki/StranglerFigApplication.html CakePHP 5.0 migration guide – https://book.cakephp.org/5/en/appendices/5-0-migration-guide.html CakePHP upgrade tool – https://github.com/cakephp/upgrade Rector – https://getrector.org/ Cake Software Foundation – https://cakefoundation.org/ CakeDC – https://www.cakedc.com/ Passbolt – https://www.passbolt.com/ TicketSauce – https://www.ticketsauce.com/ XKCD Dependency – https://xkcd.com/2347/ Longhorn PHP – https://www.longhornphp.com/ php[tek] – https://phptek.io/ I Built a CakePHP Plugin From My iPhone While Packing for a Trip – https://www.phparch.com/article/2026-08-i-built-a-cakephp-plugin-from-my-iphone-while-packing-for-a-trip/ Jamison’s Links: Website – https://jamison.bryant.ai/ Blog (Serious Semicolons) – https://serioussemicolons.wordpress.com/ Mastodon – https://phpc.social/@ssemicolons LinkedIn – https://www.linkedin.com/in/jamisonbryant/ GitHub – https://github.com/jamisonbryant Scott’s Links: Website – https://scott.keck-warren.com/ Bluesky – https://bsky.app/profile/scottkeckwarren.bsky.social LinkedIn – https://www.linkedin.com/in/scott-keck-warren-91689810/ Mastodon – https://phpc.social/@scottkeckwarren PHP Architect Social Media: X: https://x.com/phparch Mastodon: https://phparch.social/@phparch Bluesky: https://bsky.app/profile/phparch.com Discord: https://discord.phparch.com Subscribe to our magazine: https://www.phparch.com/subscribe/ Partners This podcast is made a little better thanks to our partners. OurCVEs Your security posture, on autopilot with OurCVEs   CodeRabbit   Cut code review time & bugs in half instantly with CodeRabbit.     PHP Architect Consulting   Your PHP codebase deserves a partner, not a contractor PHP Architect provides long-term technical partnerships for organizations that need senior-level PHP expertise that you can depend on https://www.phparch.com/consulting/ Music provided by Epidemic Sound https://www.epidemicsound.com/ The post Community Corner Podcast: cakePHP with Jamison Bryant appeared first on PHP Architect.

156: Batten Down The Hatches

Ian and Aaron discuss a short-lived Laravel New, Aaron's first onsite with the marketing team, a successful trip to Philly, the seemingly inevitable security apocalypse, and more.Sponsored by Svix, Maileroo, Bento, PostShiba, and Typesense.Interested in sponsoring Mostly Technical?  Head to https://mostlytechnical.com/sponsor to learn more.(00:00) - Ian's Laravel New didn't last (24:13) - Laravel Offsite (35:06) - Everybody's Orbin' (42:13) - Got The Cash (50:07) - Follow Up - Are People Actually Replacing SaaS? (58:18) - Are Companies Rational Economic Actors? (01:06:26) - Operation Batten Down The Hatches (01:18:07) - Outro! Dot FM! Links:ObsidianClaude DuetFirecrawlTerry Black’s BarbecueJoe T. Garcia’sMafia (party game)CatanGhosttyAmp OrbsSoloPHP×PhillyMary PerryEff1-900-Ice-CreamLess Annoying CRMStartup to LastNorth Korea linked to $6.3B Binance hackOutro

The PHP Podcast 2026.10.29

PHP Podcast – October 29, 2026 Hosts: Joe Ferguson, Sara Golemon & Holly Schilling Patrick Stewart has passed. Tailscale handed out root. The PHP RCE patch landed. And MediaWiki contributer Brooke Vibber tells us how Wikipedia survives celebrity deaths, 500 languages, and Apple’s file system. Patrick Stewart, Cache Stampedes, and the Michael Jackson Outage The crew opened on the sad news of Patrick Stewart’s passing. That segued directly into special guest Brooke Vibber recounting a very real MediaWiki war story from the early days. Back in 2009, when Michael Jackson died, so many people tried to edit the Wikipedia article simultaneously that the entire system fell over. Each save triggered a full re-render, link table updates, and layers of other work — and with a thousand of those happening at once, it destroyed everything. The emergency fix was a hack that served stale cached data to anyone viewing the Michael Jackson page, which instantly brought the site back online. The proper fix came later: a pressure valve for high-concurrency situations, a textbook cache-stampede problem they should have anticipated but didn’t catch until real planetary-scale load exposed it. Since fixing it correctly, they’ve never had a repeat — even for later celebrity deaths. Tailscale SSH Root and the PHP RCE Patch The team covered Tailscale’s security adventure where the built-in SSH functionality let someone already on a node in your tailnet get root on any server running it. Because it requires network access first, it wasn’t catastrophic, and Tailscale patched it quickly — though Holly cheerfully admitted to not updating her family game servers. Talk turned to the big PHP RCE vulnerability. Joe, as a release manager, actually got early access to the patch and noted it was massive — lots of files touched. The Foundation blog explained the bug was found in the 2024 security audit, but the security team struggled not with *how* to fix it but how to fix it *best*, producing competing implementations with different tradeoffs while it remained only a theoretical exploit. Sara underlined that memory-corruption RCEs like this — where a bailout leaves data somewhere it shouldn’t be, eventually turning into bytecode or binary — are extremely hard to pull off, depending on architecture and memory layout. Despite claims of in-the-wild exploitation, most were retracted, and performance impact of the fix turned out to be negligible. Wikimedia’s own response was to simply shut down all user-generated cloud services code until the patch was installed — sometimes the biggest circuit breaker is the best security. HHVM, PHP 7, and the Phantom PHP 6 Brooke walked through Wikimedia’s journey with HHVM, which gave a solid 2x improvement over PHP 5 when Sara’s team at Facebook was pitching it. But once PHP 7 arrived — borrowing many of HHVM’s performance ideas — the gap closed, performance got more consistent and less spiky, and the extra complexity of running HHVM plus the pressure to adopt Hack stopped being worthwhile. Sara took partial credit for grabbing the clever bits out of HHVM and getting them into PHP 7, all without a JIT (that didn’t arrive until PHP 8). Wikimedia stuck with mainline PHP for broader compatibility and because they’d written their entire codebase in PHP and had no desire to switch to Hack. Naturally, the conversation detoured into the legend of PHP 6. Sara confirmed the last version of PHP 6 lives on in a Git tag — something like an experimental first Unicode attempt — and it will generally compile, just don’t expect performance, since it runs about a third the speed of PHP 7. Holly floated secretly shipping PHP 8.6 as the PHP 6 branch, and Sara noted that re-adding Register Globals would be trivially easy and really ought to be an April Fool’s joke someday. 500 Languages, Unicode, and the Localization Cache Brooke revealed MediaWiki is quite possibly the most localized software in the world, supporting roughly 500 human languages — real languages with assigned ISO codes, not Klingon (though that might exist too). The system uses fallback chains, so a reader in a former Soviet country might fall back to Russian before English, and it can even dynamically convert between scripts like Serbian Cyrillic and Latin, or Chinese traditional and simplified. The infrastructure runs across roughly 2,200–2,500 Kubernetes-hosted application servers in data centers in Virginia and Texas (with a smaller caching center in San Francisco). Every MediaWiki update is packaged into an image with the pre-compiled localization cache and atomically rolled out across all nodes. Brooke worked on a patch to move the localization cache from a disk-backed database to an in-memory one built from PHP array literals, letting OPcache deduplicate all the strings automatically. In isolated testing it should yield several percent throughput improvement — which, at Wikipedia’s traffic volume, translates to tens or hundreds of thousands of dollars of equipment saved. The Esperanto Unicode Origin Story In one of the nerdiest stories the show has ever aired, Brooke explained how they first got involved in Wikipedia development back in 2001 — through localization support, while learning Esperanto for fun. (Bonus trivia: there’s a 1966 horror film, *Incubus*, starring William Shatner entirely in Esperanto, with pronunciation so notorious that Esperanto conventions turn it into a drinking game.) Because the early wikis ran 8-bit Latin-1, Esperanto’s accented characters didn’t work. So Brooke patched the open-source code to use UTF-8 for the Esperanto edition — doing Unicode before UTF-8 was the universal standard. As MediaWiki (built by Magnus Manske) took over, every new language wiki went straight to Unicode, and eventually English Wikipedia was converted too, using on-demand dynamic conversion of old Latin-1 revisions to minimize downtime. That led into a gleeful MySQL gripe session: early MySQL 3 had no transactions and no Unicode, so Wikimedia stored UTF-8 in binary fields and managed their own collations. When MySQL 4 “added Unicode,” the fine print revealed it only supported the Basic Multilingual Plane — useless for the rare CJK characters an encyclopedia must store. Normalization Forms and Cursing Apple Brooke saved the best horror story for the end: Unicode normalization. An “é” can be stored as a single precomposed character or as “e” plus a combining accent — and macOS on HFS stored file names the second way while everyone else used the first. The result was Mac users uploading images whose filenames wouldn’t match when others tried to link them. Since a compatible ICU library couldn’t be guaranteed, Brooke wrote a pure-PHP fallback that validated UTF-8 *and* normalized it to the precomposed form, so every way you type a name links the same way. Brooke cursed the Unicode Foundation many times — but cursed Apple a lot more, since everything else did the right thing by default. The group agreed the Intl extension (which provides exactly this normalization) is one of the few things that really should be installed by default — Wikipedia requires it outright now. They closed with a quick nod to Holly’s pet project on scalar extension functions for strings and a final push for the PHP Tech CFP, open through October 31. Links from the show: PHP Tech 2027 — Chicago, April 27–29; CFP & early bird tickets at phptek.io (CFP closes Oct 31) Brooke Vibber — brooke.vibber.net MediaWiki — the engine that runs Wikipedia Join us live in Discord Hosts: Joe Ferguson Mastodon: @joepferguson@phpc.social PHPArch.me: @svpernova09 Sara Golemon Mastodon: @pollita@phpc.social Holly Schilling Mastodon: @TheCodeLorax@tech.lgbt Brooke Vibber Mastodon: @bvibber@wikis.world Web: brooke.vibber.net Streams: Youtube Channel Twitch Esperanto Unicode Connect & Hire PHP Architect Website Twitter/X Mastodon Hire PHP Developers Looking to hire PHP developers? Email support@phparch.com – Joe and the team are available for consulting, infrastructure work, Ansible playbooks, and code review. Partner This podcast is made a little better thanks to our partners OurCVEs   Your security posture, on autopilot with OurCVEs     CodeRabbit   Cut code review time & bugs in half instantly with CodeRabbit.   PHP Architect Consulting   Your PHP codebase deserves a partner, not a contractor. PHP Architect provides long-term technical partnerships for organizations that need senior-level PHP expertise that you can depend on. Learn more.   Music Provided by Epidemic Sound https://www.epidemicsound.com/ Join Us Live Next Week Youtube Channel Got feedback? Join us on Discord at discord.phparch.com The post The PHP Podcast 2026.10.29 appeared first on PHP Architect.

It's insane to me that people are still...

David Hemphill is Chasing Dopamine

Matt Stauffer catches up with David Hemphill, co-creator of Laravel Nova and creator of the Beard CSS framework. They cover David’s years as an amateur MMA fighter, his punk rock roots, and why he keeps chasing flow states.The conversation moves into how David uses Suno to prototype songs before producing them himself. It also covers why he hasn’t hand-written code in almost two years, plus deep dives into mechanical keyboard group buys, Tesla’s self-driving, and neighborhood bass fishing.Matt Stauffer on X - https://x.com/mattstaufferDavid Hemphill on X - https://x.com/davidhemphillDavid Hemphill Website - davidhemphill.comLaravel Nova - https://nova.laravel.comBeard CSS framework (on David’s GitHub, monarkee): https://github.com/monarkee/beardPat Miletich -https://www.espn.com/mma/fighter/_/id/2501404/pat-miletichMiletich Fighting Systems - https://en.wikipedia.org/wiki/Miletich_Fighting_SystemsSuno - https://suno.comTycho, Dive (Matt’s background-music pick): https://www.youtube.com/watch?v=Z6ih1aKeETkPostHog’s “product engineer” role  -https://posthog.com/careers/product-engineerSass - https://sass-lang.com/Livemark - https://livemark.ai/Omnitype Bauer Lite 65% - https://omnitype.com/products/bauer-liteHappy Hacking Keyboard (HHKB) - https://happyhackingkb.comTactile Keychron 75% - https://www.keychron.com/collections/75-layout-keyboardsKeychron keyboards - https://www.keychron.com/K2 Keyboard - https://www.keychron.com/products/keychron-k2-wireless-mechanical-keyboard?_pos=1&_sid=a85eeb9c6&_ss=rK3 Max Keyboard - https://www.keychron.com/products/keychron-k3-max-qmk-via-wireless-custom-mechanical-keyboard?_pos=1&_psq=k3+max+keyboard&_psid=2b875253f&_ss=eFishbrain - https://fishbrain.com/ - User name: heyhempLaravel Twitter - https://twitter.com/laravelLaravel Website - https://laravel.com/Tighten Website - https://tighten.com/----- Editing and transcription sponsored by Tighten - https://tighten.com/Big thanks to the companies that support the show:Flare by Spatie - http://flareapp.io and Performance Monitoring - http://flareapp.io/performance-monitoringSerpAPI - https://serpapi.com?utm_source=laravel_podcast

155: The PHPocalypse

Ian and Aaron talk about Aaron's talk at Resend Forward, Ian's trip to the World Series, the PHPocalypse, Ian's dream job, and so much more.Sponsored by Svix, Maileroo, Bento, PostShiba, and Typesense.Interested in sponsoring Mostly Technical?  Head to https://mostlytechnical.com/sponsor to learn more.(00:00) - Hello Brewers Man (09:56) - Aaron's Trip to SF (28:18) - Ian's Dream Job (40:21) - Inside Baseball (43:16) - The PHPocolypse (01:00:17) - Indie Hacker Brainworm (01:03:21) - Found Money (01:14:22) - An Update on Aaron's Book (01:34:39) - Marketing Offsite Links:Brewers go up 2-0 in the World SeriesSal FrelickLaravel Founders Panel at AccelResend ForwardAaron’s talk at Resend ForwardLaravel CloudAccelThe Atlantic: “If Anything Happens to This Guy … Everyone Is Screwed”stealmybitcoin.comBrotli CVE-2026-111497Ruby’s level 10 CVEAaron’s bound bookFire & Blood by George R. R. Martin

From Webmaster to Software Developer in the Age of AI

Have you ever felt a little stung when someone called what you do “vibe coding” as if decades of craft just became optional?In the latest episode of the No Compromises podcast, we discuss why the rise of vibe coding as a term says something important about where software development is headed.Aaron makes the case that vibe coding trades long-term quality for short-term results, like a kitchen that serves one burger fast but cannot make a second one for 27 minutes.We also get into how AI tooling is shifting the role from writing code to reviewing and directing it, why the skills you have built still matter, and why Aaron is calling himself a software developer again.(00:00) - How developer titles have evolved over the years (02:12) - The problem with calling yourself a vibe coder (06:37) - Stepping back and letting AI handle the small details (10:49) - Your existing skills still matter more than you think (13:56) - Aaron's next chapter Building software with AI doesn't mean compromising on quality. See how Aaron helps you build smarter at MoreBetterFaster.

The PHP Podcast 2026.10.22

PHP Podcast – October 22, 2026 Hosts: Holly, Sara, Joe – Special Guest Daniel Scherzer PHP ships an emergency security release a day early, Daniel Scherzer pushes the commits at 6:30am on four hours of sleep, and governments across Europe start pulling servers offline. Oh, and a 12-pound dog nearly killed Holly. The PHP2Shell Security Release Special guest Daniel Scherzer — release manager for PHP 8.5 and 8.6 and a recent addition to the PHP ecosystem security team — walked the crew through the week’s big story: two critical CVEs that could lead to remote code execution. The team coordinated a synchronized release across PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12, with additional source backports provided for 7.4, 8.0, and 8.1 given how severe the vulnerabilities were. Daniel described the stress of it all, including waking up at 1am with a headache before a 5am alarm and a release process planned for 1300 UTC. In the end he volunteered to push every change himself, running three commands to push a whole bunch of commits across three repositories in a single atomic operation — four tags and seven branches at 1335 UTC, just before public disclosure. He also drew a clear line around the hats he wears. As a release manager he had early access to the fix, but he deliberately did not patch his own PHP-powered website ahead of time, explaining that the community trusted him to help release PHP, not because he was important enough to get early access for personal use. Governments in Europe were turning off public-facing sites and the NSA published guidance, leaving Daniel marveling at how he ended up with a front-row seat to something heads of government were paying attention to. A Two-Year-Old Bug and the AI Angle The vulnerability wasn’t new — it was originally discovered back in 2024 during the security audit funded through the PHP Foundation via the German government’s Sovereign Tech grant. The bug reportedly traces back through the PHP 5 series and possibly even PHP 4. What changed in 2026 was that someone (with AI tooling assistance) figured out how to turn a theoretical vulnerability into a workable exploit. Daniel pushed back on the framing that AI simply “found” the bug, emphasizing the two years in between where it was known but there weren’t enough maintainer hours or infrastructure to address it. At the time it was essentially a theoretical bug with no consistently provable exploit path. He cautioned that AI-discovered vulnerabilities shouldn’t be assumed correct without a human reviewing them, noting he hadn’t yet seen a clean proof-of-concept that didn’t also rely on some other underlying server vulnerability. The group discussed the rate of security reports skyrocketing as LLMs become common, with Sara describing the bandwidth problem the volunteer security team faces: triaging what’s likely to be exploited, confirming fixes are actually complete, and avoiding publishing an incomplete fix that tips off bad actors. Amazon claimed to have seen exploitation attempts beforehand, but the release manager chat showed no indication the bug was ever exploited in the wild before the release. Fund the Volunteers Who Hold Up the Internet A recurring theme was that PHP is fundamentally a volunteer-driven effort. The packagers for Ubuntu, Debian, and Red Hat — Remy and Andres — were both on vacation and stopped their plans to package PHP a day early. The Docker library maintainers are volunteers too, as are many members of the Foundation security team who are still not paid contractors. The crew highlighted a Mastodon post from Nils Alderman arguing that if the governments shutting down servers, the hosting companies, and the enterprises terrified by this vulnerability each gave even $50,000 a year to the PHP Foundation, things could look very different. Daniel echoed this: had there been infinite money and maintainer hours, every theoretical vulnerability might get fixed as a hardening measure. Joe shared how PHP Architect Consulting had its first client patched roughly 30 minutes after the fix went live — thanks to a tip from Marco Pavetta about forking the Docker PHP library repo and building your own base image before the mirrors saturated. He also recounted his own role helping Derick Rethans keep php.net patched before the announcement so the site wouldn’t fall over under load, including one odd bug where the patched version broke Apache directory listing on downloads.php.net. Life as a Release Manager With three release managers now on the team — Daniel, Joe, and Matteo Beccati — the conversation turned to what the role actually involves. Joe explained he wanted to learn more about the process, especially how to make judgment calls on backwards-compatibility breaks, and that lots of discussion happens behind the scenes before and during a release. Daniel noted he’d volunteered to be 8.5’s release manager for this exact week over a year ago, and that the Zoom coordination call was his idea. They dug into an ABI change in the security release that added new fields to the executor globals. The group debated whether that counts as an ABI break — the consensus being it technically is one, but a safe one as long as you’re not mixing newer extensions depending on those fields with older versions in the same branch. Sara and Holly stressed that extensions should never be wholesale copying global blocks in the first place, especially given how differently that memory behaves in threaded versus non-threaded builds. Daniel shared his origin story: just over two years contributing to PHP, starting with a typo fix to a test name after creating a professional GitHub account under Daniel E. Scherzer. Holly and Sara warned him there’s no escaping — Sara sent her first patch 24 years ago and is still here. The bit about “settling for Joe” ran throughout the whole episode. Rust, C, and the Rewrite Temptation Daniel raised the question of rewriting PHP in Rust, pointing out the vulnerability was fundamentally tied to C’s longjmp, which doesn’t exist in Rust. Sara countered that you don’t need a longjmp approach at all — the same behavior could be achieved with C++ exceptions or a Rust mechanism, but it would be a fundamentally different runtime approach. Holly, half-joking, said she’s one sponsor away from pulling a “bun” and throwing hundreds of thousands of AI agents at a hard rewrite of the PHP engine, predicting this is the first of many memory-safety bugs AI agents will surface in the C codebase. Daniel tempered the hype, noting AIs hallucinate and that this being the first of 100,000 reports doesn’t mean there are 100,000 real memory issues. The segment wrapped with Daniel’s recent work building PHP extensions in Rust (he gave a workshop on it at Longhorn), digging into the C macros for globals and how ZTS thread-support mode changes everything. The repeated advice: learn it, experiment on your own fork, but don’t mess with it until you actually understand it — and never hit git push to the public source. Links from the show: PHP Tek 2027 — April 27–29 in Chicago, early bird tickets available PHP Tek CFP — closes end of October 2026 Scherzer.dev — Daniel’s site, blog, timeline write-up, and hire info PHP Foundation — donate to support PHP security work https://phpc.social/@naderman/117485091076355564 Today’s PHP Security Release, and How We’re Strengthening PHP Security Host: Joe Ferguson Mastodon: @joepferguson@phpc.social PHPArch.me: @svpernova09 Sara Golemon Mastodon: @pollita@phpc.social Holly Schilling Mastodon: @TheCodeLorax@tech.lgbt Streams: Youtube Channel Twitch Connect & Hire PHP Architect Website Twitter/X Mastodon Hire PHP Developers Looking to hire PHP developers? Email support@phparch.com – Joe and the team are available for consulting, infrastructure work, Ansible playbooks, and code review. Partner This podcast is made a little better thanks to our partners OurCVEs   Your security posture, on autopilot with OurCVEs     CodeRabbit   Cut code review time & bugs in half instantly with CodeRabbit.   PHP Architect Consulting   PHP Architect provides long-term technical partnerships for organizations that need senior-level PHP expertise that you can depend on. Your PHP codebase deserves a partner, not a contractor. Learn more.   Music Provided by Epidemic Sound https://www.epidemicsound.com/ Join Us Live Next Week Youtube Channel Got feedback? Join us on Discord at discord.php.com The post The PHP Podcast 2026.10.22 appeared first on PHP Architect.

Model defaults, agent skills, and fake assertions

Jake and Michael discuss all the latest Laravel releases, tutorials, and happenings in the community.This episode is sponsored by PostShiba - the transactional email platform that powers Bento's amazing delivery rates. Start your trial at PostShiba.com.Show linksPHP Security Releases Fix Two Critical RCE VulnerabilitiesRoute::query() and Model defaults() in Laravel 13.35Pause Polling in Background Tabs in Inertia.js v3.9Rule Builders for Every Validation Rule in Laravel 13.36Laravel AI SDK 1.1 Adds Agent Skills and Cohere ChatPHP News: A New Site for PHP Releases, RFCs, and PackagesGrant: Enum-Based Roles and Permissions for LaravelSynapse: A Dev Dashboard for Laravel AI SDK AgentsSponsor: PostShibaBashBox: A Sandboxed Bash Interpreter for AI Agents in PHPLaravel URL AI Transformer: Extract Structured Data From URLsTutorialsRunning Laravel's Scheduler on Multiple ServersRun Large PlanetScale Queries in Laravel With DB::olap()Laravel Fake Assertions Now Accept Property ArraysFluent Rule Builders for All Laravel Validation RulesDecide with Jev: Three Questions in One Request with the Laravel AI SDK

Community Corner Podcast: elePHPants with Damien Seguy

   In this episode, Scott talks with Damien Seguy about the history of the elePHPant, from Vincent Pontier’s logo doodle to 6,054 plush toys in Damien’s home, how the community trades them through the Community Postal Service, and what it takes to create your own. Chapters: 00:00 Intro 01:52 How the PHP logo became an elephant 03:53 Turning the logo into a plush toy 05:29 elePHPants for user groups, companies and conferences 07:56 Trading and the Community Postal Service 10:25 The chocolate factory handoff 15:55 How to create your own elePHPant 19:17 Colors, nails and accessories 24:33 Scratchy: elePHPants for small user groups 27:39 Exakat and the PHP onboarding book Links: Our Discord – https://discord.gg/aMTxunVx Buy our shirts – https://store.phparch.com/products/community-corner-podcast-t-shirt Mentioned in this episode: Exakat static analysis engine – https://www.exakat.io/ PHP onboarding book (feedback welcome) – https://thephpbook.readthedocs.io/en/latest Damien’s Links: Bluesky – https://bsky.app/profile/dseguy.bsky.social Mastodon – https://phpc.social/@dseguy GitHub – https://github.com/dseguy Scott’s Links: Website – https://scott.keck-warren.com/ Bluesky – https://bsky.app/profile/scottkeckwarren.bsky.social LinkedIn – https://www.linkedin.com/in/scott-keck-warren-91689810/ Mastodon – https://phpc.social/@scottkeckwarren PHP Architect Social Media: X: https://x.com/phparch Mastodon: https://phparch.social/@phparch Bluesky: https://bsky.app/profile/phparch.com Discord: https://discord.phparch.com Subscribe to our magazine: https://www.phparch.com/subscribe/ Partners This podcast is made a little better thanks to our partners. OurCVEs Your security posture, on autopilot with OurCVEs   CodeRabbit   Cut code review time & bugs in half instantly with CodeRabbit.     PHP Architect Consulting   Your PHP codebase deserves a partner, not a contractor PHP Architect provides long-term technical partnerships for organizations that need senior-level PHP expertise that you can depend on https://www.phparch.com/consulting/ Music provided by Epidemic Sound https://www.epidemicsound.com/ The post Community Corner Podcast: elePHPants with Damien Seguy appeared first on PHP Architect.

154: Ian Laravel New'd Again!

Ian and Aaron talk about Laravel New'ing....again....and what that means for Outro, plus huge updates coming to Solo, Aaron's generative universe, and more.Sponsored by Svix, Maileroo, Bento, PostShiba, and Typesense.Interested in sponsoring Mostly Technical?  Head to https://mostlytechnical.com/sponsor to learn more.(00:00) - Ian's Still Sick (03:59) - Laravel New? (19:49) - Pricing for Outro 2.0 (30:38) - More on Outro 2.0 (37:38) - Solo on Linux (42:54) - Headless Solo (50:15) - GUI Chats? (58:57) - Aaron's Generative Universe (01:23:20) - OpenCode Was Hacked Links:Ian’s tweet about laravel newToken TownOutroSoloOpenCode getting hackedDaybreak BlueYubiKey