Nov 6, 2026

The PHP Podcast 2026.11.05

PHP Podcast – November 5, 2026 Hosts: Eric Van Johnson & Joe Ferguson (John Congdon) Two months, a dozen new stream buttons, and a 6 AM crypto-mining emergency. Eric falls in love with a developer-only social network, the PHP2Shell CVE tests the team, and PHP Tek season kicks off. Welcome to the Boss Level. Back After Two Months — and Everything Is On Fire (Audio-Wise) After nearly two months off the air, Eric and John opened the Boss Level episode the only way they know how: with a full-blown audio meltdown. Eric was on the wrong mic, and as usual, his connection kept cutting in and out while the crew wrestled with a fresh stack of stream widgets, pop-up reactions, and survey overlays nobody fully understood. Once they got the sound working, they reintroduced the show. This is the monthly “Boss Level” episode where the two people behind PHP Architect pull back the curtain on the magazine, the conference, and the consulting business — with a little more candor than usual, since, as Eric put it, John can’t fire him and he can’t fire John. Leaked AWS Keys and a 6 AM Bitcoin-Mining Nightmare John’s week started at 6:10 AM with pager alerts about a Lambda function failing to post to Slack. What looked like a trivial memory leak turned out to be something far worse: a leaked AWS key with permission to spin up instances. An attacker had launched 32x and 64x large machines in every single region to mine Bitcoin. The team rallied — four or five people each terminating instances region by region — and disabled the compromised key before new instances could spawn. Using AI tools to dig through the logs, they discovered the key had first been quietly tested back in September, likely by whoever was selling it to prove it was valid before putting it on the market. Identifying and rectifying took about 20 minutes, but it was not a fun morning. /Dev/Null: A Social Network Built for Developers in a Day Eric gushed about /dev/null, a brand-new developer-centric social network built on Laravel in roughly a day or two by Nuno, Brent, Matthew, and Pauline Voss. Everything about it is geared to developers: the main feed is “the log,” posting is “making a commit,” your VIM bindings work inside it, and sign-up ties directly to your GitHub account to pull in your profile. He’s begging the creators to keep the walled garden intact and not make it easier for the “normies.” He also highlighted a TUI built by Wendell (a Laravel employee and PHP Architect columnist) that mirrors the web app so closely it’s become Eric’s home for DevNull right inside his Tmux setup. That led into a tour of his terminal-centric workflow — one Tmux session per project (a trick from Jess Archer), panes for Claude, nvim, and dev servers, lazygit for commits — and why he quietly retired PHPStorm earlier this year in favor of nvim and the terminal. Pauline, a fantastic conference speaker known for Git talks, has even started livestreaming on Twitch following the build. PHP Tech 2027: Call for Speakers Closed, Evaluation Begins The call for speakers has closed, and talk evaluation is underway. John is changing the process this year so reviewers judge fewer talks at a time — one smaller track took him about three minutes. Anyone in the community, ideally planning to attend, can reach out to John on Discord to get added and help pick what gets presented. You rank three anonymized talks side by side, with the title doing most of the heavy lifting since that’s what attendees see on the website. Eric reminded listeners that submitting multiple talks improves their odds of being selected when narrowing the final list. Speakers with more than one accepted talk get priority since they’re the biggest bang for the buck. This year’s third track rotates: a JavaScript day, a Laravel day, and a DevOps day. John noted it was exactly that deployment knowledge gap that first drew him to PHP Tech back in 2010, when he had no idea how to actually deploy an application. All the details live at phptek.io. The PHP-to-Shell CVE and Why a DevOps Person Matters PHP had a rough couple of weeks due to a major “PHP2shell” CVE. Joe, a release manager for the upcoming PHP 8.6, had sensed something was brewing and started preparing rollout plans before the details dropped. When it hit, the team patched nearly everything across their clients within 24 hours, with only a couple of third-party-dependent servers trailing. Eric and John reflected that after 14 years of running their consulting arm (the DiegoDev Group, now PHP Architect Consulting), finally having a dedicated DevOps person has made the difference between night and day. The fallout rippled outward: NativePHP published a candid write-up about having to issue its first-ever security advisory, since a PHP vulnerability affects anything that compiles PHP into a mobile app. The hosts wondered how projects like NativePHP can get into the “consortium” that receives early patch access alongside the big distros. They also pushed back on the “PHP is dead” crowd — this was a memory bug that has lived in the code for 20 years and affects roughly 70% of the web, but memory bugs happen in every language, from Node to npm. The silver lining: a visible spike in PHP Foundation financial contributions, with Eric clarifying that the Foundation funds internal developers but doesn’t dictate PHP’s direction. Git Workflows, SVN War Stories, and the Specialization of Developers The conversation wandered into deployment history — FTP and rsync in the SVN/CVS days — and Eric’s war stories from a Java/WebSphere enterprise shop where developers had no idea where their apps were even hosted. His takeaway: developers today are extremely specialized, and you shouldn’t be surprised when a brilliant Java dev can’t navigate a command line. Eric defended his fork-based Git workflow: a single clean “upstream” repo that only deploys to servers, with everyone forking into their own private GitHub account and sending back only clean, deployment-ready code, essentially the open-source model. The chat gave him grief, including jabs about failing at Git worktrees, which Eric conceded he understands in principle but finds painful in a PHP workflow with its multiple Composer and npm installs and environment files. Links from the show: PHP Tech 2027 — Call for speakers closed; register now PHP Architect Consulting store.phparch.com — PHP Architect merch & elephants PHP Foundation Office Hours (streamed on our channel) Dev-Null.sh PHP 8.6.0 RC5 available for testing Linux Kernel TCP Flaw PHP 8.6’s soft feature freeze PHP Foundation Community Hour Podcast NativePHP first security advisories Host: Eric Van Johnson /dev/null: @ericvanjohsnon X: @shocm Mastodon: @eric@phparch.social Bluesky: @ericvanjohnson.bsky.social PHPArch.me: @eric John Congdon /dev/null: @johncongdon X: @johncongdon Mastodon: @john@phparch.social Bluesky: @johncongdon.bsky.social PHPArch.me: @john Streams: Youtube Channel Twitch Connect & Hire PHP Architect Website Twitter/X Mastodon Hire PHP Developers Looking to hire PHP developers? Email support@phparch.com – Joe and the team are available for consulting, infrastructure work, Ansible playbooks, and code review. Partner This podcast is made a little better thanks to our partners OurCVEs Your security posture, on autopilot with OurCVEs   CodeRabbit   Cut code review time & bugs in half instantly with CodeRabbit.   PHP Architect Consulting   Your PHP codebase deserves a partner, not a contractor PHP Architect provides long-term technical partnerships for organizations that need senior-level PHP expertise that you can depend on. https://www.phparch.com/consulting/ Music Provided by Epidemic Sound https://www.epidemicsound.com/ Join Us Live Next Week Youtube Channel Got feedback? Join us on Discord at discord.phparch.com The post The PHP Podcast 2026.11.05 appeared first on PHP Architect.

Nov 5, 2026

Laravel Herd 2: Coding Agents, Workspaces, and Cloud Deploys

Laravel Herd 2.0 adds Herd Studio for running coding agents on local sites, git workspaces for parallel work, and Laravel Cloud deploys.

Nov 5, 2026

so JavaScript devs use a SaaS just for auth, lol

If you liked it, a tiny subscribe, like, or comment below would mean the world 🙏 Thanks for watching! ❤️ sponsor this channel: https://nunomaduro.com/sponsorships 🙌🏻 this video was made possible by: 🛠️ jetbrains / code with phpstorm for world-class php development: https://jb.gg/nuno 🔴 redberry / work with the best laravel digital agency: https://redberry.international/?ref=nunomaduro 📱nativephp / build real native mobile apps with laravel: https://nativephp.com/?ref=nunomaduro 🔥 unstoppable / the IDE for your unstoppable agent factory: https://app.unstoppable.ai/code?utm_source=nuno 🐰 coderabbit / ai code reviews with instant feedback on pull requests: https://coderabbit.link/nunomaduro ⚡️ typesense / cutting-edge, in-memory search engine for mere mortals: https://typesense.org/?ref=nunomaduro 🔎 serpapi / instantly access real-time search data from Google, Amazon, and more: https://serpapi.com/?ref=nunomaduro 🗣️ tts at $5 / donations: https://streamlabs.com/nunomaduro/tip ✨ socials: x: https://x.com/enunomaduro website: https://nunomaduro.com twitch: https://twitch.tv/nunomaduro tiktok: https://tiktok.com/@enunomaduro linkedin: https://linkedin.com/in/nunomaduro instagram: https://instagram.com/enunomaduro #laravel #php #ai #claudecode #vibecoding #coding #webdev #programming #linux #omarchy

Nov 5, 2026

Strict Request Input Casting in Laravel

Laravel 13.40 adds a strict flag to the request integer(), boolean(), float(), and string() helpers, so bad input returns your default instead of 0 or an error.

Nov 4, 2026

Laravel October Product Updates

Resend email on Laravel Cloud, QUERY routes in the Laravel framework, and PHP security advisories in Forge. Here's everything that shipped in October.

Nov 4, 2026

in 2026, your junior developer is doing bad code? that's your fault

If you liked it, a tiny subscribe, like, or comment below would mean the world 🙏 Thanks for watching! ❤️ sponsor this channel: https://nunomaduro.com/sponsorships 🙌🏻 this video was made possible by: 🛠️ jetbrains / code with phpstorm for world-class php development: https://jb.gg/nuno 🔴 redberry / work with the best laravel digital agency: https://redberry.international/?ref=nunomaduro 📱nativephp / build real native mobile apps with laravel: https://nativephp.com/?ref=nunomaduro 🔥 unstoppable / the IDE for your unstoppable agent factory: https://app.unstoppable.ai/code?utm_source=nuno 🐰 coderabbit / ai code reviews with instant feedback on pull requests: https://coderabbit.link/nunomaduro ⚡️ typesense / cutting-edge, in-memory search engine for mere mortals: https://typesense.org/?ref=nunomaduro 🔎 serpapi / instantly access real-time search data from Google, Amazon, and more: https://serpapi.com/?ref=nunomaduro 🗣️ tts at $5 / donations: https://streamlabs.com/nunomaduro/tip ✨ socials: x: https://x.com/enunomaduro website: https://nunomaduro.com twitch: https://twitch.tv/nunomaduro tiktok: https://tiktok.com/@enunomaduro linkedin: https://linkedin.com/in/nunomaduro instagram: https://instagram.com/enunomaduro #laravel #php #ai #claudecode #vibecoding #coding #webdev #programming #linux #omarchy

Nov 4, 2026

Post Mortem: Patching the PHP and Node.js Vulnerabilities

How we patched every Laravel Cloud app in place within about 27 hours of the PHP and Node.js disclosures, what broke on Forge, Envoyer, and Vapor, and what we a...

Nov 4, 2026

so the opencode team just released this..

If you liked it, a tiny subscribe, like, or comment below would mean the world 🙏 Thanks for watching! ❤️ sponsor this channel: https://nunomaduro.com/sponsorships 🙌🏻 this video was made possible by: 🛠️ jetbrains / code with phpstorm for world-class php development: https://jb.gg/nuno 🔴 redberry / work with the best laravel digital agency: https://redberry.international/?ref=nunomaduro 📱nativephp / build real native mobile apps with laravel: https://nativephp.com/?ref=nunomaduro 🔥 unstoppable / the IDE for your unstoppable agent factory: https://app.unstoppable.ai/code?utm_source=nuno 🐰 coderabbit / ai code reviews with instant feedback on pull requests: https://coderabbit.link/nunomaduro ⚡️ typesense / cutting-edge, in-memory search engine for mere mortals: https://typesense.org/?ref=nunomaduro 🔎 serpapi / instantly access real-time search data from Google, Amazon, and more: https://serpapi.com/?ref=nunomaduro 🗣️ tts at $5 / donations: https://streamlabs.com/nunomaduro/tip ✨ socials: x: https://x.com/enunomaduro website: https://nunomaduro.com twitch: https://twitch.tv/nunomaduro tiktok: https://tiktok.com/@enunomaduro linkedin: https://linkedin.com/in/nunomaduro instagram: https://instagram.com/enunomaduro #laravel #php #ai #claudecode #vibecoding #coding #webdev #programming #linux #omarchy

Nov 4, 2026

Community Corner Podcast: cakePHP with Jamison Bryant

 In this episode, Scott talks with Jamison Bryant about what sets CakePHP apart from Laravel and Symfony, the plugin ecosystem, and how he moved TicketSauce from CakePHP 2 to 5 with the strangler fig pattern. Links: Our Discord – https://discord.gg/aMTxunVx Buy our shirts – https://store.phparch.com/products/community-corner-podcast-t-shirt Mentioned in this episode: CakePHP – https://cakephp.org/ CakePHP on GitHub – https://github.com/cakephp/cakephp Bake console – https://book.cakephp.org/5/en/bake.html CakePHP plugins directory – https://plugins.cakephp.org/ Awesome CakePHP – https://github.com/FriendsOfCake/awesome-cakephp SwaggerBake plugin – https://github.com/cnizzardini/cakephp-swagger-bake CakePHP Preloader (OPcache) – https://github.com/cnizzardini/cakephp-preloader CakePHP Authentication – https://github.com/cakephp/authentication CakePHP Authorization – https://github.com/cakephp/authorization CakePHP app template – https://github.com/cakephp/app Strangler Fig Application by Martin Fowler – https://martinfowler.com/bliki/StranglerFigApplication.html CakePHP 5.0 migration guide – https://book.cakephp.org/5/en/appendices/5-0-migration-guide.html CakePHP upgrade tool – https://github.com/cakephp/upgrade Rector – https://getrector.org/ Cake Software Foundation – https://cakefoundation.org/ CakeDC – https://www.cakedc.com/ Passbolt – https://www.passbolt.com/ TicketSauce – https://www.ticketsauce.com/ XKCD Dependency – https://xkcd.com/2347/ Longhorn PHP – https://www.longhornphp.com/ php[tek] – https://phptek.io/ I Built a CakePHP Plugin From My iPhone While Packing for a Trip – https://www.phparch.com/article/2026-08-i-built-a-cakephp-plugin-from-my-iphone-while-packing-for-a-trip/ Jamison’s Links: Website – https://jamison.bryant.ai/ Blog (Serious Semicolons) – https://serioussemicolons.wordpress.com/ Mastodon – https://phpc.social/@ssemicolons LinkedIn – https://www.linkedin.com/in/jamisonbryant/ GitHub – https://github.com/jamisonbryant Scott’s Links: Website – https://scott.keck-warren.com/ Bluesky – https://bsky.app/profile/scottkeckwarren.bsky.social LinkedIn – https://www.linkedin.com/in/scott-keck-warren-91689810/ Mastodon – https://phpc.social/@scottkeckwarren PHP Architect Social Media: X: https://x.com/phparch Mastodon: https://phparch.social/@phparch Bluesky: https://bsky.app/profile/phparch.com Discord: https://discord.phparch.com Subscribe to our magazine: https://www.phparch.com/subscribe/ Partners This podcast is made a little better thanks to our partners. OurCVEs Your security posture, on autopilot with OurCVEs   CodeRabbit   Cut code review time & bugs in half instantly with CodeRabbit.     PHP Architect Consulting   Your PHP codebase deserves a partner, not a contractor PHP Architect provides long-term technical partnerships for organizations that need senior-level PHP expertise that you can depend on https://www.phparch.com/consulting/ Music provided by Epidemic Sound https://www.epidemicsound.com/ The post Community Corner Podcast: cakePHP with Jamison Bryant appeared first on PHP Architect.

Nov 4, 2026

The Next Dependency Problem Is Inside Your AI Agent

Managing external dependencies for a software project has become an integral part of the software supply chain. Whether it’s application dependencies with tools like npm, Yarn, Composer, and so on. Or dependencies used by CI/CD workflows with tools like GitHub Actions, we’ve made considerable progress in managing dependencies across these layers.

Nov 3, 2026

Prevent Duplicate File Uploads With Laravel Storage Dedupler

Laravel Storage Dedupler uses SHA-1 hashes to prevent duplicate file storage, attach files to Eloquent models, and analyse existing directories.

Nov 3, 2026

Flock: A Free, Native Herd Alternative for Laravel

Flock is a free, open source local dev app for Laravel that runs PHP, Node, databases, mail, and HTTPS natively on macOS, Windows, and Linux.