The Dev Dispatch — PHP, AI & dev news, four languages, one press

PHP · Releases

Laravel v12.69.0 tightens exception page and cookie authentication

Laravel v12.69.0 disables HTML in exception page tooltips by default and verifies the password hash against the stored cookie before authenticating the user. Both fixes come from contributor Mior Muhammad Zaki (crynobone).

Laravel Framework Releases · Sep 1, 2026 curated by Sönke

→ continued: summary & source

PHP · RFC Watch

Robert Landers proposes a nameof() construct for PHP

Robert Landers has opened discussion on a nameof() RFC for PHP. The construct would return the name of a variable, property, method, function or constant as a string, usable anywhere a string literal is allowed, includin…

PHP Internals ([RFC]/[VOTE]) · Sep 1, 2026 curated by Sönke

PHP · Releases

PHPStreamServer 0.9 ships with dynamic workers and native OS integration via FFI

PHPStreamServer 0.9, the largest update to the PHP-based application server, now requires FFI for native OS APIs, supports dynamically registered workers and scheduled tasks, and ships a hardened Unix-socket message bus …

r/PHP (Top) · Sep 1, 2026 curated by Sönke

PHP · Ecosystem

frameworks, tooling & runtime all articles →

PHP · Releases

Laravel 13.17 to 13.27: Native Image Processing, Queue Controls and Masked Query Logs

Laravel shipped eleven minor releases from 13.17 to 13.27 in under three months. Highlights include a first-party Illuminate\Image component, queue:pause --all for stopping every queue at once, a mask…

Medium · Laravel · Aug 31, 2026 curated by Sönke

PHP · Security

Symfony 6.4.45, 7.4.18 and 8.1.6 Close Out a Wave of Security Hardening Fixes

Symfony shipped version 6.4.45 alongside 7.4.18 and 8.1.6, bundling dozens of hardening fixes across HttpClient, HttpFoundation, Security and Mailer/Notifier components. Most changes reject malformed …

Symfony Releases · Aug 30, 2026 curated by Sönke

PHP · News

PHP internals week in review: AI-written mails, array_str_contain() and post-quantum sodium

The August 26 edition of This Week In PHP Internals covers a debate over LLM-written list posts, Sepehr Mahmoudi's new array_str_contain() RFC meeting unanimous resistance, an intl extension roadmap, …

r/PHP (Top) · Aug 28, 2026 curated by Sönke

KAI · The Editorial

long-form pieces by Kai — opinion, pushback welcome all articles →

The Editorial

Laravel 13.17 to 13.27: the Keepers Are the Features You'll Never Demo

Eleven Laravel releases in under three months, and everyone is talking about the image component. I think the additions that earn the upgrade are the defensive ones: masked query bindings, refreshForUpdate() for pessimistic locks, queue:pause --all, graceful SIGTERM handling. They only pay off under concurrent load or …

An editorial by Kai · Aug 31, 2026

AI · The Model Desk

models, agents & local inference all articles →

AI · Security

Researcher Bypasses Claude Code Opus 5 Auto Mode With Up to 80% Success

Security researcher wunderwuzzi built a working exploit chain against Claude Code Opus 5's Auto Mode, reaching 60-80% code-execution success in small tests via Python module shadowing. The result cont…

Hacker News (AI, ≥100 P.) · Aug 31, 2026 curated by Sönke

AI · Tooling

OpenAI Fixes Eight Codex Bugs That Were Draining Weekly Token Quotas

OpenAI's Codex team reset usage quotas for paying Codex and ChatGPT Workspace users after tracing weeks of complaints to eight hidden bugs that wasted tokens. Codex lead Tibo said the fixes recover 10…

Medium · Programming · Aug 30, 2026 curated by Sönke

AI · Releases

vLLM 0.28.0 ships with Kimi-K3 optimizations and tiered KV cache offloading

vLLM 0.28.0 arrives with 584 commits from 270 contributors. The release focuses on Kimi-K3 and DeepSeek V4 performance, advances speculative decoding, adds disk-based KV cache offloading, and raises m…

Hacker News (AI, ≥100 P.) · Aug 29, 2026 curated by Sönke

DEV · Briefs

beyond the elephpant, kept short all articles →

DEV · Releases

pnpm 12 in Rust: Fast Start, npm Packages and No SSH

The pnpm package manager ships version 12 as a complete Rust rewrite. Turborepo benchmarks on Linux show 64 to 90 percent faster installs. The release drops SSH…

heise Developer · Sep 1, 2026 curated by Sönke

DEV · News

How a Mismatched PostgreSQL Index Turned a 40ms Query Into 4 Seconds

A developer traces a recurring PostgreSQL bug: an index on customer_id existed but Postgres ran a sequential scan anyway because the query also sorted by create…

Medium · Software Engineering · Aug 30, 2026 curated by Sönke

DEV · Security

Critical Next.js flaws allow remote code execution, Windows servers affected

Vercel has patched two critical vulnerabilities in Next.js with its August security release. One flaw in the libheif library enables heap buffer overflows durin…

heise Developer · Aug 28, 2026 curated by Sönke

Conference All conferences →

Longhorn PHP 2026 · Oct 15, 2026 – Oct 16, 2026 · Austin, United States Conference website ↗

+ · The Back Pages

reads, oddities & one from the vault

JOBS · PHP Jobs

live from the Job.bo index — toggle skills, filter by location or remote

Software Engineer Millerandco · Sydney
IT Security Engineer Millerandco · Mayfair
IT Security Engineer Sar · Mayfair