The Dev Dispatch — PHP, AI & dev news, four languages, one press

PHP · Releases

Laravel 13.38 tightens consistency across app data

Laravel 13.38.0 adds a session-based two-second fallback to the write connection after a database write and introduces DB::usingWritePdo() for relationship queries that need fresh data. The release accepts floats in Rule::unique() conditions and releases earlier chunks during lazy iteration. Scheduled-job lock cleanup and further Eloquent, SQLite, routing, and queue fixes complete the update.

Medium · Laravel · Oct 22, 2026 curated by Heiko

→ continued: summary & source

PHP · Security

Report attributes two critical PHP flaws to AI research

An October Medium report attributes two alleged critical PHP vulnerabilities, CVE-2026–109618 and CVE-2026–109619, to research involving Wiz and OpenAI’s GPT-5.6 Sol. It claims a 9.2 severity score, unauthenticated remot…

Medium · PHP · Oct 22, 2026 curated by Giselle

PHP · Security

OpenAI’s Codex skills check whether a site exposes a risky PHP version

OpenAI has released a checker for Codex that tests whether a website publicly reveals a PHP version within the affected range. The phpcheck-url skill works from a URL, and phpcheck-server validates the local installation…

Xataka · Oct 21, 2026 curated by Sönke

PHP · Ecosystem

frameworks, tooling & runtime all articles →

PHP · Security

Wazuh rules watch for post-exploitation after critical PHP flaws

PHP’s emergency fixes on October 21, 2026 address CVE-2026-109618 and CVE-2026-109619, two unauthenticated remote-code-execution flaws rated CVSS 9.2. A community Wazuh deployment uses process samplin…

Medium · PHP · Oct 21, 2026 curated by Georg

PHP · RFC Watch

PHP pattern matching debate turns on keys and ints

Kevin Lopez has raised two semantic issues in the draft PHP Pattern Matching RFC. Array patterns should distinguish a missing key from an explicit null and use array_key_exists(). Integer patterns and…

PHP Internals ([RFC]/[VOTE]) · Oct 22, 2026 curated by Sönke

PHP · Security

PHP crisis shows how AI accelerates attacks on known flaws

OpenAI, Google and other AI labs are using frontier models to locate PHP vulnerabilities, build exploits and check proposed fixes. The current crisis involves structural flaws that may enable unauthen…

Xataka · Oct 22, 2026 curated by Sönke

KAI · The Editorial

long-form pieces by Kai — opinion, pushback welcome all articles →

The Editorial

Your PHP Patch Counts Only Once the Old Workers Are Dead

Two PHP flaws rated 9.2 landed on October 21, and the fixed versions are easy to name. The harder question is whether you can prove which binary is answering requests on every vhost, staging box and forgotten container right now. I argue that most of us can't, and that this inventory gap is the real vulnerability we sh…

An editorial by Kai · Oct 23, 2026

AI · The Model Desk

models, agents & local inference all articles →

AI · Security

ConnectWise breach exposed thousands of customer environments

Microsoft says China-aligned hackers used stolen ConnectWise cloud-backup credentials to target about 2,250 organizations. AI agents running the open-source ARTEX framework generated nearly 3,000 logi…

TechCrunch (AI) · Oct 22, 2026 curated by Sönke

AI · Releases

Mistral AI opens public preview for 1.05T-parameter Large 4

Mistral AI opened a public preview of Mistral Large 4 on October 6, 2026. The open-weight multimodal model uses a granular Mixture-of-Experts design with 52 billion active parameters, 1.05 trillion in…

Hacker News (AI, ≥100 P.) · Oct 21, 2026 curated by Sönke

AI · Releases

Anthropic links company stake to new benefit fund

Anthropic plans to place part of its shares in the new Anthropic Public Benefit Fund. The fund has a structure that increases its stake as the company expands. Anthropic published the announcement on …

Anthropic News (Sitemap-Diff) · Oct 20, 2026 curated by Sönke

DEV · Briefs

beyond the elephpant, kept short all articles →

DEV · Security

GitLab ships patches for CVSS-10 remote-code flaw

GitLab has released patches for CE and EE branches 19.5, 19.4, 19.3, 19.2, 19.1, 19.0 and 18.11. The updates fix 12 vulnerabilities, including CVE-2026-110264, …

heise Developer · Oct 22, 2026 curated by Georg

DEV · Security

Node.js v26.12.1 ships with a security focus

The Node.js project has published version v26.12.1 in the 26.x line. The release is marked as a security update. The supplied notice gives no vulnerability iden…

Node.js Releases (dist) · Oct 21, 2026 curated by Sönke

DEV · Security

Security updates land for Node.js 24 and 22 LTS

The Node.js project has published two security releases for its LTS branches: v24.22.1, codenamed Krypton, and v22.23.4, codenamed Jod. The supplied release not…

Node.js Releases (dist) · Oct 20, 2026 curated by Sönke

Conference All conferences →

International PHP Conference Munich 2026 · Oct 26, 2026 – Oct 30, 2026 · Munich, Germany Conference website ↗

+ · The Back Pages

reads, oddities & one from the vault

JOBS · PHP Jobs

live from the Job.bo index — toggle skills, filter by location or remote

IT & Digital Solutions Manager Eyelink Group · Gresik, Jawa Timur
🚀 Mobile Developer Servisin Aja · Klaten, Jawa Tengah
Wissenschaftliche Mitarbeiterin (Postdoc) (w/d/m) Med. Hochschule Hannover · Hannover