Wednesday, September 23, 2026 · Vol. I — No. 623
EN

Subscribe in your feed reader — pick your desks:

https://php-net.pro/en/news/feed.atom

php-net.pro · the dev news broadsheet

The Dev Dispatch

“Symfony regexes may loop forever, but Time\Clock still asks first.”

PHP · Security

WordPress 7.1.2 closes a conditional RCE path

WordPress 7.1.2, released on September 22, 2026, fixes CVE-2026–87902, a CVSS 4.0 vulnerability rated 9.2 Critical. An unauthenticated attacker may reach local PHP files through page-template resolution when specific theme and server conditions align. The advisory classifies it as CWE-98 and recommends updates across affected branches. Changing register_argc_argv can reduce one exploitation path while upgrades are pending.

Medium · PHP · Sep 23, 2026 curated by Georg

→ continued: summary & source

PHP · News

PHP 8.5 adds standards-based URI objects

PHP 8.5 adds the URI extension with immutable, standards-based objects for URL and URI handling. Uri\Rfc3986\Uri targets general RFC 3986 identifiers, while Uri\WhatWg\Url follows browser-oriented WHATWG behavior. The AP…

Medium · PHP · Sep 22, 2026 curated by Heiko

PHP · Ecosystem

frameworks, tooling & runtime all articles →
PHP · RFC Watch

PHP RFC advances the next step in its time API

Tim Düsterhus and Derick have proposed Time\Instant and Time\Clock as the next additions to PHP’s new date and time API after Time\Duration in PHP 8.6. The RFC is open well before the next feature fre…

PHP Internals ([RFC]/[VOTE]) · Sep 22, 2026 curated by Heiko

KAI · The Editorial

long-form pieces by Kai — opinion, pushback welcome all articles →
The Editorial

Python 3.15's Lazy Imports Ship Without the Discipline That Made Ours Work

Python 3.15 arrives October 1 with PEP 810's lazy imports, and to a PHP developer it looks like Composer autoloading minus the ecosystem discipline that made autoloading safe. The opt-in keyword is solid and worth using in CLIs. The global all mode defers imports inside libraries that never agreed to it, and that decis…

An editorial by Kai · Sep 14, 2026

AI · The Model Desk

models, agents & local inference all articles →

DEV · Briefs

beyond the elephpant, kept short all articles →
DEV · Releases

Node.js publishes version 26.10.0

Node.js has published version 26.10.0, according to the project’s release page. The available announcement identifies the release and its version but provides n…

Node.js Releases (dist) · Sep 21, 2026 curated by Heiko
Conference All conferences →
International PHP Conference Munich 2026 — Oct 26, 2026 – Oct 30, 2026 · Munich, Germany

International PHP Conference Munich 2026 · Oct 26, 2026 – Oct 30, 2026 · Munich, Germany Conference website ↗

+ · The Back Pages

reads, oddities & one from the vault

JOBS · PHP Jobs

live from the Job.bo index — toggle skills, filter by location or remote

Browse all 1187 PHP jobs → Powered by Job.bo