The Dev Dispatch — PHP, AI & dev news, four languages, one press

PHP · RFC Watch

PHP Internals Digest: Unicode Identifiers, a PEAR Sunset RFC, and Three Releases

The weekly PHP internals recap covers a Unicode identifier scan across half a million files, Nick Sdot's RFC to end PEAR endorsement with only Net_SMTP still maintained, a dispute over whether base conversion functions should throw ValueError, and security release PHP 8.4.25.

r/PHP (Top) · Sep 3, 2026 curated by Sönke

→ continued: summary & source

PHP · Releases

Laravel v12.69.0 tightens exception page and cookie authentication

Laravel v12.69.0 disables HTML in exception page tooltips by default and verifies the password hash against the stored cookie before authenticating the user. Both fixes come from contributor Mior Muhammad Zaki (crynobone…

Laravel Framework Releases · Sep 1, 2026 curated by Sönke

PHP · RFC Watch

Robert Landers proposes a nameof() construct for PHP

Robert Landers has opened discussion on a nameof() RFC for PHP. The construct would return the name of a variable, property, method, function or constant as a string, usable anywhere a string literal is allowed, includin…

PHP Internals ([RFC]/[VOTE]) · Sep 1, 2026 curated by Sönke

PHP · Ecosystem

frameworks, tooling & runtime all articles →

PHP · Releases

PHPStreamServer 0.9 ships with dynamic workers and native OS integration via FFI

PHPStreamServer 0.9, the largest update to the PHP-based application server, now requires FFI for native OS APIs, supports dynamically registered workers and scheduled tasks, and ships a hardened Unix…

r/PHP (Top) · Sep 1, 2026 curated by Sönke

PHP · Releases

Laravel 13.17 to 13.27: Native Image Processing, Queue Controls and Masked Query Logs

Laravel shipped eleven minor releases from 13.17 to 13.27 in under three months. Highlights include a first-party Illuminate\Image component, queue:pause --all for stopping every queue at once, a mask…

Medium · Laravel · Aug 31, 2026 curated by Sönke

PHP · Security

Symfony 6.4.45, 7.4.18 and 8.1.6 Close Out a Wave of Security Hardening Fixes

Symfony shipped version 6.4.45 alongside 7.4.18 and 8.1.6, bundling dozens of hardening fixes across HttpClient, HttpFoundation, Security and Mailer/Notifier components. Most changes reject malformed …

Symfony Releases · Aug 30, 2026 curated by Sönke

KAI · The Editorial

long-form pieces by Kai — opinion, pushback welcome all articles →

The Editorial

Set DB_MASK_BINDINGS=true Today, Then Ask Why It Was Ever Off

Laravel 13.27 can finally stop interpolating bound values into QueryException messages, which means your logs, failed_jobs rows and APM traces stop collecting customer data by accident. I say flip the flag in production this week. But an opt-in switch only protects the people who read release notes, and it does nothing…

An editorial by Kai · Sep 2, 2026

AI · The Model Desk

models, agents & local inference all articles →

AI · Security

AISLE reports six curl CVEs days after frontier AI scanners found none

AISLE says its autonomous AI system produced 29 reports on curl, of which six were accepted as CVEs in curl 8.22.0, days after OpenAI Codex Security and Anthropic Mythos reportedly returned zero findi…

Hacker News (AI, ≥100 P.) · Sep 2, 2026 curated by Sönke

AI · Security

Manipulated git configs let AI coding agents run malware on startup

Security firm Manifold found that terminal AI agents from Claude, Qwen, Grok and others execute commands embedded in a repository's git configuration when it is opened. The code runs outside the sandb…

heise Developer · Sep 2, 2026 curated by Sönke

AI · Security

Researcher Bypasses Claude Code Opus 5 Auto Mode With Up to 80% Success

Security researcher wunderwuzzi built a working exploit chain against Claude Code Opus 5's Auto Mode, reaching 60-80% code-execution success in small tests via Python module shadowing. The result cont…

Hacker News (AI, ≥100 P.) · Aug 31, 2026 curated by Sönke

DEV · Briefs

beyond the elephpant, kept short all articles →

DEV · Security

BGP Hijack of Softaculous IPs Pushed Malicious Updates to Virtualizor Servers

Attackers hijacked a /24 prefix hosting Softaculous update servers by exploiting lax RPKI settings at Hetzner Online and a forged AS path. Because Virtualizor u…

Ars Technica · Sep 2, 2026 curated by Sönke

DEV · Releases

pnpm 12 in Rust: Fast Start, npm Packages and No SSH

The pnpm package manager ships version 12 as a complete Rust rewrite. Turborepo benchmarks on Linux show 64 to 90 percent faster installs. The release drops SSH…

heise Developer · Sep 1, 2026 curated by Sönke

DEV · News

How a Mismatched PostgreSQL Index Turned a 40ms Query Into 4 Seconds

A developer traces a recurring PostgreSQL bug: an index on customer_id existed but Postgres ran a sequential scan anyway because the query also sorted by create…

Medium · Software Engineering · Aug 30, 2026 curated by Sönke

Conference All conferences →

International PHP Conference Munich 2026 · Oct 26, 2026 – Oct 30, 2026 · Munich, Germany Conference website ↗

+ · The Back Pages

reads, oddities & one from the vault

JOBS · PHP Jobs

live from the Job.bo index — toggle skills, filter by location or remote

(Senior) E-Commerce Consultant (m/w/d) in Stuttgart, Hamburg oder Berlin – Hybrid Klickpiloten · Stuttgart
Full Stack Engineer (100% Remote United Kingdom) InnoCraft · Remote
Laravel / PHP-Webentwickler (m/w/d) YER · Pinneberg