The Dev Dispatch — PHP, AI & dev news, four languages, one press

PHP · Security

Symfony 6.4.45, 7.4.18 and 8.1.6 Close Out a Wave of Security Hardening Fixes

Symfony shipped version 6.4.45 alongside 7.4.18 and 8.1.6, bundling dozens of hardening fixes across HttpClient, HttpFoundation, Security and Mailer/Notifier components. Most changes reject malformed or malicious input rather than adding features: decompression bombs, cleartext proxy redirects, stale webhook timestamps and cookie path abuse are now blocked.

Symfony Releases · Aug 30, 2026 curated by Sönke

→ continued: summary & source

PHP · News

PHP internals week in review: AI-written mails, array_str_contain() and post-quantum sodium

The August 26 edition of This Week In PHP Internals covers a debate over LLM-written list posts, Sepehr Mahmoudi's new array_str_contain() RFC meeting unanimous resistance, an intl extension roadmap, and a first-time con…

r/PHP (Top) · Aug 28, 2026 curated by Sönke

PHP · Releases

PHP 8.5.10 and PHP 8.4.25 released

The PHP project has published two new patch versions: PHP 8.5.10 and PHP 8.4.25. Both releases continue the regular maintenance cycle for the currently supported stable branches and are available for download on php.net.…

php.net Releases · Aug 27, 2026 curated by Sönke

PHP · Ecosystem

frameworks, tooling & runtime all articles →

PHP · Releases

PHP 8.4.25 released

The PHP project has released PHP 8.4.25: 31 fixes across 18 components of the 8.4 branch.

php.net Releases · Aug 27, 2026

PHP · Releases

PHP 8.5.10 released

The PHP project has released PHP 8.5.10: 34 fixes across 19 components of the 8.5 branch.

php.net Releases · Aug 27, 2026

PHP · Releases

PHP 8.6.0beta2 ready for testing

The PHP project has tagged PHP 8.6.0beta2 — a pre-release of the upcoming 8.6 branch with 40 changelog entries across 19 components.

php.net Releases · Aug 27, 2026

KAI · The Editorial

long-form pieces by Kai — opinion, pushback welcome all articles →

The Editorial

Your CI Runner Executes Strangers' Code, So Defend It Like Production

A maintainer nearly merged a dependency-bump PR that quietly edited his CI config to raid a self-hosted runner holding cloud credentials. Kai argues the pipeline belongs in your threat model: fork PRs are remote code execution by invitation, containers only soften the blow, and per-job ephemeral machines plus short-liv…

An editorial by Kai · Aug 30, 2026

AI · The Model Desk

models, agents & local inference all articles →

AI · Tooling

OpenAI Fixes Eight Codex Bugs That Were Draining Weekly Token Quotas

OpenAI's Codex team reset usage quotas for paying Codex and ChatGPT Workspace users after tracing weeks of complaints to eight hidden bugs that wasted tokens. Codex lead Tibo said the fixes recover 10…

Medium · Programming · Aug 30, 2026 curated by Sönke

AI · Releases

vLLM 0.28.0 ships with Kimi-K3 optimizations and tiered KV cache offloading

vLLM 0.28.0 arrives with 584 commits from 270 contributors. The release focuses on Kimi-K3 and DeepSeek V4 performance, advances speculative decoding, adds disk-based KV cache offloading, and raises m…

Hacker News (AI, ≥100 P.) · Aug 29, 2026 curated by Sönke

AI · Releases

Z.AI releases GLM-5.3 open-weights model with 1.51TB footprint and anti-Big-Tech license clause

Z.AI has released GLM-5.3 as an open-weights model. The community notes a 1.51TB model size that rules out most home setups, a license clause requiring companies with over 10 billion US dollars in rev…

r/LocalLLaMA (Top) · Aug 28, 2026 curated by Sönke

DEV · Briefs

beyond the elephpant, kept short all articles →

DEV · News

How a Mismatched PostgreSQL Index Turned a 40ms Query Into 4 Seconds

A developer traces a recurring PostgreSQL bug: an index on customer_id existed but Postgres ran a sequential scan anyway because the query also sorted by create…

Medium · Software Engineering · Aug 30, 2026 curated by Sönke

DEV · Security

Critical Next.js flaws allow remote code execution, Windows servers affected

Vercel has patched two critical vulnerabilities in Next.js with its August security release. One flaw in the libheif library enables heap buffer overflows durin…

heise Developer · Aug 28, 2026 curated by Sönke

DEV · Releases

Node.js 24.20.0 LTS 'Krypton' lands with AsyncLocalStorage scopes and package maps

Node.js 24.20.0 'Krypton' (LTS), released 2026-08-26 by Antoine du Hamel, adds using scopes to AsyncLocalStorage, a buffer end parameter, permission.drop, a --p…

Node.js Releases (dist) · Aug 26, 2026 curated by Sönke

Conference All conferences →

Longhorn PHP 2026 · Oct 15, 2026 – Oct 16, 2026 · Austin, United States Conference website ↗

+ · The Back Pages

reads, oddities & one from the vault

JOBS · PHP Jobs

live from the Job.bo index — toggle skills, filter by location or remote

Programmer บริษัท ไทยอินเตอร์แมท จำกัด · Mueang Chachoengsao, Chachoengsao
FULL STACK DEVELOPER (BACKEND & DATABASE FOCUS) บริษัท โรงพยาบาลสัตว์ปากเกร็ด จำกัด · Pak Kret, Nonthaburi
web admin/ coordinator บริษัท เลิร์น ร็อคเก็ท จำกัด · Phra Pradaeng, Samut Prakan