The Dev Dispatch — PHP, AI & dev news, four languages, one press

PHP · Security

Two critical PHP vulnerability disclosures expected on 22 October

A Hacker News post reports an expected PHP announcement on 22 October 2026 at 18:00 CEST covering two remote-code-execution vulnerabilities with CVSS 10.0 ratings. It names CVE-2026-109618 and CVE-2026-109619. The author provides no corroborating evidence. Thread comments attribute the issue to PHP core and say fixes may be limited to PHP 8.

Hacker News (PHP, ≥15 P.) · Oct 20, 2026 curated by Sönke

→ continued: summary & source

PHP · Security

CVE-2026-108082 raises a Symfony CPU-exhaustion alert

A post in r/PHP identifies CVE-2026-108082 as a Symfony regular-expression denial-of-service issue. It claims that a single request can consume CPU for several seconds. The excerpt names no affected Symfony versions or f…

r/PHP (Top) · Oct 20, 2026 curated by Sönke

PHP · Releases

Laravel 13.38.0 updates query, queue and cache internals

Laravel 13.38.0, released on 20 October 2026, is a maintenance update for the 13.x branch. It adjusts validation, Eloquent relations, database queries, queues, notifications, logging, caching and lazy collections. The re…

Laravel Framework Releases · Oct 20, 2026 curated by Sönke

PHP · Ecosystem

frameworks, tooling & runtime all articles →

PHP · Releases

RoadRunner 3 brings SemVer back to PHP infrastructure

RoadRunner 3 is available with a return to Semantic Versioning and a shared roadrunner/* package namespace. The release targets PHP 8.2 and newer, adds several HTTP, jobs, proxy, Redis and gRPC capabi…

r/PHP (Top) · Oct 19, 2026 curated by Sönke

PHP · Security

Symfony patches four branches as UX 3.6 arrives

Symfony’s roundup for October 12 to 18, 2026 reports maintenance work across four release branches and security fixes in Yaml and HttpFoundation. Symfony UX 3.6 adds experimental tools, while the proj…

Medium · Laravel · Oct 19, 2026 curated by Sönke

PHP · Releases

Laravel 13.36 expands validation APIs and tunes queues

Laravel 13.36, released in October 2026, adds fluent builders for more validation rules and introduces DB::olap() for analytical work on compatible Vitess systems such as PlanetScale. It also changes …

Medium · Laravel · Oct 19, 2026 curated by Sönke

KAI · The Editorial

long-form pieces by Kai — opinion, pushback welcome all articles →

The Editorial

If you ship Laravel, Symfony's patch notes are your release notes too

Symfony 6.4 has reached its 48th patch release, and this week's batch fixed security issues in Yaml and HttpFoundation along with a timezone bug in Clock. Laravel teams usually wait for their own framework to tell them something changed. Kai argues you should read the upstream changelog yourself and patch on Symfony's …

An editorial by Kai · Oct 20, 2026

AI · The Model Desk

models, agents & local inference all articles →

AI · Releases

Anthropic links company stake to new benefit fund

Anthropic plans to place part of its shares in the new Anthropic Public Benefit Fund. The fund has a structure that increases its stake as the company expands. Anthropic published the announcement on …

Anthropic News (Sitemap-Diff) · Oct 20, 2026 curated by Sönke

AI · Releases

DeepSeek publishes DeepInfer for large-scale model serving

DeepSeek has published DeepInfer, an Apache-2.0 inference framework for large-scale DeepSeek deployments. The initial release targets DeepSeek-V4.1-Flash and runs on NVIDIA SM100 GPUs or Huawei Ascend…

Hacker News (AI, ≥100 P.) · Oct 20, 2026 curated by Sönke

AI · Security

OpenCode cloud users urged to rotate provider credentials

Users in r/LocalLLaMA are warning OpenCode Console customers about a reported compromise involving third-party provider API keys. Comments point to the hosted service, while local model use appears ou…

r/LocalLLaMA (Top) · Oct 17, 2026 curated by Sönke

DEV · Briefs

beyond the elephpant, kept short all articles →

DEV · Releases

TypeScript 7.1 beta build is now available

TypeScript 7.1 has reached a beta release in the microsoft/TypeScript repository. GitHub lists the build as v7.1-beta. jakebailey published it on 20 October at …

TypeScript Releases · Oct 20, 2026 curated by Sönke

DEV · Releases

Node.js 24.22.0 LTS widens crypto and runtime support

Node.js 24.22.0, the LTS release named Krypton, arrived on 14 October 2026. It adds PKCS#12 parsing, a generic MAC API and OpenSSL provider discovery in crypto.…

Node.js Releases (dist) · Oct 14, 2026 curated by Sönke

DEV · Security

Microsoft ships 1,411 fixes, including an exploited zero-day

Microsoft’s 13 October 2026 security release fixes 1,411 vulnerabilities, the largest monthly total reported for the company. Seventy are critical, and three ar…

Next (FR) · Oct 14, 2026 curated by Sönke

Conference All conferences →

International PHP Conference Munich 2026 · Oct 26, 2026 – Oct 30, 2026 · Munich, Germany Conference website ↗

+ · The Back Pages

reads, oddities & one from the vault

JOBS · PHP Jobs

live from the Job.bo index — toggle skills, filter by location or remote

Senior Backend API Engineer Odaseva · Paris
PROGRAMER/PROGRAMERKA SENIOR HELIOZ TECHNOLOGIES d.o.o. · Slavonski Brod, Hrvatska
MOTIVA I ESPECIALISTA DE SOLUÇÕES Motiva · São Paulo, São Paulo