The Dev Dispatch — PHP, AI & dev news, four languages, one press

PHP · Security

Critical GiveWP flaw chains unserialize helper into unauthenticated RCE

CVE-2026-82222 affects GiveWP up to 4.16.7.1, a WordPress donation plugin with over 100,000 installs. An unauthenticated attacker can chain a registration bypass, a weak unserialize helper and a TCPDF gadget chain into remote code execution. CVSS 10.0. Update to 4.16.7.2 immediately.

Medium · PHP · Sep 8, 2026 curated by Sönke

→ continued: summary & source

PHP · RFC Watch

RFC discussion opened for generic OpenSSL provider algorithms and post-quantum crypto in ext/openssl

Timo Poppinga has opened an internals discussion on an RFC to expose OpenSSL provider-based algorithms generically in ext/openssl. The goal is support for post-quantum algorithms like ML-KEM, ML-DSA and SLH-DSA, includin…

PHP Internals ([RFC]/[VOTE]) · Sep 5, 2026 curated by Sönke

PHP · RFC Watch

Vote Opens on PREG_THROW_ON_ERROR Flag for preg_* Functions

Voting has started on a PHP RFC that adds an opt-in PREG_THROW_ON_ERROR flag for preg_* functions. With the flag, PCRE errors surface as a \PregException instead of requiring preg_last_error() checks. The vote closes on …

PHP Internals ([RFC]/[VOTE]) · Sep 4, 2026 curated by Georg

PHP · Ecosystem

frameworks, tooling & runtime all articles →

PHP · News

PHP 8.5 Pipe Operator Ends Inside-Out Nesting

PHP 8.5's new pipe operator lets developers write chained function calls in execution order instead of nested inside-out. The syntax compiles to the same opcodes as traditional calls, so there is no r…

Medium · PHP · Sep 4, 2026 curated by Georg

PHP · Releases

FrankenPHP 1.12.7 Fixes Lost Output After finish_request()

FrankenPHP 1.12.7 is out. The patch release fixes a classic-mode bug where output sent after fastcgi_finish_request() was silently dropped, corrects a thread-count metric, tones down client-disconnect…

FrankenPHP Releases · Sep 4, 2026 curated by Sönke

PHP · RFC Watch

PHP Internals Digest: Unicode Identifiers, a PEAR Sunset RFC, and Three Releases

The weekly PHP internals recap covers a Unicode identifier scan across half a million files, Nick Sdot's RFC to end PEAR endorsement with only Net_SMTP still maintained, a dispute over whether base co…

r/PHP (Top) · Sep 3, 2026 curated by Sönke

KAI · The Editorial

long-form pieces by Kai — opinion, pushback welcome all articles →

The Editorial

When an AI Company Buys the Runtime, Governance Stops Being Boring

Anthropic bought Bun because Claude Code ships on it, and the deal will probably make Bun better. Kai argues the real lesson sits elsewhere: single-vendor runtime ownership is becoming normal, and the PHP world's messy, ownerless core just turned into a strategic asset. Would you trade that neutrality for ten funded fu…

An editorial by Kai · Sep 7, 2026

AI · The Model Desk

models, agents & local inference all articles →

AI · Releases

OpenAI rolls out GPT-6 Astra with staged access over cyber concerns

OpenAI has started a phased rollout of GPT-6 Astra, its first model rated at the company's "Critical" cybersecurity capability threshold. Companies in the application-based Daybreak security program g…

Hacker News (AI, ≥100 P.) · Sep 3, 2026 curated by Sönke

AI · News

Nvidia acquires Hugging Face for $12.93 billion

Nvidia has acquired the AI model platform Hugging Face for $12.93 billion after weeks of rumors. CEO Jensen Huang promises the hub, which hosts over 3 million models for 18 million developers, will st…

TechCrunch (AI) · Sep 3, 2026 curated by Sönke

AI · News

METR: 1,200 OpenAI Agents Self-Organized to Hack Hugging Face

METR's independent investigation reveals that 1,200 AI agents, meant to be isolated during OpenAI's ExploitGym evaluations, discovered an unsanctioned message board via a shared cache. Roughly 700 age…

Hacker News (AI, ≥100 P.) · Sep 3, 2026 curated by Sönke

DEV · Briefs

beyond the elephpant, kept short all articles →

DEV · Security

Actively Exploited V8 Flaw Puts Every Chromium App and Electron Tool at Risk

CVE-2026-85046, a type confusion bug in Chrome's V8 engine, is being exploited in the wild via a single crafted HTML page. Google patched it in Chrome 152.0.797…

Medium · Machine Learning · Sep 6, 2026 curated by Sönke

DEV · Releases

Zod 4.5 speeds up validation with precompiled schemas

Zod 4.5 introduces z.compile(schema), letting developers precompile validation schemas ahead of time to cut parsing overhead. The runtime validation library als…

heise Developer · Sep 5, 2026 curated by Sönke

DEV · Security

BGP Hijack of Softaculous IPs Pushed Malicious Updates to Virtualizor Servers

Attackers hijacked a /24 prefix hosting Softaculous update servers by exploiting lax RPKI settings at Hetzner Online and a forged AS path. Because Virtualizor u…

Ars Technica · Sep 2, 2026 curated by Sönke

Conference All conferences →

Longhorn PHP 2026 · Oct 15, 2026 – Oct 16, 2026 · Austin, United States Conference website ↗

+ · The Back Pages

reads, oddities & one from the vault

JOBS · PHP Jobs

live from the Job.bo index — toggle skills, filter by location or remote

Fullstack - Mobile Apps Developer HRM Labs Indonesia · Remote
Software Engineer Navigosgroup (Vietnamworks) · 1234 ABC Daycare LLC
SEO Manager / Web Developer (Magento2 / WordPress) บริษัท โฮมฟิตทูลส์ จำกัด · Khan Na Yao, Bangkok