The Dev Dispatch

PHP · Releases

PHP 8.6.0RC5 ready for testing

The PHP project has tagged PHP 8.6.0RC5 — a pre-release of the upcoming 8.6 branch with 103 changelog entries across 34 components.

php.net Releases · Nov 5, 2026

→ continued: summary & source

PHP · Releases

Laravel 13.38 tightens consistency across app data

Laravel 13.38.0 adds a session-based two-second fallback to the write connection after a database write and introduces DB::usingWritePdo() for relationship queries that need fresh data. The release accepts floats in Rule…

Medium · Laravel · Oct 22, 2026 curated by Heiko

PHP · Security

Report attributes two critical PHP flaws to AI research

An October Medium report attributes two alleged critical PHP vulnerabilities, CVE-2026–109618 and CVE-2026–109619, to research involving Wiz and OpenAI’s GPT-5.6 Sol. It claims a 9.2 severity score, unauthenticated remot…

Medium · PHP · Oct 22, 2026 curated by Giselle

PHP · Ecosystem

frameworks, tooling & runtime all articles →

PHP · Security

OpenAI’s Codex skills check whether a site exposes a risky PHP version

OpenAI has released a checker for Codex that tests whether a website publicly reveals a PHP version within the affected range. The phpcheck-url skill works from a URL, and phpcheck-server validates th…

Xataka · Oct 21, 2026 curated by Sönke

PHP · Security

Wazuh rules watch for post-exploitation after critical PHP flaws

PHP’s emergency fixes on October 21, 2026 address CVE-2026-109618 and CVE-2026-109619, two unauthenticated remote-code-execution flaws rated CVSS 9.2. A community Wazuh deployment uses process samplin…

Medium · PHP · Oct 21, 2026 curated by Georg

PHP · RFC Watch

PHP pattern matching debate turns on keys and ints

Kevin Lopez has raised two semantic issues in the draft PHP Pattern Matching RFC. Array patterns should distinguish a missing key from an explicit null and use array_key_exists(). Integer patterns and…

PHP Internals ([RFC]/[VOTE]) · Oct 22, 2026 curated by Sönke

KAI · The Editorial

long-form pieces by Kai — opinion, pushback welcome all articles →

The Editorial

An AI Found the PHP Bug, but Our Upgrade Debt Is the Real Exposure

Everyone is talking about the model that found CVE-2026-109618 and CVE-2026-109619. The more uncomfortable number is that Cisco puts about half of internet-facing PHP on versions that no longer get security fixes. AI made discovery cheap. Deployment is still slow, and nobody can hand that part off to a model.

An editorial by Kai · Nov 6, 2026

AI · The Model Desk

models, agents & local inference all articles →

AI · Security

ConnectWise breach exposed thousands of customer environments

Microsoft says China-aligned hackers used stolen ConnectWise cloud-backup credentials to target about 2,250 organizations. AI agents running the open-source ARTEX framework generated nearly 3,000 logi…

TechCrunch (AI) · Oct 22, 2026 curated by Sönke

AI · Releases

Mistral AI opens public preview for 1.05T-parameter Large 4

Mistral AI opened a public preview of Mistral Large 4 on October 6, 2026. The open-weight multimodal model uses a granular Mixture-of-Experts design with 52 billion active parameters, 1.05 trillion in…

Hacker News (AI, ≥100 P.) · Oct 21, 2026 curated by Sönke

AI · Releases

Anthropic links company stake to new benefit fund

Anthropic plans to place part of its shares in the new Anthropic Public Benefit Fund. The fund has a structure that increases its stake as the company expands. Anthropic published the announcement on …

Anthropic News (Sitemap-Diff) · Oct 20, 2026 curated by Sönke

DEV · Briefs

beyond the elephpant, kept short all articles →

DEV · Security

GitLab ships patches for CVSS-10 remote-code flaw

GitLab has released patches for CE and EE branches 19.5, 19.4, 19.3, 19.2, 19.1, 19.0 and 18.11. The updates fix 12 vulnerabilities, including CVE-2026-110264, …

heise Developer · Oct 22, 2026 curated by Georg

DEV · Security

Node.js v26.12.1 ships with a security focus

The Node.js project has published version v26.12.1 in the 26.x line. The release is marked as a security update. The supplied notice gives no vulnerability iden…

Node.js Releases (dist) · Oct 21, 2026 curated by Sönke

DEV · Security

Senior Sales Engineer - Public Sector (UK) Datadog · London
Senior Partner Solutions Architect (Pan-EMEA GSI) Datadog · Remote
Fullstack Developer · Zuidoost-Noord-Brabant

PHP 8.6.0RC5 ready for testing

Laravel 13.38 tightens consistency across app data

Report attributes two critical PHP flaws to AI research

PHP · Ecosystem

OpenAI’s Codex skills check whether a site exposes a risky PHP version

Wazuh rules watch for post-exploitation after critical PHP flaws

PHP pattern matching debate turns on keys and ints

KAI · The Editorial

An AI Found the PHP Bug, but Our Upgrade Debt Is the Real Exposure

AI · The Model Desk

ConnectWise breach exposed thousands of customer environments

Mistral AI opens public preview for 1.05T-parameter Large 4

Anthropic links company stake to new benefit fund

DEV · Briefs

GitLab ships patches for CVSS-10 remote-code flaw

Node.js v26.12.1 ships with a security focus

Security updates land for Node.js 24 and 22 LTS

+ · The Back Pages

JOBS · PHP Jobs