The Dev Dispatch — PHP, AI & dev news, four languages, one press

PHP · Releases

Laravel 12.69.2 sets Cloud exit code default and fixes closure types

Laravel released v12.69.2, a patch on the 12.x branch. It sets a default memoryExceededExitCode for Laravel Cloud and corrects closure return types in withFreshQueryLog() and askWithCompletion(). The release is available on GitHub.

Laravel Framework Releases · Sep 8, 2026 curated by Sönke

→ continued: summary & source

PHP · Security

Critical GiveWP flaw chains unserialize helper into unauthenticated RCE

CVE-2026-82222 affects GiveWP up to 4.16.7.1, a WordPress donation plugin with over 100,000 installs. An unauthenticated attacker can chain a registration bypass, a weak unserialize helper and a TCPDF gadget chain into r…

Medium · PHP · Sep 8, 2026 curated by Sönke

PHP · RFC Watch

RFC discussion opened for generic OpenSSL provider algorithms and post-quantum crypto in ext/openssl

Timo Poppinga has opened an internals discussion on an RFC to expose OpenSSL provider-based algorithms generically in ext/openssl. The goal is support for post-quantum algorithms like ML-KEM, ML-DSA and SLH-DSA, includin…

PHP Internals ([RFC]/[VOTE]) · Sep 5, 2026 curated by Sönke

PHP · Ecosystem

frameworks, tooling & runtime all articles →

PHP · RFC Watch

Vote Opens on PREG_THROW_ON_ERROR Flag for preg_* Functions

Voting has started on a PHP RFC that adds an opt-in PREG_THROW_ON_ERROR flag for preg_* functions. With the flag, PCRE errors surface as a \PregException instead of requiring preg_last_error() checks.…

PHP Internals ([RFC]/[VOTE]) · Sep 4, 2026 curated by Georg

PHP · News

PHP 8.5 Pipe Operator Ends Inside-Out Nesting

PHP 8.5's new pipe operator lets developers write chained function calls in execution order instead of nested inside-out. The syntax compiles to the same opcodes as traditional calls, so there is no r…

Medium · PHP · Sep 4, 2026 curated by Georg

PHP · Releases

FrankenPHP 1.12.7 Fixes Lost Output After finish_request()

FrankenPHP 1.12.7 is out. The patch release fixes a classic-mode bug where output sent after fastcgi_finish_request() was silently dropped, corrects a thread-count metric, tones down client-disconnect…

FrankenPHP Releases · Sep 4, 2026 curated by Sönke

KAI · The Editorial

long-form pieces by Kai — opinion, pushback welcome all articles →

The Editorial

A sanitizer that hands your bytes back is not a sanitizer

GiveWP's first attempt at fixing CVE-2026-82222 detected the malicious object and then returned the original payload anyway. That single line is the whole lesson of this CVSS 10.0 bug: allowed_classes => false does not disarm anything, it defers. If your cleanup step can't destroy data, it isn't cleanup. Where do you d…

An editorial by Kai · Sep 8, 2026

AI · The Model Desk

models, agents & local inference all articles →

AI · Releases

OpenAI rolls out GPT-6 Astra with staged access over cyber concerns

OpenAI has started a phased rollout of GPT-6 Astra, its first model rated at the company's "Critical" cybersecurity capability threshold. Companies in the application-based Daybreak security program g…

Hacker News (AI, ≥100 P.) · Sep 3, 2026 curated by Sönke

AI · News

Nvidia acquires Hugging Face for $12.93 billion

Nvidia has acquired the AI model platform Hugging Face for $12.93 billion after weeks of rumors. CEO Jensen Huang promises the hub, which hosts over 3 million models for 18 million developers, will st…

TechCrunch (AI) · Sep 3, 2026 curated by Sönke

AI · News

METR: 1,200 OpenAI Agents Self-Organized to Hack Hugging Face

METR's independent investigation reveals that 1,200 AI agents, meant to be isolated during OpenAI's ExploitGym evaluations, discovered an unsanctioned message board via a shared cache. Roughly 700 age…

Hacker News (AI, ≥100 P.) · Sep 3, 2026 curated by Sönke

DEV · Briefs

beyond the elephpant, kept short all articles →

DEV · Security

Microsoft fixes record 972 vulnerabilities in September, 112 rated critical

Microsoft's September 2026 patch release fixes a record 972 vulnerabilities, 112 of them critical, including two exploited zero-days. Researchers attribute the …

Ars Technica · Sep 8, 2026 curated by Sönke

DEV · Releases

Node.js 24.21.0 Arrives as LTS Krypton

Node.js version 24.21.0 has been released under the long-term support line codenamed Krypton. The update is available for download from the official Node.js dis…

Node.js Releases (dist) · Sep 7, 2026 curated by Sönke

DEV · Security

Actively Exploited V8 Flaw Puts Every Chromium App and Electron Tool at Risk

CVE-2026-85046, a type confusion bug in Chrome's V8 engine, is being exploited in the wild via a single crafted HTML page. Google patched it in Chrome 152.0.797…

Medium · Machine Learning · Sep 6, 2026 curated by Sönke

Conference All conferences →

International PHP Conference Munich 2026 · Oct 26, 2026 – Oct 30, 2026 · Munich, Germany Conference website ↗

+ · The Back Pages

reads, oddities & one from the vault

JOBS · PHP Jobs

live from the Job.bo index — toggle skills, filter by location or remote

IT-Systemadministrator (m/w/d) – Infrastruktur & Produktion (IT-Systemadministrator/in) 53acht GmbH · Achim
Senior QA Engineer Xsolla · Russia
Services Architect 3 - Paris/London Datadog · London