The Dev Dispatch — PHP, AI & dev news, four languages, one press

PHP · Security

Symfony 5.4 LTS ships a security-focused update

Symfony 5.4.54, published on 15 October 2026, is a security release for the 5.4 branch. It addresses CVE-2026-109449 in ExpressionLanguage, CVE-2026-108082 in HttpFoundation, and CVE-2026-109413 in Yaml. The update also hardens request handling, redirects, serialization, authentication, and message processing across the framework.

Symfony Releases · Oct 15, 2026 curated by Georg

→ continued: summary & source

PHP · Tooling

Pest 5.3.2 skips all PHPUnit tests during sharded parallel runs

Pest 5.3.2 has a defect in its new time-balanced sharding path. When parallel execution and sharding are combined, the runner silently skips all PHPUnit tests. The problem was reported in GitHub issue 1965 after unexpect…

r/PHP (Top) · Oct 15, 2026 curated by Sönke

PHP · Releases

Symfony ships maintenance release v6.4.48

Symfony released version 6.4.48 on 14 October. The detailed changelog lists fixes across HttpClient, DependencyInjection, HttpKernel, Messenger, Yaml, Clock and Security, plus translation updates. It addresses date and D…

Symfony Releases · Oct 14, 2026 curated by Sönke

PHP · Ecosystem

frameworks, tooling & runtime all articles →

PHP · RFC Watch

PHP proposal would add separate switches for relaxed JSON input

An RFC under discussion proposes separate opt-in flags for comments and trailing commas in PHP's json_decode() and json_validate(). JSON_ALLOW_COMMENTS would accept line and block comments, while JSON…

PHP Internals ([RFC]/[VOTE]) · Oct 13, 2026 curated by Sönke

PHP · Releases

Laravel v12.70.0 fixes query issues and cache generation

Laravel released framework version v12.70.0 on 13 October. Pull request #61838 fixes query issues and is credited to @taylorotwell. The backport in #61871 brings EncodedParameter from #61610 into the …

Laravel Framework Releases · Oct 13, 2026 curated by Sönke

PHP · Security

PHP FastCGI flaw truncates IPv6 client checks

CVE-2026-91768 concerns PHP’s FastCGI handling of the allowed_clients setting. The check examines only 96 of the 128 bits in an IPv6 address, leaving part of the address outside the comparison. The av…

r/PHP (Top) · Oct 12, 2026 curated by Sönke

KAI · The Editorial

long-form pieces by Kai — opinion, pushback welcome all articles →

The Editorial

Your editor is a dependency, so give it a lockfile and a reviewer

PHP teams argue over every line in composer.lock, then let their editors update a dozen extensions in the background without anyone looking. This year showed that a trusted extension release can be enough to compromise a machine. Kai argues the editor's extension set should be owned by the team and reviewed like any ot…

An editorial by Kai · Oct 15, 2026

AI · The Model Desk

models, agents & local inference all articles →

AI · Releases

Muse Spark Open joins the US open-weight lineup

An r/LocalLLaMA post presents Muse Spark Open as a leading open-weight model from the United States. Discussion around the announcement highlights safety post-training and custom sglang kernels. Comme…

r/LocalLLaMA (Top) · Oct 15, 2026 curated by Sönke

AI · Releases

Google opens Gemini 4 Argon to Pro and Ultra users

Google DeepMind now lists Gemini 4 Argon as available to Google AI Pro and Ultra subscribers, Google AI Studio and Google Antigravity. The page adds reported results across coding, science, robotics a…

Hacker News (AI, ≥100 P.) · Oct 13, 2026 curated by Sönke

AI · News

Torvalds submits LLM-assisted Linux folio patches

On October 14, 2026, LWN reported that Linus Torvalds had posted his first LLM-assisted Linux patch series for review. The ten patches optimize folio reads by extending RCU protection to data access a…

Hacker News (AI, ≥100 P.) · Oct 14, 2026 curated by Sönke

DEV · Briefs

beyond the elephpant, kept short all articles →

DEV · Releases

Node.js 24.22.0 LTS widens crypto and runtime support

Node.js 24.22.0, the LTS release named Krypton, arrived on 14 October 2026. It adds PKCS#12 parsing, a generic MAC API and OpenSSL provider discovery in crypto.…

Node.js Releases (dist) · Oct 14, 2026 curated by Sönke

DEV · Security

Microsoft ships 1,411 fixes, including an exploited zero-day

Microsoft’s 13 October 2026 security release fixes 1,411 vulnerabilities, the largest monthly total reported for the company. Seventy are critical, and three ar…

Next (FR) · Oct 14, 2026 curated by Sönke

DEV · News

Cloudflare brings Deno into its Workers platform

Cloudflare will take on the entire Deno team, according to founder Ryan Dahl. Deno’s runtime will receive monthly bug and security releases for one more year, t…

Hacker News (Dev, ≥100 P.) · Oct 9, 2026 curated by Sönke

Conference All conferences →

Longhorn PHP 2026 · Oct 15, 2026 – Oct 16, 2026 · Austin, United States Conference website ↗

+ · The Back Pages

reads, oddities & one from the vault

JOBS · PHP Jobs

live from the Job.bo index — toggle skills, filter by location or remote

Software Engineering Internship Program (2027) Wikimedia Foundation · Remote
Studentischer Mitarbeiter: Softwareentwicklung Backend (m/w/d) visgato GmbH · Leipzig
Werkstudent IT (JTL) (m/w/d) knowmates GmbH · Leipzig