The Dev Dispatch — PHP, AI & dev news, four languages, one press

PHP · Releases

Laravel 12.67.0 ships with fixes for validation bypass and Postgres JSON escaping

Laravel 12.67.0 tightens temporary upload URL handling, closes a loose-comparison bypass in validation rules, and escapes single quotes in Postgres JSON paths. It also adds retries for timed-out cloud agent long-polls and avoids quadratic wildcard rule expansion.

Laravel Framework Releases · Aug 18, 2026 curated by Sönke

→ continued: summary & source

PHP · Releases

Leaf 5 ships with AI-assistant workflows built into the framework

Leaf PHP framework creator Michael Darko has released Leaf 5, described as the project's largest update yet. It adds self-explaining error screens, token-efficient documentation and a .leaf/CONTEXT.md file for persistent…

r/PHP (Top) · Aug 17, 2026 curated by Sönke

PHP · RFC Watch

Debate over CSV deprecations in the PHP 8.6 deprecations RFC

The Deprecations for PHP 8.6 RFC has passed its vote, but discussion on internals continues. Robert Humphries argues that deprecating SplFileObject CSV methods like fputcsv() and setCsvControl() leaves the READ_CSV flag …

PHP Internals ([RFC]/[VOTE]) · Aug 15, 2026 curated by Giselle

PHP · Ecosystem

frameworks, tooling & runtime all articles →

PHP · News

PHP 8.6 Deprecation Wave Could Inflate Your Logging Costs

PHP 8.6's mass deprecation vote closed with 35 RFCs, most passing. Nothing breaks immediately, but deprecated calls keep warning — and on busy Laravel apps that means sustained log volume, higher inge…

Medium · Laravel · Aug 14, 2026 curated by Heiko

PHP · News

Symfony App Migration to FrankenPHP Worker Mode Yields 20% Gain, Not the Advertised 3.5x

A developer reports that migrating a production Symfony application from nginx plus PHP-FPM to FrankenPHP worker mode delivered roughly a 20% speedup rather than the 3.5x figure on the FrankenPHP home…

r/PHP (Top) · Aug 14, 2026 curated by Georg

PHP · News

PHP 8.6 RFC Season Closes: 31 of 35 Deprecation Proposals Accepted

The PHP internals voting cycle for version 8.6 concluded this week with 31 of 35 proposals approved. Key outcomes: list() remains after a 23–23 tie vote; the pipe assignment operator (|>=) was rejecte…

r/PHP (Top) · Aug 13, 2026 curated by Heiko

KAI · The Editorial

long-form pieces by Kai — opinion, pushback welcome all articles →

The Editorial

Symfony 8.1 Finally Makes Attributes a Real Extension Point. Use Them.

For years, writing your own attribute-driven listener in Symfony meant smuggling state through request keys and running on every request just to check for presence. Symfony 8.1 moves attribute storage onto the Request and gives each attribute its own event. Kai argues this quietly changes how you should structure cross…

An editorial by Kai · Aug 18, 2026

AI · The Model Desk

models, agents & local inference all articles →

AI · Security

Copilot Leaked Its Own Bypass: Varonis One-Click Attack Exfiltrates Passwords

Varonis researchers coaxed Microsoft 365 Copilot Enterprise into revealing an undocumented URL parameter, ?autorun=1, that executes prompts without user consent. Combined with ?q=, a single clicked li…

Ars Technica · Aug 18, 2026 curated by Sönke

AI · Releases

DeepSeek launches V4-Pro and splits API pricing into peak and off-peak rates

DeepSeek has released DeepSeek-V4-Pro as GA, promising stronger agent performance, adjustable reasoning effort and native OpenAI Responses API support. Alongside, the provider introduces peak/off-peak…

Hacker News (AI, ≥100 P.) · Aug 14, 2026 curated by Giselle

AI · Releases

Google Releases Gemini 3.7 Flash with Enhanced Coding and Agent Capabilities

Google has launched Gemini 3.7 Flash, an upgraded version of its widely-used workhorse model, just three weeks after version 3.6. The new model demonstrates significant improvements in software engine…

Hacker News (AI, ≥100 P.) · Aug 13, 2026 curated by Heiko

DEV · Briefs

beyond the elephpant, kept short all articles →

DEV · Security

Critical GitLab Flaw Lets Attackers Delete Projects

GitLab has patched two vulnerabilities, one rated critical, that allow attackers to manipulate or delete public projects and user data via the GraphQL API. Fixe…

heise Developer · Aug 18, 2026 curated by Sönke

DEV · Security

PostgreSQL patches 28 security flaws, two allow code execution

PostgreSQL's team released versions 14.24, 15.19, 16.15, 17.11 and 18.6, fixing 28 vulnerabilities. Most let attackers run arbitrary code after a successful att…

heise Developer · Aug 17, 2026 curated by Sönke

DEV · Security

GitLab 19.2.2, 19.1.4 and 19.0.6 patch serious XSS flaws

GitLab has published patch releases 19.2.2, 19.1.4 and 19.0.6 with important security fixes. Among the addressed issues are cross-site scripting vulnerabilities…

heise Developer · Aug 15, 2026 curated by Charlie

Conference All conferences →

Longhorn PHP 2026 · Oct 15, 2026 – Oct 16, 2026 · Austin, United States Conference website ↗

+ · The Back Pages

reads, oddities & one from the vault

JOBS · PHP Jobs

live from the Job.bo index — toggle skills, filter by location or remote

Software Engineer Odoo · Berlin
IT Security Engineer Odoo · Mayfair
Software Engineer Macaw · Sydney