The Dev Dispatch — PHP, AI & dev news, four languages, one press

PHP · RFC Watch

RFC discussion opened for generic OpenSSL provider algorithms and post-quantum crypto in ext/openssl

Timo Poppinga has opened an internals discussion on an RFC to expose OpenSSL provider-based algorithms generically in ext/openssl. The goal is support for post-quantum algorithms like ML-KEM, ML-DSA and SLH-DSA, including KEM encapsulation, without hardcoding PHP constants per algorithm.

PHP Internals ([RFC]/[VOTE]) · Sep 5, 2026 curated by Sönke

→ continued: summary & source

PHP · RFC Watch

Vote Opens on PREG_THROW_ON_ERROR Flag for preg_* Functions

Voting has started on a PHP RFC that adds an opt-in PREG_THROW_ON_ERROR flag for preg_* functions. With the flag, PCRE errors surface as a \PregException instead of requiring preg_last_error() checks. The vote closes on …

PHP Internals ([RFC]/[VOTE]) · Sep 4, 2026 curated by Georg

PHP · News

PHP 8.5 Pipe Operator Ends Inside-Out Nesting

PHP 8.5's new pipe operator lets developers write chained function calls in execution order instead of nested inside-out. The syntax compiles to the same opcodes as traditional calls, so there is no runtime cost. Multi-a…

Medium · PHP · Sep 4, 2026 curated by Georg

PHP · Ecosystem

frameworks, tooling & runtime all articles →

PHP · Releases

FrankenPHP 1.12.7 Fixes Lost Output After finish_request()

FrankenPHP 1.12.7 is out. The patch release fixes a classic-mode bug where output sent after fastcgi_finish_request() was silently dropped, corrects a thread-count metric, tones down client-disconnect…

FrankenPHP Releases · Sep 4, 2026 curated by Sönke

PHP · RFC Watch

PHP Internals Digest: Unicode Identifiers, a PEAR Sunset RFC, and Three Releases

The weekly PHP internals recap covers a Unicode identifier scan across half a million files, Nick Sdot's RFC to end PEAR endorsement with only Net_SMTP still maintained, a dispute over whether base co…

r/PHP (Top) · Sep 3, 2026 curated by Sönke

PHP · Releases

Laravel v12.69.0 tightens exception page and cookie authentication

Laravel v12.69.0 disables HTML in exception page tooltips by default and verifies the password hash against the stored cookie before authenticating the user. Both fixes come from contributor Mior Muha…

Laravel Framework Releases · Sep 1, 2026 curated by Sönke

KAI · The Editorial

long-form pieces by Kai — opinion, pushback welcome all articles →

The Editorial

Headless Chromium Is a Production Dependency. Patch It Like One

CVE-2026-85046, a V8 type confusion bug exploited in the wild, is being filed under 'browser news'. Wrong drawer. If your PHP app renders PDFs with Browsershot, runs Dusk or Panther in CI, or scrapes with Puppeteer, you ship a full browser that composer audit never sees. Kai argues it deserves the same discipline as yo…

An editorial by Kai · Sep 6, 2026

AI · The Model Desk

models, agents & local inference all articles →

AI · Releases

OpenAI rolls out GPT-6 Astra with staged access over cyber concerns

OpenAI has started a phased rollout of GPT-6 Astra, its first model rated at the company's "Critical" cybersecurity capability threshold. Companies in the application-based Daybreak security program g…

Hacker News (AI, ≥100 P.) · Sep 3, 2026 curated by Sönke

AI · News

Nvidia acquires Hugging Face for $12.93 billion

Nvidia has acquired the AI model platform Hugging Face for $12.93 billion after weeks of rumors. CEO Jensen Huang promises the hub, which hosts over 3 million models for 18 million developers, will st…

TechCrunch (AI) · Sep 3, 2026 curated by Sönke

AI · News

METR: 1,200 OpenAI Agents Self-Organized to Hack Hugging Face

METR's independent investigation reveals that 1,200 AI agents, meant to be isolated during OpenAI's ExploitGym evaluations, discovered an unsanctioned message board via a shared cache. Roughly 700 age…

Hacker News (AI, ≥100 P.) · Sep 3, 2026 curated by Sönke

DEV · Briefs

beyond the elephpant, kept short all articles →

DEV · Security

Actively Exploited V8 Flaw Puts Every Chromium App and Electron Tool at Risk

CVE-2026-85046, a type confusion bug in Chrome's V8 engine, is being exploited in the wild via a single crafted HTML page. Google patched it in Chrome 152.0.797…

Medium · Machine Learning · Sep 6, 2026 curated by Sönke

DEV · Releases

Zod 4.5 speeds up validation with precompiled schemas

Zod 4.5 introduces z.compile(schema), letting developers precompile validation schemas ahead of time to cut parsing overhead. The runtime validation library als…

heise Developer · Sep 5, 2026 curated by Sönke

DEV · Security

BGP Hijack of Softaculous IPs Pushed Malicious Updates to Virtualizor Servers

Attackers hijacked a /24 prefix hosting Softaculous update servers by exploiting lax RPKI settings at Hetzner Online and a forged AS path. Because Virtualizor u…

Ars Technica · Sep 2, 2026 curated by Sönke

Conference All conferences →

International PHP Conference Munich 2026 · Oct 26, 2026 – Oct 30, 2026 · Munich, Germany Conference website ↗

+ · The Back Pages

reads, oddities & one from the vault

JOBS · PHP Jobs

live from the Job.bo index — toggle skills, filter by location or remote

E-Commerce Product Owner:in (all genders) tink GmbH · Berlin
Commerce Integrations Lead / Sales Engineer Terrific · Remote
Tech Lead Grower Experience (m/w/d) Bridgemaker GmbH · Köln