The php2shell exploits leave nothing in your logs. You only see what the attacker does next, which means detection depends on www-data almost never doing anything interesting. That's a design choice we can make right now…
The PHP2Shell fixes shipped on October 21, and plenty of teams still can't say which PHP binary answered their last request. Kai argues that the interpreter is your most important dependency and deserves the same treatme…
When PHP2Shell landed, the PHP project shipped emergency source patches for 7.4, 8.0 and 8.1, branches it had already retired. Be grateful, then read the gesture correctly. Your next critical CVE will be decided by how r…
The PHP project announced the critical fixes for CVE-2026-109618 and CVE-2026-109619 ahead of time, gave a date and a UTC hour, and held back the details. That was a fair deal. The trouble is that a lot of teams spent th…
CVE-2026-110264 is an integer overflow in Onigmo that an anonymous visitor can reach through GitLab's Org-mode renderer. Patch today, obviously. The harder lesson is about defaults: every format a server renders for stra…
Two critical PHP core flaws, CVE-2026-109618 and CVE-2026-109619, got patches only for 8.2 through 8.5. That leaves the 7.4, 8.0 and 8.1 crowd hardening config files against a bug that fires before any of their code runs…
October 21 gave us a Laravel token guard bypass and two PHP flaws rated CVSS 9.2 on the same afternoon. Eight days on, the teams that shipped fast didn't care more than anyone else. They had a test suite they trusted and…
The fix for the session.upload_progress memory bug was scheduled for 21 October, and most teams will upgrade and forget. That's the wrong ending. A default almost nobody uses turned into a critical exposure on stock PHP …
Two CVSS 9.2 flaws in the PHP engine, fixed in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and no complete workaround. The upgrade takes minutes. What most teams actually lack is a reliable list of every PHP process answering the…
Two unauthenticated remote code execution bugs in the PHP runtime, CVE-2026-109618 and CVE-2026-109619, showed up on October 21, and suddenly lots of teams had no quick answer to a simple question: which binary is actual…
Two PHP flaws rated 9.2 landed on October 21, and the fixed versions are easy to name. The harder question is whether you can prove which binary is answering requests on every vhost, staging box and forgotten container r…
Two 9.2-rated engine bugs, fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, hit servers whose application code was spotless. Kai argues the fix is cultural: application teams should pin and ship the interpreter the way th…
Symfony 6.4 has reached its 48th patch release, and this week's batch fixed security issues in Yaml and HttpFoundation along with a timezone bug in Clock. Laravel teams usually wait for their own framework to tell them s…
The RFC that deprecated PECL broke nothing and set no deadline, so most of us will leave pecl install where it is. I think that's the wrong move. The gaps in PIE are real but small, and every Dockerfile that switches ear…
mir, a Rust analyzer that reads psalm.xml, baselines and @psalm-* tags, checks Laravel and Symfony in about two seconds where Psalm takes close to a minute. The speed is the headline. The bigger story is that PHP's docbl…
Reflection's Beam arrives with 501B parameters, an Apache 2.0 license and SWE-Bench numbers that will fill every slide deck this month. The detail I care about is smaller: a reasoning-effort setting you can turn down. Mo…
Google, OpenAI and Anthropic all landed a strong model at $2 in and $10 out per million tokens within days of each other. Kai argues that this ends price as the deciding factor. The PHP code worth writing now is a thin p…
PHP teams argue over every line in composer.lock, then let their editors update a dozen extensions in the background without anyone looking. This year showed that a trusted extension release can be enough to compromise a…
PyTorch 2.14 ships faster Mac kernels, a new GEMM backend and fault-tolerant distributed training. The change I keep thinking about is smaller: torch.compile on Python 3.15 now refuses to run instead of quietly running s…
Route::query() will get the attention, but the important change in Laravel 13.35 is quieter. Schedule::alwaysOnOneServer() and global strict form requests let one line of config replace a rule you had to remember on ever…
PHP 8.6 keeps choosing a thrown error over a polite guess, and I think that is the best thing in the release. There is one exception: partial function application captures its arguments when it is created, and nothing wa…
Almost a year after PHP 8.5 shipped, everyone still talks about |>. I think the feature that will save you the most grief is the new URI extension, which finally parses URLs to RFC 3986 and WHATWG. Pipes make code pretti…
Mistral Large 4 scores 38 on the Artificial Analysis index. That puts it level with a model that costs a sixteenth as much per task, and Mistral's own platform hosts a stronger rival. Kai argues this is the best reason y…
Laravel 13.35 ships Route::query(), giving the brand new HTTP QUERY method a first-class seat in the router. I think new filter-heavy endpoints should use it right away, not someday. Yes, your proxies, CDN and CORS setup…
Everyone is quoting the VS Code build dropping from 77.8 seconds to 7.5. I care more about what shipped without it: a stable programmatic API. For PHP, whose static analysis lives on its plugin ecosystems, that gap matte…
Symfony 8.2 hands configuration back to the components: 29 new bundles, each with its own config root, and the old framework: keys keep working through aliases. That last part is generous, and it's exactly why I think yo…
Symfony 8.2 brings plenty of new features, but the one I care most about is a single transport option: the transactional outbox. Once preventing dual writes takes one line of config, sending to the broker directly from i…
Mago, the Rust toolchain for PHP, formats, lints, analyzes and guards architecture from one binary, and its speed is real. Kai argues the smart move is to let it take over the fast, cheap checks right now, keep your plug…
React 19.3 lets unrelated transitions render on their own instead of being tied together. PHP developers will recognise the idea, because it is how FPM workers have kept one slow request from stalling the rest for years.…
Partial Function Application lands in PHP 8.6 and finally makes the pipe operator pleasant to use. It is also easy to misread. A partial evaluates its fixed arguments once, when you create it, and it drops most attribute…
