Angular v22 made Signal Forms and the resource-based async signals stable. For PHP teams that run an Angular frontend on top of Laravel or Symfony, that is a cue to stop splitting validation rules and server-state logic …
Laravel AI SDK 1.0 lets an agent pause a tool call until a human decides what happens. That's useful, and it's also a dialog box. Anyone who has watched people click through dialog boxes knows how that ends. Kai argues t…
PHP 8.5 ships Uri\Rfc3986\Uri and Uri\WhatWg\Url, and the obvious complaint is that one clean class would have been simpler. Kai argues the split is the real fix: most URL bugs come from two components reading the same s…
laravel/mcp 1.0 drops server-side sessions, and for a language built on share-nothing requests that part of the upgrade is mostly a grep. The work that deserves real thinking is the one nobody forces on you: deciding whi…
Partial application will get the applause, but I think the substance of PHP 8.6 sits elsewhere: Time\Duration, clamp(), SortDirection, JSON errors with coordinates and a native polling layer. Core is starting to ship sha…
Laravel AI SDK hit v1.0.0, and the feature I care about is not chat streaming. It is classification on the tiny Jev model: cheap, fast answers to the yes/no questions that make up most real AI work in a web app. Add the …
WordPress 7.1.2 patches CVE-2026-87902, a critical template-inclusion flaw around get_page_template(). The exploit only fires when theme layout, pearcmd.php and register_argc_argv line up, and that is exactly the point: …
Python 3.15 arrives October 1 with PEP 810's lazy imports, and to a PHP developer it looks like Composer autoloading minus the ecosystem discipline that made autoloading safe. The opt-in keyword is solid and worth using …
Laravel 13 quietly ships two opposite answers to one question: where does configuration belong? You can pin queue settings to a job class with a PHP attribute, or route jobs centrally with Queue::route(). Kai argues the …
NVIDIA is reportedly paying $12.9 billion for Hugging Face, and most of us have a Dockerfile that curls hf.co at build time without a second thought. We already learned this lesson with Composer: open code is not the sam…
The Swoole team open-sourced TypePHP, an AOT compiler that turns a typed subset of PHP into native binaries and claims up to 150x speedups. Kai argues the headline number is the least interesting part: the real prize is …
PHP 8.6 arrives on 19 November 2026 as a light release: partial function application, a Duration class, and about thirty deprecations. My argument: the version bump is trivial, so spend the saved time making deprecation …
GiveWP's first attempt at fixing CVE-2026-82222 detected the malicious object and then returned the original payload anyway. That single line is the whole lesson of this CVSS 10.0 bug: allowed_classes => false does not d…
Anthropic bought Bun because Claude Code ships on it, and the deal will probably make Bun better. Kai argues the real lesson sits elsewhere: single-vendor runtime ownership is becoming normal, and the PHP world's messy, …
CVE-2026-85046, a V8 type confusion bug exploited in the wild, is being filed under 'browser news'. Wrong drawer. If your PHP app renders PDFs with Browsershot, runs Dusk or Panther in CI, or scrapes with Puppeteer, you …
Symfony 7.3 gave voters a Vote object and addReason(); 7.4 and 8.0 add extraData plus two Twig functions that expose the whole access decision. The boolean era of authorization is quietly over, and the per-voter logger c…
PHP 8.5's |> is a one-rule feature: left value in, first argument out. The loudest complaint is the parentheses you need around every multi-argument arrow function. I think that friction is the operator's best quality, b…
A French field report on moving a Sulu site to FrankenPHP measures 30 to 40 ms saved per request, zero repeated MySQL connections, and one nasty 404 in production. Kai argues the modest, honest numbers are a better case …
Laravel 13.27 can finally stop interpolating bound values into QueryException messages, which means your logs, failed_jobs rows and APM traces stop collecting customer data by accident. I say flip the flag in production …
Eleven Laravel releases in under three months, and everyone is talking about the image component. I think the additions that earn the upgrade are the defensive ones: masked query bindings, refreshForUpdate() for pessimis…
A maintainer nearly merged a dependency-bump PR that quietly edited his CI config to raid a self-hosted runner holding cloud credentials. Kai argues the pipeline belongs in your threat model: fork PRs are remote code exe…
FrankenPHP collapses Nginx and PHP-FPM into one Caddy-based binary, and its worker mode keeps your app resident between requests. Kai argues the persistence trap everyone warns about is actually the strongest reason to t…
PHP 8.5 gives you a curl share that survives between FPM requests, and the benchmark headline says an 88 percent cut in request time. I think the number is the least interesting thing here. The function is worth studying…
Four lines of PCNTL turn a silently killed PHP process into a clean exit, and every team should ship them. But a signal handler only guarantees the current work item finishes. If that item is a forty-minute report over t…
Kubernetes v1.37 ships today with SELinuxMount on by default. If your nodes run SELinux enforcing and two differently-labeled pods share a PVC, one of them stops starting. I think you should upgrade into that break rathe…
Keyset pagination is the part everyone quotes, and it's the part you'll finish before lunch. What actually turned an 18-hour fintech outage into a boring 8-hour Saturday was the checkpoint, the pause flag, the verificati…
Qdrant 1.19 replaces its scattered memory flags with one clean tier parameter and adds turbo4, a 4-bit datatype that stores no full-precision copy at all. Kai argues the boring memory API is the real money-saver, while t…
A VLD dump against PHP 8.3.6 shows declare(strict_types=1) leaves the bytecode untouched: same RECV, same VERIFY_RETURN_TYPE, one file-level flag. That kills the performance excuse and exposes the real problem, caller-si…
Go 1.27 ships generic methods, a rebuilt JSON engine under the old API, stdlib UUIDs and post-quantum crypto, and Go folks are asking if their minimalist language just blinked. Kai argues PHP resolved this debate long ag…
PHP 8.4 moved lazy loading into the engine, so Symfony and Doctrine stopped generating proxy classes. The real payoff is that the object in your debugger is finally the class you wrote. The catch: laziness is now invisib…
