The PHP Foundation is accepting proposals for its 2027 contractor program until October 20, 2026, at the end of the day in Anywhere on Earth time. The call targets experienced C and systems programmers who can maintain P…
Laravel has fixed two security issues in laravel/ai and laravel/mcp. Laravel AI SDK 1.0.0 allowed server-side requests through its Vercel and AG-UI adapters, while Laravel MCP mishandled OAuth redirect validation. Instal…
Jakub Zelenka has opened discussion on an early PHP RFC for IO hooks and operations. The proposal depends on the newly introduced Polling API Additions RFC and could later gain Ring API support. A working proof of concep…
Laravel AI SDK 1.0 lets an agent pause a tool call until a human decides what happens. That's useful, and it's also a dialog box. Anyone who has watched people click through dialog boxes knows how that ends. Kai argues t…
Laravel 13.34.0 adds opt-in accounting for worker crashes in maxExceptions, timeout notification for Interruptible jobs, and execution duration on JobProcessed. The release also scopes queue:flush to one queue, adds Sche…
PHP 8.5 ships Uri\Rfc3986\Uri and Uri\WhatWg\Url, and the obvious complaint is that one clean class would have been simpler. Kai argues the split is the real fix: most URL bugs come from two components reading the same s…
Laravel released v11.57.0 of its framework on GitHub. taylorotwell created the tag on 29 September at 15:33. The release page lists no changelog entries. The update confirms the version tag but leaves the code changes un…
Symfony released version 6.4.47 on 29 September. The update fixes escaping in generated PHP code and tightens Redis namespace cleanup. Serializer cache keys and YAML parsing also receive fixes, alongside HTTP client and …
Sjoerd Langkemper has proposed the PHP RFC bcrypt_max_password_length. It would make password_hash() throw ValueError when bcrypt receives input longer than 72 bytes. PHP currently truncates longer input silently, hashin…
laravel/mcp 1.0 drops server-side sessions, and for a language built on share-nothing requests that part of the upgrade is mostly a grep. The work that deserves real thinking is the one nobody forces on you: deciding whi…
A new Laravel-focused walkthrough tests Laravel AI SDK v1 with real OpenAI API calls. It examines middleware applied per step and approvals for tool execution. The guide also covers conversations and streaming. It adds p…
Pratik Bhujel has proposed Io\Terminal for PHP 8.7. The API would add native terminal sessions, size detection, safe raw mode, normalized key input, and hidden input to ext/standard. A reduced implementation is under rev…
Partial application will get the applause, but I think the substance of PHP 8.6 sits elsewhere: Time\Duration, clamp(), SortDirection, JSON errors with coordinates and a native polling layer. Core is starting to ship sha…
Laravel AI SDK hit v1.0.0, and the feature I care about is not chat streaming. It is classification on the tiny Jev model: cheap, fast answers to the yes/no questions that make up most real AI work in a web app. Add the …
Symfony UX 3.5 introduces symfony/ux-pagination, an experimental component for paginating arrays, Doctrine queries and other data sources. It relies solely on server-side PHP and Twig, without JavaScript, Stimulus or Tur…
Laravel’s next major version is planned for Q1 2027, although the project has not set a release date. Development already includes API changes such as routing support for the HTTP QUERY method. Laravel 14 will require PH…
An analysis of Laravel AI SDK 1.0 draws a boundary between action approval and data consent. The new Approvable contract pauses tool calls for approval, rejection or argument edits, including queued workflows. It cannot …
Following the previously reported PHP 8.5.11 release, the PHP project has published PHP 8.4.26, PHP 8.3.35 and PHP 8.2.34. The announcement excerpt gives no component list or change details for these three versions. Deve…
WordPress 7.1.2 patches CVE-2026-87902, a critical template-inclusion flaw around get_page_template(). The exploit only fires when theme layout, pearcmd.php and register_argc_argv line up, and that is exactly the point: …
JetBrains has introduced Air, a product family for running and managing AI coding agents. Its free public-preview IDE plugin brings Claude Agent, Codex, Junie, Copilot, and OpenCode to PhpStorm and other JetBrains IDEs. …
Patchstack saw probing of CVE-2026-87902 within hours of WordPress 7.1.2, with exploitation attempts escalating the next day. The critical, unauthenticated path-traversal flaw can load local PHP files and reach code exec…
Laravel AI SDK 1.0 leaves beta with TypeSafe's Jev model for fast, low-cost classification, streaming through Vercel Chat and AG-UI, and human approval for risky tool calls. Laravel 13.33 adds tagged memoized caching, th…
PHP 8.6 has entered feature freeze, with the first release candidate due on September 24, while master targets 8.7. This week’s internals discussions also settled exception propagation for preg_replace_callback and intro…
An r/PHP post points to CVE-2026-91766 and associates it with a credential leak during HTTP redirects in PHP. The headline also notes that curl addressed the same redirect-related issue in 2018. The source provides no af…
Laravel MCP 1.0 can reject unchanged 0.9 clients with HTTP 400 and JSON-RPC -32020 when required protocol headers do not match. The migration removes session APIs, moves context into request data, and makes PKCE mandator…
PHP 8.6 is scheduled for November 19, 2026. The preview covers partial function application, readonly defaults, constant override checks, Time\Duration, clamp(), SortDirection, richer JSON diagnostics, and a new polling …
