Laravel released v12.69.2, a patch on the 12.x branch. It sets a default memoryExceededExitCode for Laravel Cloud and corrects closure return types in withFreshQueryLog() and askWithCompletion(). The release is available…
Fuzz, a package by Jon Purvis, adds coverage-guided fuzz testing to Pest 5 via nikic's PHP-Fuzzer. It mutates seed strings, tracks code coverage without Xdebug, and reports crashes as failed tests. A walkthrough shows it…
CVE-2026-82222 affects GiveWP up to 4.16.7.1, a WordPress donation plugin with over 100,000 installs. An unauthenticated attacker can chain a registration bypass, a weak unserialize helper and a TCPDF gadget chain into r…
Symfony 7.3 gave voters a Vote object and addReason(); 7.4 and 8.0 add extraData plus two Twig functions that expose the whole access decision. The boolean era of authorization is quietly over, and the per-voter logger c…
Timo Poppinga has opened an internals discussion on an RFC to expose OpenSSL provider-based algorithms generically in ext/openssl. The goal is support for post-quantum algorithms like ML-KEM, ML-DSA and SLH-DSA, includin…
Taylor Otwell has disabled GitHub Issues on most Laravel open-source packages, asking users to describe bugs to a coding agent and submit pull requests instead. The main Laravel repository is unaffected. Symfony is exper…
PHP 8.5's |> is a one-rule feature: left value in, first argument out. The loudest complaint is the parentheses you need around every multi-argument arrow function. I think that friction is the operator's best quality, b…
Voting has started on a PHP RFC that adds an opt-in PREG_THROW_ON_ERROR flag for preg_* functions. With the flag, PCRE errors surface as a \PregException instead of requiring preg_last_error() checks. The vote closes on …
PHP 8.5's new pipe operator lets developers write chained function calls in execution order instead of nested inside-out. The syntax compiles to the same opcodes as traditional calls, so there is no runtime cost. Multi-a…
FrankenPHP 1.12.7 is out. The patch release fixes a classic-mode bug where output sent after fastcgi_finish_request() was silently dropped, corrects a thread-count metric, tones down client-disconnect logging, and remove…
A French field report on moving a Sulu site to FrankenPHP measures 30 to 40 ms saved per request, zero repeated MySQL connections, and one nasty 404 in production. Kai argues the modest, honest numbers are a better case …
The weekly PHP internals recap covers a Unicode identifier scan across half a million files, Nick Sdot's RFC to end PEAR endorsement with only Net_SMTP still maintained, a dispute over whether base conversion functions s…
John Koster's Forte package parses Laravel Blade files into a typed syntax tree that developers can query, rewrite, and render back byte-identical. The Laravel News walkthrough covers codemods, audits, and CI checks, plu…
Laravel 13.27 can finally stop interpolating bound values into QueryException messages, which means your logs, failed_jobs rows and APM traces stop collecting customer data by accident. I say flip the flag in production …
Sebastian Bergmann argues that European digital sovereignty already runs on PHP applications like TYPO3, Drupal and Nextcloud, citing Germany's €108 million Government Site Builder and the EU's 770 Drupal sites. His piec…
Laravel 13.30 ships chunkBy() for grouping adjacent collection items, forces Storage::path() through the Flysystem path normalizer so traversal attempts now throw PathTraversalDetected, prints the queue worker's stop rea…
Laravel v12.69.0 disables HTML in exception page tooltips by default and verifies the password hash against the stored cookie before authenticating the user. Both fixes come from contributor Mior Muhammad Zaki (crynobone…
Robert Landers has opened discussion on a nameof() RFC for PHP. The construct would return the name of a variable, property, method, function or constant as a string, usable anywhere a string literal is allowed, includin…
Brent Roose, PHP developer advocate at JetBrains and creator of the Tempest framework, has joined The PHP Foundation's Board of Directors in the JetBrains Platinum Sponsor seat. He replaces Roman Pronskiy, founding membe…
PHPStreamServer 0.9, the largest update to the PHP-based application server, now requires FFI for native OS APIs, supports dynamically registered workers and scheduled tasks, and ships a hardened Unix-socket message bus …
Eleven Laravel releases in under three months, and everyone is talking about the image component. I think the additions that earn the upgrade are the defensive ones: masked query bindings, refreshForUpdate() for pessimis…
Inertia.js v3.7.0 adds a cancelOnUnmount attribute and a cancel method to the <Form> component, letting developers abort in-flight submissions when a form unmounts or on demand. usePoll now reports a reactive polling sta…
Laravel shipped eleven minor releases from 13.17 to 13.27 in under three months. Highlights include a first-party Illuminate\Image component, queue:pause --all for stopping every queue at once, a mask_bindings_in_excepti…
Symfony shipped version 6.4.45 alongside 7.4.18 and 8.1.6, bundling dozens of hardening fixes across HttpClient, HttpFoundation, Security and Mailer/Notifier components. Most changes reject malformed or malicious input r…
FrankenPHP collapses Nginx and PHP-FPM into one Caddy-based binary, and its worker mode keeps your app resident between requests. Kai argues the persistence trap everyone warns about is actually the strongest reason to t…
All Laravel starter kits now build with Vite+, the unified toolchain released in beta in July 2026. The switch, made via laravel/maestro#60, replaces ESLint and Prettier with a single vp CLI covering linting, formatting,…
PHP 8.5 gives you a curl share that survives between FPM requests, and the benchmark headline says an 88 percent cut in request time. I think the number is the least interesting thing here. The function is worth studying…
The August 26 edition of This Week In PHP Internals covers a debate over LLM-written list posts, Sepehr Mahmoudi's new array_str_contain() RFC meeting unanimous resistance, an intl extension roadmap, and a first-time con…
The PHP project has published two new patch versions: PHP 8.5.10 and PHP 8.4.25. Both releases continue the regular maintenance cycle for the currently supported stable branches and are available for download on php.net.…
Four lines of PCNTL turn a silently killed PHP process into a clean exit, and every team should ship them. But a signal handler only guarantees the current work item finishes. If that item is a forty-minute report over t…
