The PHP Foundation has started publishing quarterly reports on the work of its core development team, aiming to increase transparency about how its 13 contractors (spread across 8 countries) spend their time. This first edition covers Q2 2026.

Arnaud Le Blanc, with Ilija Tovilo, worked out a general fix for two long-standing engine bugs tied to error handlers and destructors; an RFC for a related third bug source is coming, targeting a version after PHP 8.6. He also shifted his STF (streams) work with Jakub Zelenka from I/O hooks to a dependency of those hooks.

David Carlier added AF_PACKET raw buffer support to PHP's sockets extension (PR #21631), letting PHP talk to low-level Linux packet sockets natively instead of shelling out or using FFI — closing a gap with C, Python, Go and Rust. It requires CAP_NET_RAW/root, so it doesn't widen the attack surface for regular code.

Derick Rethans completed a migration of the entire php.net infrastructure to a new CDN provider; further details are promised in a separate announcement.

Gina Banyard cut unnecessary allocations in ext/phar, investigated unifying PHP's type-checking code (linked to her interface-only generic types proposal), and prototyped replacing the get_constructor() object handler with an attribute, which could eventually allow new MyClass(...) as a callable. She's also preparing the PHP 8.6 mass deprecation RFC, studying how often objects are used like arrays, and gave talks including her first academic conference, UNSOUND.

Ilija Tovilo focused on security triage, continued the STF stream project, and experimented with an 8-byte zval representation — an early-stage idea that could cut memory use and boost performance broadly. He also raised gcovr coverage-tool accuracy from roughly 54% to 71%.

Jakub Zelenka shipped a new stream errors API, an internal/userspace polling API (Io\Poll), and OpenSSL/TLS improvements including configurable session resumption, PSK support and crypto status exposure. He also patched a security issue in the FPM status endpoint and fixed several memory leaks and stream bugs.

James Titcumb's PIE team is preparing PIE 1.5, adding multi-extension installs, an unattended --select flag, no-op reinstalls of already-installed extensions, and a pie install --from-lock flag, alongside PECL placeholder support, adoption of the providers API, and continued 1.4.x maintenance and GHSA security fixes.

Joe Watkins built an experimental multi-engine parser called phathom (published on GitHub) meant to map PHP core code across repositories and documentation for new contributors; the project is currently paused.

Máté Kocsis got the 'Followup improvements for ext/uri' RFC accepted, adding URI/URL Builder classes, largely already implemented. He's also drafted the query_params RFC, which could reshape how PHP handles query parameters, with voting expected next quarter, and prototyped a UUID v7 extension.

Saki Takamachi handled bug fixes and reviews before going on family leave.

Shivam Mathur added Visual Studio 2026 (VS18) toolchain support to PHP's Windows build infrastructure ahead of PHP 8.6, updated key Windows dependencies (OpenSSL, curl, SQLite, Apache, ICU, libssh2) to close known vulnerabilities, fixed Windows-specific PGO and ZTS crashes, and maintained php-windows-builder for PECL releases.

Volker Dusch founded the PHP Ecosystem Security Team, scanning over 500 popular Composer packages and nearly every major framework, and shared more than 100 fixes directly with maintainers.

Alexandre Daubois joined as the team's 13th contractor too recently for updates this quarter.

On the leadership side, Executive Director Elizabeth Barron and Director of Fundraising Ben Marks ran a listening tour, drafted a yearly strategy plan, onboarded new contractors, sponsors and board members, and launched the PHP Ambassador program, quarterly Advisory Board meetings, the State of PHP Survey, and a revived monthly newsletter.