In September 2025, the PHP community approved guidance that favors PIE, the PHP Installer for Extensions, over PECL for installing non-bundled extensions. PIE 1.5.2 builds and enables packages from Packagist, while PECL …
mir, a Rust analyzer that reads psalm.xml, baselines and @psalm-* tags, checks Laravel and Symfony in about two seconds where Psalm takes close to a minute. The speed is the headline. The bigger story is that PHP's docbl…
Symfony 5.4.54 fixes CVE-2026-109449 in the ExpressionLanguage component by limiting how deeply expressions can nest. The maintenance release also improves cache handling and character escaping in the console. No exploit…
Laravel 13.37.0 arrived on 16 October with fixes across queues, Eloquent and database access. queue:failed now supports a --queue option, and queue:forget accepts multiple IDs. The Image API adds JPEG XL support, and FTP…
Pest 5.3.2 has a defect in its new time-balanced sharding path. When parallel execution and sharding are combined, the runner silently skips all PHPUnit tests. The problem was reported in GitHub issue 1965 after unexpect…
Symfony 5.4.54, published on 15 October 2026, is a security release for the 5.4 branch. It addresses CVE-2026-109449 in ExpressionLanguage, CVE-2026-108082 in HttpFoundation, and CVE-2026-109413 in Yaml. The update also …
Alexandre Daubois outlines how PHP’s independent security team triages reports, reproduces them across platforms and assigns CVEs without waiting for GitHub. Since July 1, it has published 15 CVEs and closed 106 reports.…
Laravel 13.36.0 expands the fluent validation API to cover every rule that previously required string syntax. The release also adds OLAP workload switching for PlanetScale and Vitess, optional sticky-connection resets be…
Symfony released version 6.4.48 on 14 October. The detailed changelog lists fixes across HttpClient, DependencyInjection, HttpKernel, Messenger, Yaml, Clock and Security, plus translation updates. It addresses date and D…
An RFC under discussion proposes separate opt-in flags for comments and trailing commas in PHP's json_decode() and json_validate(). JSON_ALLOW_COMMENTS would accept line and block comments, while JSON_ALLOW_TRAILING_COMM…
Route::query() will get the attention, but the important change in Laravel 13.35 is quieter. Schedule::alwaysOnOneServer() and global strict form requests let one line of config replace a rule you had to remember on ever…
Inertia.js 3.9.0 gives usePoll() and router.poll() explicit background-tab behavior through background: 'pause', 'throttle', or 'continue'. The release also exposes history restores in navigate events, clears prefetch da…
Laravel released framework version v12.70.0 on 13 October. Pull request #61838 fixes query issues and is credited to @taylorotwell. The backport in #61871 brings EncodedParameter from #61610 into the 12.x line and is cre…
PHP 8.6 keeps choosing a thrown error over a polite guess, and I think that is the best thing in the release. There is one exception: partial function application captures its arguments when it is created, and nothing wa…
CVE-2026-91768 concerns PHP’s FastCGI handling of the allowed_clients setting. The check examines only 96 of the 128 bits in an IPv6 address, leaving part of the address outside the comparison. The available report ident…
Freek Van der Herten examines a PHP 8.6 RFC that changes how readonly properties can receive default values. The overview places the four-year restriction in context, explains why interface properties renewed the case fo…
PHP 8.6.0 RC3, tagged on 8 October 2026, puts partial function application at the center of the release. The more urgent migration work concerns stricter argument checks, safer session defaults and deprecations headed fo…
Almost a year after PHP 8.5 shipped, everyone still talks about |>. I think the feature that will save you the most grief is the new URI extension, which finally parses URLs to RFC 3986 and WHATWG. Pipes make code pretti…
PHP 8.5, released on November 20, 2025, brings the pipe operator to core PHP and adds a standards-based URI extension, immutable object updates with clone(), array_first(), array_last(), and #[\NoDiscard]. The release al…
Following the 1.13.0 report, FrankenPHP has published version 1.13.1 on 10 October. GitHub identifies commit 99d4e11 and lists two release assets. The supplied release record omits a changelog and fix list. Security note…
Laravel 13.35 ships Route::query(), giving the brand new HTTP QUERY method a first-class seat in the router. I think new filter-heavy endpoints should use it right away, not someday. Yes, your proxies, CDN and CORS setup…
Freek Van der Herten shows how Spatie uses Laravel Wayfinder with React and Inertia to remove hardcoded URLs from frontend code. Generated TypeScript functions check route parameters and controller calls during the build…
Damian Jóźwiak has opened discussion of an RFC for a core ext/csv module. The proposal responds to the planned PHP 8.6 deprecation of SplFileObject CSV methods and introduces a compact Csv\ API with RFC 4180 defaults, mu…
PHP internals has a backward-compatible answer to bcrypt’s 72-byte limit: Sjoerd Langkemper proposes the opt-in PASSWORD_BCRYPT_SHA256 algorithm, based on Passlib. The earlier plan to reject longer inputs is set aside fo…
Sebastian Bergmann examines a security shift in PHP command-line tooling: coding agents consume raw output, humans see terminal rendering. He uses recent PHPUnit hardening to show how control characters, forged compact-o…
Freek Van der Herten shows how Spatie uses the new Laravel AI SDK inside There There, its private-beta support platform. A ThereThereAgent combines a Blade-backed system prompt, model settings, conversation history, and …
Symfony 8.2 hands configuration back to the components: 29 new bundles, each with its own config root, and the old framework: keys keep working through aliases. That last part is generous, and it's exactly why I think yo…
Released on October 7, 2026, PIE 1.5 lets developers install several PHP extensions in one command and choose packages explicitly for unattended project installs. `pie upgrade` now respects each extension’s original vers…
Released on October 7, 2026, Laravel AI SDK 1.1.0 is the project’s first minor release after 1.0. It adds Agent Skills, Cohere text generation, approval gates for built-in tools, and self-hosted Laya classification. Prov…
