€0.00 — free as in speechtonight's forecast: clear skies over production Cache: warm · Deploys: fair, 0% rollbacks expectedset by moonlight, shipped before dawn · deploy freely Page A1

❦The Daily Commit❦ ☾The Nightly Build☽

Dev news, typeset daily — PHP · AI · The Wider Stack

The developer's evening paper — PHP · AI · The Wider Stack

Motto of the dayMotto of the night

“Does Claude's leak mean PHP needs more Psalm?”

Tuesday, November 10, 2026 Vol. I — No. 896 · Morning editionLate edition EN DE FR ES

PHP · The Lead · Releases

PHP 8.6.0RC5 ready for testing

php.net Releases, November 5, 2026 — The PHP project has tagged PHP 8.6.0RC5 — a pre-release of the upcoming 8.6 branch with 103 changelog entries across 34 components.

The PHP project has tagged PHP 8.6.0RC5, a pre-release build of the upcoming 8.6 branch. It is meant for testing, not for production: the 103 changelog entries across 34 components — among them Core, CLI, COM, Curl, DBA, DOM … — preview what 8.6 will ship.

Now is the time to run your applications and extensions against this build and report regressions upstream — every issue caught before GA saves the whole ecosystem an upgrade headache. The changelog so far is below; QA builds are available on qa.php.net.

→ continued: summary & source

PHP · Releases

Laravel 13.38 tightens consistency across app data

Medium · Laravel, October 22, 2026 — Laravel 13.38.0 adds a session-based two-second fallback to the write connection after a database write and introduces DB::usingWritePdo() for relationship queries that need fresh data. The release accepts floats in Rule::unique() conditions and releases earlier chunks during lazy iteration. Scheduled-job lock cleanup and further Eloquent, SQLite, routing, and queue fixes complete the update.

curated by Heiko

PHP · Security

Report attributes two critical PHP flaws to AI research

Medium · PHP, October 22, 2026 — An October Medium report attributes two alleged critical PHP vulnerabilities, CVE-2026–109618 and CVE-2026–109619, to research involving Wiz and OpenAI’s GPT-5.6 Sol. It claims a 9.2 severity score, unauthenticated remote code execution, 22.6 million exposed instances and an emergency patch after details leaked. The excerpt gives no affected or fixed PHP versions.

curated by Giselle

Ad — php-net.pro · in our own cause

Ad · php-net.pro

Reach 145,000 PHP developers.

Sponsored posts on @php_net — the largest independent PHP account on X. From €399, booked online in minutes: write, preview, schedule, pay.

Book a post →

◇ this ad position rotates with every refresh · plus VAT where applicable

PHP · Security

OpenAI’s Codex skills check whether a site exposes a risky PHP version

Xataka, October 21, 2026 — OpenAI has released a checker for Codex that tests whether a website publicly reveals a PHP version within the affected range. The phpcheck-url skill works from a URL, and phpcheck-server validates the local installation and the PHP-FPM or Apache instance serving it. Results are VULNERABLE, OK, or UNKNOWN, but the check is not an exploit or full audit.

curated by Sönke

PHP · Security

Wazuh rules watch for post-exploitation after critical PHP flaws

Medium · PHP, October 21, 2026 — PHP’s emergency fixes on October 21, 2026 address CVE-2026-109618 and CVE-2026-109619, two unauthenticated remote-code-execution flaws rated CVSS 9.2. A community Wazuh deployment uses process sampling and file-integrity monitoring to detect post-exploitation activity during patching. The rules are unofficial, miss short-lived commands, and do not reveal the initial exploit.

curated by Georg

PHP · RFC Watch

PHP pattern matching debate turns on keys and ints

PHP Internals ([RFC]/[VOTE]), October 22, 2026 — Kevin Lopez has raised two semantic issues in the draft PHP Pattern Matching RFC. Array patterns should distinguish a missing key from an explicit null and use array_key_exists(). Integer patterns and numeric ranges should reject strings and floats, even when their values fit. Lopez says these rules are required to validate model JSON with exact fields and types.

curated by Sönke

The Wider Stack

Dev · Security

GitLab ships patches for CVSS-10 remote-code flaw

GitLab has released patches for CE and EE branches 19.5, 19.4, 19.3, 19.2, 19.1, 19.0 and 18.11. The updates fix 12 vulnerabilities, including CVE-2026-110264, a CVSS 10.0 unauthenticated remote-code-execution flaw affecting versions from 7.0 onward. GitLab urges self-managed operators to update. No…

curated by Georg

Situations Vacant — PHP

live from the Job.bo index — toggle skills, filter by location or remote

Browse all 1000 PHP jobs → · Powered by Job.bo