Ecosystem — The Daily Commit
The Editorial
November 6, 2026 — Everyone is talking about the model that found CVE-2026-109618 and CVE-2026-109619. The more uncomfortable number is that Cisco puts about half of internet-facing PHP on versions that no longer get security fixes. AI made discovery cheap. Deployment is still slow, and nobody can hand that part off to a model.
The Editorial
November 5, 2026 — The php2shell exploits leave nothing in your logs. You only see what the attacker does next, which means detection depends on www-data almost never doing anything interesting. That's a design choice we can make right now. Sometimes it costs…
Releases
PHP.NET RELEASES, November 5, 2026 — The PHP project has tagged PHP 8.6.0RC5 — a pre-release of the upcoming 8.6 branch with 103 changelog entries across 34 components.
The Editorial
November 7, 2026 — Laravel 13.38 ships PreventStaleDatabaseReads, a middleware that pins a user's reads to the primary for two seconds after a write. It's handy and worth turning on. The more honest tool in the release is DB::usingWritePdo(), because it makes you say at the call site which reads need fresh data. A heuristic doesn't replace knowing that.
The Editorial
The PHP2Shell fixes shipped on October 21, and plenty of teams still can't say which PHP binary answered their last request. Kai argues that the interpreter is your most important dependency and deserves the same treatment as composer.lock:…
The Editorial
When PHP2Shell landed, the PHP project shipped emergency source patches for 7.4, 8.0 and 8.1, branches it had already retired. Be grateful, then read the gesture correctly. Your next critical CVE will be decided by how routine your upgrades…
The Lead · The Editorial
Fluent Rule builders got the headline, but the line in Laravel 13.36 I'd act on first is Worker::$flushStickyConnections.
November 8, 2026 — It ships off by default so nothing breaks for apps that rely on it. I think you should turn it on, because a job that only works if an earlier job ran in the same process has a hidden dependency you'll hit eventually.
The Editorial
The PHP project announced the critical fixes for CVE-2026-109618 and CVE-2026-109619 ahead of time, gave a date and a UTC hour, and held back the details. That was a fair deal. The trouble is that a l…
The Editorial
Two critical PHP core flaws, CVE-2026-109618 and CVE-2026-109619, got patches only for 8.2 through 8.5. That leaves the 7.4, 8.0 and 8.1 crowd hardening config files against a bug that fires before an…
The Editorial: Your Patch Speed Is Set by Your Test Suite, Not by How Worried You Are B2
The Editorial: Patched the upload_progress bug? Keep the feature switched off anyway B2
The Editorial: The PHP patch is the easy part. Finding every running PHP is the job B2
The Editorial: Your app should report its PHP version long before an advisory asks B2
The Editorial: Your PHP Patch Counts Only Once the Old Workers Are Dead B2
Releases: Laravel 13.38 tightens consistency across app data B2
Security: Report attributes two critical PHP flaws to AI research B2
Security: OpenAI’s Codex skills check whether a site exposes a risky PHP version B2
Security: Wazuh rules watch for post-exploitation after critical PHP flaws B3
RFC Watch: PHP pattern matching debate turns on keys and ints B3
Security: PHP crisis shows how AI accelerates attacks on known flaws B3
Security: PHP security team addresses PHP2Shell rumors B3
Security: OffSeq tracks PHP2Shell traffic ahead of the fix B3
Security: Patched setup-php builds cover PHP 5.3 through 8.7 B3
Security: HN author apologizes over premature PHP RCE post B3
Security: PHP2Shell leaves unsupported PHP branches without a fix B3
The Editorial: PHP2Shell shows your PHP binary belongs in your repo next to composer.lock B4
Security: PHP explainer focuses on runtime checks for hosts B4
Releases: Composer 2.11 RC1 opens testing with stronger safeguards B4
Security: Tests fail to confirm an easy exploit for PHP flaw B4
Security: PHP ships fixes for two critical runtime RCE flaws B4
"All the Code That's Fit to Ship" · The Daily Commit · Screen edition · Imprint · Privacy Policy