Ecosystem — The Daily Commit
Reads
LARAVEL NEWS, September 9, 2026 — Laravel v13.31.0 ships a new Queue::totalSize() method and a JobInterrupted event for Interruptible jobs. The release also adds chaperone support for BelongsToMany pivot models, a Vite devServerUrl() method, once assertions for the Mail and Notification fakes, and a long list of bug fixes.
The Editorial
September 8, 2026 — GiveWP's first attempt at fixing CVE-2026-82222 detected the malicious object and then returned the original payload anyway. That single line is the whole lesson of this CVSS 10.0 bug: allowed_classes => false does not disarm anything, it d…
Releases
LARAVEL FRAMEWORK RELEASES, September 8, 2026 — Laravel released v12.69.2, a patch on the 12.x branch. It sets a default memoryExceededExitCode for Laravel Cloud and corrects closure return types in withFreshQueryLog() and askWithCompletion(). The release is available on GitHub.
News
MEDIUM · LARAVEL, September 9, 2026 — PHP 8.6 arrives 19 November 2026 with partial function application, the Time\Duration class and roughly thirty deprecations that map out PHP 9.0. A new overview covers the features, the migration work and why enabling E_DEPRECATED now pays off later.
Reads
LARAVEL NEWS — Fuzz, a package by Jon Purvis, adds coverage-guided fuzz testing to Pest 5 via nikic's PHP-Fuzzer. It mutates seed strings, tracks code coverage without Xdebug, and reports crashes as failed tests. A walkthrough shows it catching a Division…
Security
MEDIUM · PHP — CVE-2026-82222 affects GiveWP up to 4.16.7.1, a WordPress donation plugin with over 100,000 installs. An unauthenticated attacker can chain a registration bypass, a weak unserialize helper and a TCPDF gadget chain into remote code execution…
The Lead · The Editorial
PHP 8.6 arrives on 19 November 2026 as a light release: partial function application, a Duration class, and about thirty deprecations.
September 9, 2026 — My argument: the version bump is trivial, so spend the saved time making deprecation notices break your pipeline instead of scrolling past them. Here is the case, the honest counter-argument, and the two items no counter will catch.
The Editorial
Symfony 7.3 gave voters a Vote object and addReason(); 7.4 and 8.0 add extraData plus two Twig functions that expose the whole access decision. The boolean era of authorization is quietly over, and th…
RFC Watch
PHP INTERNALS ([RFC]/[VOTE]) — Timo Poppinga has opened an internals discussion on an RFC to expose OpenSSL provider-based algorithms generically in ext/openssl. The goal is support for post-quantum algorithms like ML-KEM, ML-DSA a…
Reads: Laravel Closes GitHub Issues on Most Packages, Wants PRs Instead B2
The Editorial: Let PHP 8.5's Pipe Operator Annoy You Into Writing Better Functions B2
RFC Watch: Vote Opens on PREG_THROW_ON_ERROR Flag for preg_* Functions B2
News: PHP 8.5 Pipe Operator Ends Inside-Out Nesting B2
Releases: FrankenPHP 1.12.7 Fixes Lost Output After finish_request() B2
The Editorial: FrankenPHP's worker mode earns its 40 ms honestly, and asks discipline back B2
RFC Watch: PHP Internals Digest: Unicode Identifiers, a PEAR Sunset RFC, and Three Releases B2
Reads: Forte Brings Syntax-Tree Parsing and Rewriting to Blade Templates B2
The Editorial: Set DB_MASK_BINDINGS=true Today, Then Ask Why It Was Ever Off B3
Reads: PHP Runs Europe's Sovereign Government Stack, but Funding Lags Behind B3
Reads: Laravel 13.30: chunkBy() for Collections, Storage Path Hardening, Worker Stop Reasons B3
Releases: Laravel v12.69.0 tightens exception page and cookie authentication B3
RFC Watch: Robert Landers proposes a nameof() construct for PHP B3
Reads: Brent Roose Takes JetBrains Seat on PHP Foundation Board as Roman Pronskiy Steps Down B3
Releases: PHPStreamServer 0.9 ships with dynamic workers and native OS integration via FFI B3
The Editorial: Laravel 13.17 to 13.27: the Keepers Are the Features You'll Never Demo B3
Reads: Inertia.js 3.7 Lets Forms Cancel Their Own Uploads B4
Releases: Laravel 13.17 to 13.27: Native Image Processing, Queue Controls and Masked Query Logs B4
Security: Symfony 6.4.45, 7.4.18 and 8.1.6 Close Out a Wave of Security Hardening Fixes B4
The Editorial: Worker Mode Is a Lie Detector for Your Application's Hidden State B4
"All the Code That's Fit to Ship" · The Daily Commit · Screen edition · Imprint · Privacy Policy