The Daily Commit · Section Edition Front Page PHP AI Dev EN DE FR ES
Motto
„All the Code
That's Fit to Ship“

The Php Times

Ecosystem — The Daily Commit

Weather
Today: cache warm, deploys fair. Rollback probability 0 %. Page B2
Vol. I — No. 679 Wednesday, September 30, 2026 Page B3 · € 0,00

Releases

PHP 8.6.0beta3 ready for testing

PHP.NET RELEASES, September 10, 2026 — The PHP project has tagged PHP 8.6.0beta3 — a pre-release of the upcoming 8.6 branch with 37 changelog entries across 18 components.

The Editorial

Let Deprecations Fail Your Build, and Let PHP 8.6 Be the Excuse

September 9, 2026 — PHP 8.6 arrives on 19 November 2026 as a light release: partial function application, a Duration class, and about thirty deprecations. My argument: the version bump is trivial, so spend the saved time making deprecation notices break your p…

Reads

Telescope 5.24.0 Brings CLI Debugging with telescope:list and telescope:show

LARAVEL NEWS, September 9, 2026 — Laravel Telescope 5.24.0, released September 8, 2026, adds two Artisan commands, telescope:list and telescope:show, for inspecting recorded entries from the terminal. Both support filters and JSON output for scripts and coding agents. The release also aborts stale dashboard requests during navigation.

→ continued: summary & source

Reads

Laravel 13.31 adds queue totalSize() and a JobInterrupted event

LARAVEL NEWS — Laravel v13.31.0 ships a new Queue::totalSize() method and a JobInterrupted event for Interruptible jobs. The release also adds chaperone support for BelongsToMany pivot models, a Vite devServerUrl() method, once assertions for the Mail and…

The Editorial

A sanitizer that hands your bytes back is not a sanitizer

GiveWP's first attempt at fixing CVE-2026-82222 detected the malicious object and then returned the original payload anyway. That single line is the whole lesson of this CVSS 10.0 bug: allowed_classes => false does not disarm anything, it d…

The Lead · RFC Watch

PHP Internals Week: PREG_THROW_ON_ERROR Vote Pulled, PEAR Sunset Moves Forward


Osama Aldemeery withdrew the PREG_THROW_ON_ERROR vote after 56 hours following a policy objection from Tim Düsterhus.


R/PHP (TOP), September 10, 2026 — The weekly internals recap also covers Gina Banyard's undefined-behaviour proposal, progress on sunsetting PEAR, and the closed strict-identifiers thread.

→ continued: summary & source

Reads

Fuzz Brings Coverage-Guided Fuzz Testing to Pest 5

LARAVEL NEWS — Fuzz, a package by Jon Purvis, adds coverage-guided fuzz testing to Pest 5 via nikic's PHP-Fuzzer. It mutates seed strings, tracks code coverage without Xdebug, and reports crashes as failed tests. A …

◆ Inside The Php Times ◆

Security: Critical GiveWP flaw chains unserialize helper into unauthenticated RCE B2

The Editorial: Your Security Voters Can Finally Testify, So Stop Logging by Hand B2

RFC Watch: RFC discussion opened for generic OpenSSL provider algorithms and post-quantum crypto in ext/openssl B2

Reads: Laravel Closes GitHub Issues on Most Packages, Wants PRs Instead B2

The Editorial: Let PHP 8.5's Pipe Operator Annoy You Into Writing Better Functions B2

RFC Watch: Vote Opens on PREG_THROW_ON_ERROR Flag for preg_* Functions B2

News: PHP 8.5 Pipe Operator Ends Inside-Out Nesting B2

Releases: FrankenPHP 1.12.7 Fixes Lost Output After finish_request() B2

The Editorial: FrankenPHP's worker mode earns its 40 ms honestly, and asks discipline back B3

RFC Watch: PHP Internals Digest: Unicode Identifiers, a PEAR Sunset RFC, and Three Releases B3

Reads: Forte Brings Syntax-Tree Parsing and Rewriting to Blade Templates B3

The Editorial: Set DB_MASK_BINDINGS=true Today, Then Ask Why It Was Ever Off B3

Reads: PHP Runs Europe's Sovereign Government Stack, but Funding Lags Behind B3

Reads: Laravel 13.30: chunkBy() for Collections, Storage Path Hardening, Worker Stop Reasons B3

Releases: Laravel v12.69.0 tightens exception page and cookie authentication B3

RFC Watch: Robert Landers proposes a nameof() construct for PHP B3

Reads: Brent Roose Takes JetBrains Seat on PHP Foundation Board as Roman Pronskiy Steps Down B4

Releases: PHPStreamServer 0.9 ships with dynamic workers and native OS integration via FFI B4

The Editorial: Laravel 13.17 to 13.27: the Keepers Are the Features You'll Never Demo B4

Reads: Inertia.js 3.7 Lets Forms Cancel Their Own Uploads B4

Releases: Laravel 13.17 to 13.27: Native Image Processing, Queue Controls and Masked Query Logs B4

"All the Code That's Fit to Ship" · The Daily Commit · Screen edition · Imprint · Privacy Policy