Cooldown Policies for New Package Versions in Composer 2.11
Composer 2.11 can hold back newly published package versions for a period you set. It also ships nine security fixes and removes the dist-to-source fallback.
PHP News — Everything happening in PHP
Partners who support PHP News
Latest PHP News
PHP 8.2 End of Life: Plan Your Upgrade Before Dec 31
PHP 8.2 security support ends December 31, 2026. See the support dates for 8.3 through 8.5, how to pick a target, and a checklist for upgrading production.
Cloudflare Opens a PHP CTF to Test Its php2shell WAF Rules
Cloudflare put a vulnerable PHP 8.5.11 server behind its WAF and invites HackerOne researchers to bypass the php2shell rules and capture a flag.
PHP Windows Builds Patch Brotli CVE-2026-111497
Rebuilt PHP Windows binaries 8.2.35-1 to 8.5.12-1 ship Brotli 1.2.1 to fix CVE-2026-111497. The PHP version doesn't change, so check for the -1 build.
The php2shell Scare Showed How Much Runs on PHP
The php2shell scare pulled PHP onto front pages worldwide, from Japan's prime minister to the NSA, and showed how much of the internet quietly runs on it.
More stories
All stories →- PHP Warns of Another Session Upload Progress RCE Path
- Chainguard Broke the php2shell Embargo
- PHP Foundation Explains the RCE Bugs and the Disclosure Leak
- php2shell: How OpenAI Coordinated the PHP RCE Disclosure
- PHP Fixes Two Critical Remote Code Execution Bugs - Update Today!
- PHP Social Network Built Live in 48 Hours With JetBrains Air
- Automattic Applies for a .php Top-Level Domain
- PHP 8.7 RFC: Comments and Trailing Commas in json_decode()
- The History of PEAR, PHP's First Package Manager
- elephc: A PHP Compiler That Builds Native Binaries
PHP news in your inbox
The most important news, tutorials, and packages—curated for working PHP developers.