Developer Tools
Psalm 7 Turns On Security Analysis by Default
Psalm 7 runs taint analysis by default, replaces its old purity annotations with capabilities, and requires 64-bit PHP 8.2 through 8.6.
Eric L. Barnes
Developer Tools
Cooldown Policies for New Package Versions in Composer 2.11
Composer 2.11 can hold back newly published package versions for a period you set. It also ships nine security fixes and removes the dist-to-source fallback.
Eric L. Barnes
PHP Core
PHP 8.2 End of Life: Plan Your Upgrade Before Dec 31
PHP 8.2 security support ends December 31, 2026. See the support dates for 8.3 through 8.5, how to pick a target, and a checklist for upgrading production.
Eric L. Barnes
Developer Tools
Cloudflare Opens a PHP CTF to Test Its php2shell WAF Rules
Cloudflare put a vulnerable PHP 8.5.11 server behind its WAF and invites HackerOne researchers to bypass the php2shell rules and capture a flag.
Eric L. Barnes
PHP Core
PHP Windows Builds Patch Brotli CVE-2026-111497
Rebuilt PHP Windows binaries 8.2.35-1 to 8.5.12-1 ship Brotli 1.2.1 to fix CVE-2026-111497. The PHP version doesn't change, so check for the -1 build.
Eric L. Barnes
PHP Core
PHP Warns of Another Session Upload Progress RCE Path
The PHP security team says to set session.upload_progress.enabled=0 until the next bugfix release to block a rare RCE path, CVE-2026-115560.
Eric L. Barnes
PHP Core
Chainguard Broke the php2shell Embargo
Chainguard CEO Dan Lorenc says exploit reports justified shipping PHP RCE fixes before the embargo lifted. The reports don't hold up, and it was the wrong call.
Eric L. Barnes
PHP Core
PHP Foundation Explains the RCE Bugs and the Disclosure Leak
The PHP Foundation says the OOM bug behind today's PHP RCE fix was first spotted in 2024, the fix stalled for months, and a leak moved the release up a day.
Eric L. Barnes
PHP Core
php2shell: How OpenAI Coordinated the PHP RCE Disclosure
OpenAI says its Patch the Planet program coordinated the php2shell disclosure after Calif used GPT-5.6 Sol to find a critical PHP bug Wiz also reported.
Eric L. Barnes
PHP Core
PHP Fixes Two Critical Remote Code Execution Bugs - Update Today!
PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 fix two CVSS 9.2 bugs that allow unauthenticated remote code execution. Who's at risk and how to mitigate.
Eric L. Barnes
Community
PHP Social Network Built Live in 48 Hours With JetBrains Air
Nuno Maduro, Brent Roose, and Matthieu Napoli are building a social network for developers in PHP and Laravel, live on YouTube from the JetBrains office.
Eric L. Barnes
Community
Automattic Applies for a .php Top-Level Domain
WordPress parent Automattic filed for a .php TLD in ICANN's 2026 round. Here's how the application works.
Eric L. Barnes