PHP Core
Why PHP 6 Never Shipped and PHP Skipped to 7
The full story of PHP 6: the Unicode rewrite that stalled, the books sold for a version that never came, and the 2014 vote to skip straight to PHP 7.
Eric L. Barnes
The PHP Blog
PHP News is the daily source for developers building with PHP — a PHP blog covering practical tutorials, release notes, package discoveries, and the community reporting that helps you ship better applications.
Developer Tools
Psalm 7 Turns On Security Analysis by Default
Psalm 7 runs taint analysis by default, replaces its old purity annotations with capabilities, and requires 64-bit PHP 8.2 through 8.6.
Eric L. Barnes
Developer Tools
Cooldown Policies for New Package Versions in Composer 2.11
Composer 2.11 can hold back newly published package versions for a period you set. It also ships nine security fixes and removes the dist-to-source fallback.
Eric L. Barnes
PHP Core
PHP 8.2 End of Life: Plan Your Upgrade Before Dec 31
PHP 8.2 security support ends December 31, 2026. See the support dates for 8.3 through 8.5, how to pick a target, and a checklist for upgrading production.
Eric L. Barnes
Developer Tools
Cloudflare Opens a PHP CTF to Test Its php2shell WAF Rules
Cloudflare put a vulnerable PHP 8.5.11 server behind its WAF and invites HackerOne researchers to bypass the php2shell rules and capture a flag.
Eric L. Barnes
PHP Core
PHP Windows Builds Patch Brotli CVE-2026-111497
Rebuilt PHP Windows binaries 8.2.35-1 to 8.5.12-1 ship Brotli 1.2.1 to fix CVE-2026-111497. The PHP version doesn't change, so check for the -1 build.
Eric L. Barnes
Community
The php2shell Scare Showed How Much Runs on PHP
The php2shell scare pulled PHP onto front pages worldwide, from Japan's prime minister to the NSA, and showed how much of the internet quietly runs on it.
Matt Stauffer
PHP Core
PHP Warns of Another Session Upload Progress RCE Path
The PHP security team says to set session.upload_progress.enabled=0 until the next bugfix release to block a rare RCE path, CVE-2026-115560.
Eric L. Barnes
PHP Core
Chainguard Broke the php2shell Embargo
Chainguard CEO Dan Lorenc says exploit reports justified shipping PHP RCE fixes before the embargo lifted. The reports don't hold up, and it was the wrong call.
Eric L. Barnes
PHP Core
PHP Foundation Explains the RCE Bugs and the Disclosure Leak
The PHP Foundation says the OOM bug behind today's PHP RCE fix was first spotted in 2024, the fix stalled for months, and a leak moved the release up a day.
Eric L. Barnes
PHP Core
php2shell: How OpenAI Coordinated the PHP RCE Disclosure
OpenAI says its Patch the Planet program coordinated the php2shell disclosure after Calif used GPT-5.6 Sol to find a critical PHP bug Wiz also reported.
Eric L. Barnes
PHP Core
PHP Fixes Two Critical Remote Code Execution Bugs - Update Today!
PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 fix two CVSS 9.2 bugs that allow unauthenticated remote code execution. Who's at risk and how to mitigate.
Eric L. Barnes
Browse the PHP blog by topic
Every post lands in one of these, so start wherever your work does.