Hi everyone,
It's php Thursday and we're bringing you the latest news, updates and releases from the php community. This week we have articles on The Specification Pattern in Laravel, Claude Code Skills for safe PHP, and Why Laravel's Service Container Feels Like Magic. In Podcasts we have new episodes from Laravel News and topics this week were Route metadata, faster Filament, and documented APIs. WP Builds tackles the intersection of human creativity and AI, while Syntax gets into whether anyone actually reads the code they ship anymore. Finally in our Reading section we have articles on 7 Unconventional (But Surprisingly Effective) Ways to Get Better at Coding, How Claude Changed the Way I Build WordPress Products, and When a password sync is 'partly done'.
We have all that and more, so we do hope you enjoy this week's newsletter. If you have an article, tutorial or podcast that you would like to be featured in our newsletter, feel free to reach out to us at [email protected].
All the best,
Adrian
|
Please help us by clicking to our sponsors:
Give Your Unused Startup a Second Chance
List your unfinished SaaS, app, or project for free. Sell it, find a co-founder, or let someone else bring it to life. No fees, no hassle - just new opportunities!
|
Articles
Seven things production taught me that no tutorial did
I spent the last few months building out a shipping integration on top of Shippo, and along the way, I kept running into the same lesson: the "quick" way to write Laravel code almost always works — right up until it doesn't. This isn't a theory post. Every pattern below came from something that actually broke, or almost broke, in this codebase.
Why Laravel's Service Container Feels Like Magic: Dependency Injection Explained
You’ve been there. You're building a Laravel application, and everything is going smoothly. You type Route::get('/orders', [OrderController::class, 'index']), define your method, and suddenly—you need to send an email.
The Specification Pattern in Laravel: Refactoring Complex Business Rules
As our Laravel applications grow, we inevitably face a common architectural dilemma: where do we put complex business logic that dictates whether an entity meets certain criteria?
Prevent WordPress hacks by reading your own access log
WordPress hack prevention is not a product you install after a breach. It is the boring work you do before one, and almost all of it is a reaction to traffic that is already hitting your site right now.
I Ported 60,000 Lines of PHP to NodeJS/TypeScript in just 14 Hours. The Speed Wasn’t the Surprise.
Fourteen hours. One AI coding agent — Claude Code running Opus 4.8. Sixty thousand lines of legacy PHP, rebuilt as a NodeJS/TypeScript backend that had to behave exactly like the original.
Claude Code Skills for safe PHP and JS package updates
In the age of AI propelled supply-chain attacks, it’s important not to update just because there’s an update waiting. But it’s also important to update because you might have unknowingly harbored some latent explot in your packages waiting for the right time to strike.
|
Tutorials and Talks
Ship AI with Laravel: I Tricked My Own AI Into Leaking Everything
Before we secure anything, I show you how bad it can get. With the right sequence of messages, I socially engineer our own support agent into handing over its entire system prompt, its list of tools, and its internal instructions.
How to parse lots of PDFs and more into markdown, with Laravel
You want to ask questions about your own documents from a Laravel app. The AI SDK that shipped with Laravel 13 handles most of it: embeddings, vector queries, agents. What it doesn't handle is the part that comes first, where a user hands you a 40-page scanned PDF and you need clean text out of it.
Stop Branch Wars: Feature Flags in Laravel
As engineering teams scale at Smart Tech Devs, the standard "Git Flow" methodology becomes a massive bottleneck. A developer creates a feature/new-billing branch and works on it for three weeks. Meanwhile, the rest of the team merges 50 other pull requests into the main branch.
How to Make Custom Model Casts in Laravel
You cannot directly specify custom helper functions like 'username' => 'encrypt_data()' inside Laravel's $casts array. Laravel's $casts property only accepts native types (such as 'encrypted') or classes that implement the CastsAttributes interface.
Stop Memory Leaks: Scaling APIs with Laravel Octane
Traditional PHP was designed to die. At Smart Tech Devs, a standard Laravel request spins up, boots the framework, processes the logic, returns a response, and then completely destroys itself, clearing all RAM.
How to Make Rank Math Sitemap Pages Load Faster
One common issue on WordPress websites with a large number of posts is that the Rank Math XML Sitemap can become slow to load. This happens because the sitemap is generated dynamically every time a visitor or search engine bot requests it.
30 WooCommerce Performance Tips That Actually Work (2026)
I've been doing WordPress performance audits for years. Hundreds of stores. And I keep running into the same problems - not exotic edge cases, just wrong defaults and things running that shouldn't be. |
News and Announcements
Welcoming Alexandre Daubois to The PHP Foundation
We are thrilled to add Alexandre Daubois to our team of contracted developers, focused on security. Alexandre will be spending a few hours a week helping with triage and the handling and fixing of incoming security reports.
AI Review for Laravel Upgrades
Since launching the AI prompts and AI skills, they've become my preferred way to use Shift. This has always been the biggest indicator for Shift - do I use it myself. AI helps push Shift's automation to the level I always wanted. It's the best of both worlds: deterministic changes from Shift and contextual changes from AI.
HTTP Query Method Support in Laravel 13.19
Laravel 13.19.0 rounds out support for the HTTP QUERY method across the HTTP client and testing helpers, and adds a handful of collection, string, and queue improvements alongside the usual fixes.
July 6–12, 2026 - A Week of Symfony #1019
This week, development activity focused on various improvements, such as enhancing the DX of AssetMapper in debug mode and allowing developers to disable redirects on logout. There were also proposals to improve Messenger with a new command and to add pipe operator compatibility to the Validator component.
This Week In PHP Internals | July 8, 2026
The Deprecations RFC fought about WordPress and then about evidence, Time\Duration declared itself complete, two rival function-autoloading designs collided in the same inbox, typed closures came back to a warm room, and the third-party docs RFC passed 26-1.
|
Podcasts and Vlogs
Laravel News: Route metadata, faster Filament, and documented APIs
Jake and Michael discuss all the latest Laravel releases, tutorials, and happenings in the community.
The Stack Overflow: Your AI is only as responsible as you are
Recorded at Microsoft Build, Ryan welcomes Sarah Bird, Microsoft’s Chief Product Officer for Responsible AI, about how we can build and use AI responsibly with the NIST approach, why most irresponsible AI comes from experimentation without thought of impact, and how Microsoft is researching thoughtful human/AI workflow design to reduce unnecessary escalation.
Software Engineering Radio: SE Radio 728: Clare Liguori on the AWS Strands SDK for AI Agents
Clare Liguori, a Senior Principal Engineer who works on developer tooling and agentic AI at Amazon Web Services, speaks with host Sri Panyam about the Amazon Strands Agents SDK. This episode explores the philosophy, design decisions, and emerging patterns behind building production-grade AI agents.
Developer Tea: Your Single Most Important Tool for Managing the Uneven Downsides of Risk
The skills you build and the tools you master matter, but they aren't your most important asset when things go wrong — and something eventually will. In this episode, I work through why our careers and lives are governed more by avoiding catastrophic downside than by chasing upside, and why the single best tool for surviving a bad event isn't testing, insurance, or money — it's genuine trust with the people around you.
Shoptalk Show: Ads on Your Website, UX for Web Dev Jobs, and Progressive Web Components
How do websites handle advertising embeds, thinking DND thoughts about team topologies, does knowing UX help get jobs in web dev, using Elena for building progressive web components, and dealing with buttons in web components.
WP Builds: 475 – Human creativity still matters in the age of AI
Well this is a different episode from the normal things we get into on WP Builds. It’s about the intersection of human creativity and AI, sparked by a handmade zine (I did not know what that was) titled “Human Creativity in the Age of AI.”
PHP Architect: The PHP Podcast 2026.07.09
The call for papers for PHP Tek 2027 is open, and the deadline is end of August.
Mostly Technical: 140: Eating The Burst
Ian and Aaron talk about pricing AI usage in apps, what's coming next for HelpSpot, a Jay-Z concert in NYC, and so much more.
Syntax: Do You Read The Code?
Auto-accept on, brain off? We're getting into whether anyone actually reads the code they ship anymore — then it's HTTP's first new method in 16 years (meet QUERY) and OpenAI's compute-hungry "Sol Ultra" tier landing in Codex.
|
|
You can't find a bug you never named
There's a post going around arguing that every project should ship an invariants.md. I agree. What convinced me wasn't a blog post, though. It was a SELECT statement.
The Cache Stampede: How One Expired Key Doomed Our Redis Cluster
Using object caching in Redis is extremely important in case there is a need to speed up any application with high load… until one expires a key when traffic is high.
When a password sync is 'partly done', it's a bug: converging on one canonical flow
Two apps each had their own password-change/reset logic, plus config toggles to enable/disable backends. That combination quietly allowed partial syncs.
7 Unconventional (But Surprisingly Effective) Ways to Get Better at Coding
Ten years ago, coding only meant learning languages.I was learning C#, keeping up with PHP, and sneaking into Python.I thought coding was only about symbols and lines of code.
How Claude Changed the Way I Build WordPress Products
Today, I use Claude as a development partner rather than a code generator. The biggest improvement hasn't been writing code faster—it's making better architectural decisions before writing code at all.
|
Interesting Projects, Tools and Libraries
thecodingmachine/graphqlite-symfony-validator-bridge
A bridge to use Symfony validator with GraphQLite.
simplehtmldom/simplehtmldom
A fast, simple and reliable HTML document parser for PHP.
optimizely/optimizely-sdk
Optimizely PHP SDK for Optimizely Feature Experimentation, Optimizely Full Stack (legacy), and Optimizely Rollouts.
alleyinteractive/wp-type-extensions
PHP interfaces and implementations for WordPress.
jordanbrauer/unit-converter
Convert standard units from one to another with this easy to use, lightweight package.
fresh/datetime
PHP library that provides additional functions for processing dates & times.
stefanak-michal/bolt
PHP library to provide connectivity to graph database over TCP socket with Bolt specification.
php-standard-library/json
JSON encoding and decoding with typed exceptions and sensible defaults.
magento/composer-dependency-version-audit-plugin
Validating packages through a composer plugin.
konekt/address
Laravel module for handling countries, cities, addresses, people and organizations.
|
Jobs
------
Do you have a position that you would like to fill? PHP Weekly is ideal for targeting developers and the cost is only $75/week for an advert. Please let me know if you are interested by emailing me at [email protected] |
Please help us by clicking to our sponsor:
 Protect your PHP Code
Why not try SourceGuardian 17. Click here to download a 14 Day Trial copy. Protect your code using Windows, Linux or Mac and run everywhere with our free Loaders. |
So, how did you like this issue?
|
|
|
|
