Hi everyone,
It's our first edition for August and we have plenty of news and updates to share. Lots of new updates from the latest releases from PHP 8.2.33, 8.5.9, 8.3.33 & 8.4.24, as well as the announcement of the end of support for Symfony 8.0. Anne McCarthy Joins The PHP Foundation Board, and they also announced the launch of the PHP Onboarding Initiative Special Interest Group to provide space for collaborative problem solving. In Podcasts we have new episodes from No Compromises, and this week they discuss real pull request disagreement about where environment variables belong and why it actually matters. Laravel Podcast talk about Aaron Francis and his new role as Laravel's New VP of Marketing & Community. Finally in our Reading section we have articles on When to Upgrade vs Rewrite a CakePHP Application, Clean Transactions in the Application Layer, and Laravel Query Optimization.
We have all that and more, so we do hope you enjoy this week's newsletter. If you have an article, tutorial or podcast that you would like to be featured in our newsletter, feel free to reach out to us at [email protected].
All the best,
Adrian
|
Please help us by clicking to our sponsors:
Give Your Unused Startup a Second Chance
List your unfinished SaaS, app, or project for free. Sell it, find a co-founder, or let someone else bring it to life. No fees, no hassle - just new opportunities!
|
Articles
Laravel 13 PHP Attributes: Config That Lives With Your Code
You open a job class to work out why it hammered a third-party API twenty-five times before giving up. The answer is not in the class body.
You retyped the Schematron into PHP. How do you know you got it right?
Last time I wrote about a let variable thirty lines above an assertion that quietly inverted a rule, and made my validator report a bug on every credit note. A few people replied with versions of the same question, and it is the right one: if you cannot run the official file, and you retyped it into PHP by hand, what tells you the two still agree?
Human-in-the-Loop for Laravel AI Agents: Stop Your Agent Before It Refunds the Wrong Order
Your support agent has a refund tool. A customer sends a message that sounds close enough to a refund request, the model decides that's what it wants, and four thousand euros leaves your Stripe account before a human reads a single word of the conversation.
Skills Were Only Half the Answer: Upgrading to Agents, Skills and Commands
Back in February I wrote about agent-skills — a repo of SKILL.md files that taught Claude Code my Laravel conventions so I'd stop re-explaining Pest, Action classes and Livewire 4 every session.
Your Laravel Models Aren’t the Problem. Hidden Workflows Are.
Most Laravel applications do not become difficult to maintain because somebody made one obviously terrible architectural decision. They get there through dozens of small decisions that looked completely reasonable at the time.
Command Injection in PHP — When exec() Becomes an Attack Surface
One unsanitized argument reaching a shell function is all an attacker needs to own your server. Here's how command injection works, why blacklist filters always fail, and the fixes that actually stop it. This is the ninth article in a series on PHP and Laravel application security.
7 Laravel Features I Started Using After Several Years (And Wish I’d Found Sooner)
The first “real” Laravel app I shipped had a controller method that was 214 lines long. I know because I counted it recently, out of morbid curiosity, while migrating that project off Laravel 8.
|
Tutorials and Talks
When "select all" checkboxes don't actually select anything — verifying after `check()`, not just trusting it
WordPress's plugin and theme update screens both have a "select all" checkbox. Calling check() on it with Playwright succeeds — no error, no exception. But look at the individual checkboxes afterward, and sometimes none of them are actually checked.
Building a Sliding Window Rate Limiter for a Video API With Redis
Last month our trending-videos endpoint started returning garbage latency numbers. Not because the queries got slower, but because a handful of clients discovered they could hammer /api/v1/trending?region=DE a few thousand times a minute and our fixed-window rate limiter happily let them through in bursts.
The Easiest Way to Look Up GeoIP in Laravel
IP location data is useful when your Laravel application needs a sensible regional default, timezone context, analytics enrichment, or an additional risk signal. The integration does not need a large package or a complicated SDK.
Atomic Money: Making a PHP/MySQL Wallet Safe Under Concurrency
The lost-update bug that quietly corrupts homegrown wallet balances — and the five disciplines we used across PayWithToken to make money movement correct under concurrency.
When `update-core.php` version scraping goes wrong — telling a plugin version number apart from WordPress core
On hosting without SSH access, a common pattern is to open update-core.php (the WordPress update screen) with Playwright and read "what version is WordPress core currently running" straight off the page text.
Building an embedded Shopify app in Symfony: session tokens, token exchange, and the parts nobody writes in PHP
Shopify's app documentation has exactly one first-class path: Node, the official CLI, and a Remix template that wires authentication for you.
|
News and Announcements
Laravel AI SDK Adds Human-in-the-Loop Tool Approval
At Laracon US 2026 in Boston, the Laravel team announced a human-in-the-loop (HITL) API for the Laravel AI SDK. Agents can now pause before executing a tool and wait for a person to approve it, reject it, or edit its arguments. The feature landed in laravel/ai#773 and shipped in v0.10.0 on July 21.
PHP 8.2.33, 8.5.9, 8.3.33 & 8.4.24 Released!
The PHP development team announces the immediate availability of 8.2.33, 8.5.9, 8.3.33 & 8.4.24. This is a security release. All PHP 8.4 users are encouraged to upgrade to this version.
PHP 8.6.0 Alpha 3 available for testing
The PHP team is pleased to announce the second testing release of PHP 8.6.0, Alpha 3. This continues the PHP 8.6 release cycle, the rough outline of which is specified in the PHP Wiki.
Symfony UX 3.4.0 released
Symfony UX 3.4 expands Toolkit with a Bootstrap 5.3 kit, reusable design-system-agnostic behaviors and richer documentation for kit authors. The release also adds dynamic Twig component names, safer on-demand icons, modern React and Vue bundler support and a stable Translator component.
Symfony 6.4.43, 7.4.15, 8.0.16 and 8.1.3 Released
Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.
July 27 – August 2, 2026 - A Week of Symfony #1022
This week, Symfony 6.4.43, 7.4.15, 8.0.16 and 8.1.3 maintenance versions were released. In addition, Symfony 8.0 reached its end of life. Finally, we introduced Symfony Reprise, the evolution of Webpack Encore for modern bundlers such as Vite and Rsbuild.
Symfony 8.0 reaches its end of maintenance
Symfony 8.0.16 was released on July 29, 2026. It is the last release of the 8.0 branch. Symfony's release policy gives standard versions eight months of support, with bug fixes and security fixes ending at the same time. Symfony 8.0.0 was published on November 27, 2025, so the branch closes at the end of July 2026, right on schedule. From now on, no further bug fix or security release will be published for 8.0, and the branch is frozen.
Anne McCarthy Joins The PHP Foundation Board
Anne brings 15 years of technical and open source experience, and has spent the last 12 years at Automattic, dedicated to improving the experience of the Wordpress community of users and contributors alike.
Kicking off the PHP Onboarding Initiative Special Interest Group
One of the most common pieces of feedback we hear from the PHP community is that the newcomer experience could use some improvement, and that we may be losing new users because of it.
This Week In PHP Internals | July 29, 2026
42 RFC ballots are open at once in PHP internals. This week: list() is losing its deprecation ballot, the dechunk filter split the room, a first-time author's pipe assignment operator went to a vote dead even, a literal scalar types ballot lasted 18 minutes, and PHP 8.6's feature freeze is 2 weeks out. Recorded at Laracon US in Boston.
|
Podcasts and Vlogs
The Stack Overflow: Your MVP doesn’t need a Kubernetes cluster
Ryan welcomes Anurag Goel, CEO and co-founder of Render, to discuss why most startups shouldn’t start by managing their Kubernetes and cloud infrastructure.
No Compromises Podcast: Where do credentials end and configuration begin in your env file?
In the latest episode of the No Compromises podcast, we discuss a real pull request disagreement about where environment variables belong and why it actually matters.
Maintainable Podcast: Diana Pfeil: Building Confidence in Probabilistic Systems
Diana Pfeil of Sunbeam Consulting joins Robby Russell on Maintainable to explain how changing data, model behavior, and non-deterministic outputs create a different kind of maintenance challenge.
Software Engineering Radio: SE Radio 731: Sonali Varde on AI and the Engineering Manager Role
Sonali Varde, Senior Software Engineering Manager at LinkedIn, joins host Kanchan Shringi to discuss how AI is changing the role of the engineering manager. They explore how AI is showing up in day-to-day management work, including operational reviews, planning, communication, workflow automation, and preparation for leadership discussions.
Shoptalk Show: Be More Weird, Sameness is Ok, and People Noticing the Effort You Put In
We're checking on quarter 3 KPIs, using AI for admin dashboards is kind of fun, being a weirdo is something we should aspire to, there's a reason things sometimes all look the same and that's ok, people see the effort you put in to your creativity on the web, and thoughts on generating a random post on a static site generator.
WP Builds: 478 – Inside WordPress 7.1 – responsive styling, new blocks, media modal and behind-the-scenes changes
Birgit Pauli-Haack and Anne McCarthy joined this “At The Core” episode to highlight what’s ahead in WordPress 7.1.
Laravel Podcast: Aaron Francis Is Laravel's New VP of Marketing & Community
In this episode, Matt Stauffer sits down with Aaron Francis — just days before his first day — to explore his journey from programmer and entrepreneur to VP of Marketing and Community at Laravel.
PHP Architect: The PHP Podcast 2026.07.30
Time travel is real, birds aren’t. The gang argues about Fahrenheit vs. Celsius, boiling rocks, and stones (the weight kind), then gets into PSR-3 logging, the PHP ecosystem, AI slop bug reports, Codeberg’s anti-AI stance, and Laravel Cloud’s scale-to-zero magic.
Mostly Technical: 142: Aaron's a VP at Laravel?!
Ian and Aaron are back after Laracon US to talk about....Aaron's new job as VP of Marketing & Community at Laravel?!
Syntax: OpenAI Agent Hacks Hugging Face
A rogue OpenAI agent allegedly hacks Hugging Face, the React Compiler lands in Rust, and a fresh Rust full-stack framework ships.
|
|
When to Upgrade vs Rewrite a CakePHP Application
One of the most common questions we hear from teams maintaining older CakePHP applications is: Should we upgrade this application, or should we rewrite it? It is an important question because the wrong decision can be expensive.
One locale code silently killed 92% of a Magento Shopware migration — and the tool reported Done
13,154 orders in. 1 order out. The source was an anonymised copy of a real Magento CE store: 3 websites, 13 store views, 7 languages including Simplified and Traditional Chinese, 7,629 products, 6,960 customers.
Your A/B test has three goals and they disagree. Now what?
Every A/B testing tutorial ends the same way: run the test, wait for significance, ship the winner. Then you run a real test and variant B converts 12% better on newsletter signups, brings in 4% less revenue per visitor, and bounce is flat. Nothing is significant except the signups. Ship it?
Laravel image jobs need idempotency before they need new APIs
Laravel getting first-party image processing is useful, but it also creates the wrong instinct in a lot of teams. They start thinking the hard part is finally solved because the resize and transform layer is now closer to the framework.
Clean Transactions in the Application Layer
In a Hexagonal codebase, one rule keeps coming back: the core (domain + application) must not depend on infrastructure. But a database transaction is infrastructure. So how do we run a unit of work spanning several entities without injecting Doctrine’s EntityManager into an application service?
DTOs in Symfony: Definition, Best Practices, and Automatic Mapping & Validation
From manual request parsing to declarative, type-safe controllers — with a look inside Symfony’s mapping internals.
Laravel Query Optimization: 12 Practical Techniques to Make Your Application Faster
If you’re building Laravel applications, learning how to optimize database queries is one of the highest-impact skills you can develop.
|
Interesting Projects, Tools and Libraries
flarum/json-api-server
A fully automated JSON:API server implementation in PHP.
patchlevel/event-sourcing
A lightweight but also all-inclusive event sourcing library with a focus on developer experience.
spatie/laravel-mail-preview
A mail driver to quickly preview mail.
friendsofcake/bootstrap-ui
Bootstrap front-end framework support for CakePHP.
wp-cli/ability-command
Lists, inspects, and executes abilities registered via the WordPress Abilities API.
webignition/symfony-console-typed-input
Symfony InputInterface providing type-specific getters for options and arguments.
utopia-php/storage
A simple Storage library to manage application storage.
valorin/random
Random is a simple helper package designed to make it easy to generate a range of different cryptographically secure random values.
codeat3/blade-google-material-design-icons
A package to easily make use of "Google Fonts Material Icons" in your Laravel Blade views.
dotswan/filament-map-picker
Easily pick and retrieve geo-coordinates using a map-based interface in your Filament applications.
|
Jobs
------
Do you have a position that you would like to fill? PHP Weekly is ideal for targeting developers and the cost is only $75/week for an advert. Please let me know if you are interested by emailing me at [email protected] |
Please help us by clicking to our sponsor:
 Protect your PHP Code
Why not try SourceGuardian 17. Click here to download a 14 Day Trial copy. Protect your code using Windows, Linux or Mac and run everywhere with our free Loaders. |
So, how did you like this issue?
|
|
|
|
