Hi everyone,
If you're on the lookout for weekly news on php, then you've come to the right place. This week we have articles on Laravel Octane Concurrency, Mass Assignment in PHP and Laravel, and the 5 Most Useful Array Functions in PHP. In Tutorials we have guides on Laravel Application Optimization, How to Test AI Agents in Laravel (Beyond Fakes), and How to Deploy a Symfony Application with Docker and FrankenPHP. Finally in our Reading section we have articles on Migrating from spatie/laravel-permission to Redis: A Production Playbook, How to Run Time-Consuming Tasks in the Background, and Why You Should Never Trust an Incoming Payload.
We have all that and more, so we do hope you enjoy this week's newsletter. If you have an article, tutorial or podcast that you would like to be featured in our newsletter, feel free to reach out to us at [email protected].
All the best,
Adrian
|
Please help us by clicking to our sponsors:
Give Your Unused Startup a Second Chance
List your unfinished SaaS, app, or project for free. Sell it, find a co-founder, or let someone else bring it to life. No fees, no hassle - just new opportunities!
|
Articles
Laravel AI: Trace Agent Runs With Lifecycle Events
An agent run is rarely a single API call. The model returns tool calls, the SDK executes them, sends the results back, and repeats until the model finishes.
Sanitize Twice: Why One Pass Isn't Enough for Rich-Text Email
TL;DR — I sanitize rich-text email bodies when they're saved. Today I added a second pass at render time, and it isn't belt-and-braces paranoia — it's an ordering bug.
Breaking the Speed Limit: Laravel Octane Concurrency
For over two decades, PHP has dominated the web using a very specific architectural paradigm: the "Shared-Nothing" request lifecycle. When an HTTP request hits a traditional Nginx and PHP-FPM stack, PHP spins up a completely fresh environment.
Magento 2 Product Reviews Performance: The Hidden Cron & N+1 Bottleneck
Product reviews look innocent. A star rating in the listing, a list of comments on the product page, an admin grid to moderate them. What could possibly be slow about that?
Row-level security in Symfony: the role that ran your migrations bypasses every policy you wrote
A comment on my last article was better than the article. The subject was single-database multi-tenancy, and @to21as argued that the predicate should not live in the ORM at all: put it in Postgres as a row-level security policy, and a Messenger worker, a line of native SQL and an ad-hoc psql session all get the same WHERE clause whether anyone remembered it or not.
WordPress Security Hardening: A 10-Step Technical Checklist
WordPress powers 40%+ of the web, which also makes it the most heavily targeted CMS by automated attack tools. Most compromises aren't sophisticated — outdated core/plugin versions, weak admin credentials, or nulled plugins with backdoors baked in. Here's a hardening checklist ordered by priority.
Mass Assignment in PHP and Laravel — When User Input Becomes More Than It Should
No SQL injection. No XSS. No path traversal. Just an unexpected field in a legitimate request and suddenly a user may be modifying data they were never supposed to control.
5 Most Useful Array Functions in PHP
In this article, we’ll explore the five most useful array functions that every PHP developer should know.
|
Tutorials and Talks
Your PrestaShop hook renders nothing, and nothing is logged
A module hook that returns an empty string looks exactly like a module hook that was never called. PrestaShop gives you nothing to tell them apart: no error, no log entry, no stack trace, no fallback text. The page renders fine. Your block is just absent.
Laravel Application Optimization
A. Database & Eloquent Optimization.
Building a Custom REST API in WordPress the Right Way
WordPress is often treated as a traditional CMS, but its REST API makes it possible to use WordPress as the backend for applications, dashboards, mobile clients, automation systems, and external services.
How I Approach Appointment Slot Optimization in Laravel When Services Have Different Durations
In this article, I'll explain the approach I use when designing this type of scheduling logic in Laravel.
Advanced WordPress Performance Optimization: A Developer's Guide
This guide looks at WordPress performance from the developer's perspective, from the server and PHP layer through database queries, assets, caching, and external services.
When My Laravel Queue Kept Stopping, the Queue Wasn't the Real Problem
I had a Laravel application connected to Make.com. Make.com was sending requests every 30 minutes, and Laravel was processing them through a queue. Everything worked — until the server restarted.
How to Test AI Agents in Laravel (Beyond Fakes)
Your test suite is green. All twelve AI tests pass, none of them touch a provider, and the whole run takes 200ms. Then someone tightens a system prompt on Tuesday, and three weeks later a customer forwards you a support reply that confidently invented a refund policy you do not have.
How I Debugged a phpMyAdmin 500 Error While Importing a Large SQL File on Laragon
I recently ran into a weird issue while working on a Laravel project on Windows using Laragon.
How to Deploy a Symfony Application with Docker and FrankenPHP
For a long time, I deployed my Symfony applications the traditional way: PHP installed directly on the server, a web server such as Nginx or Apache, Composer installed on the machine, and a database configured separately.
The Right Way to Handle Exceptions in Laravel 13's
A closer look at a common Laravel exception handling setup — and the four subtle bugs hiding in it, from a env() config-cache trap to swallowed HTTP status codes, plus the fixed version you can drop into bootstrap/app.php. |
News and Announcements
So You Received a Security Report. Now What?
You maintain a PHP project. Someone (maybe Volker from the PHP Foundation, maybe an independent researcher) has just told you that your project may have a security vulnerability. You might be feeling overwhelmed, or unsure whether you can trust the report, or simply unsure what the correct next step is.
Agent Run Observability in Laravel AI SDK 0.11
Laravel AI v0.11.0 gives an agent run a single correlation ID and a set of lifecycle events that fire around every provider round-trip and every tool call. Until now, a run that took five round-trips to resolve its tool calls looked identical to one that took a single call, and a run that died in the gateway reported nothing. The release landed on August 19, 2026 with 36 merged pull requests and twelve first-time contributors.
Symfony 8.1.5, 7.4.17 & 6.4.44 released
Symfony 8.1.5 7.4.17 & 6.4.44 have just been released. Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.
August 17–23, 2026 - A Week of Symfony #1025
This week, Symfony 6.4.44, Symfony 7.4.17 and Symfony 8.1.5 maintenance versions were released. In addition, we introduced Symfony Language Tools, the official Symfony LSP server. Finally, we started experimenting with issue-first open source contributions.
This Week In PHP Internals | August 19, 2026
No RFC went to a vote this week — nothing was in the voting phase at all — so the list spent it on design. A new contributor's array_search_range() ran into a counter-proposal for a general lazy array slice, a one-line ini_get_all() inconsistency turned into a case-sensitivity argument its own author withdrew, and PHP 8.6 beta 1 shipped.
|
Podcasts and Vlogs
The Stack Overflow: Inside LinkedIn's cognitive memory agent for agentic personalization
Ryan is joined by Praveen Bodigutla, Principal AI Researcher at LinkedIn, to chat about the four-layer memory system his team built to give LinkedIn's hiring assistant a persistent, personalized state.
Software Engineering Radio: SE Radio 734: Sathiesh Veera on Engineering Data-Protection Guardrails with LLMs
Sathiesh Veera, a GenAI Solutions Architect at At&T, speaks with host Brijesh Ammanath about the data-protection guardrails required when using LLMs. The core issue is that LLMs sit outside the cloud tenant in most enterprise AI deployments, which means that data leaves the company’s perimeter with every prompt, RAG retrieval, and tool call.
Developer Tea: Why Reducing Complexity Is A Sign of Seniority
As you grow as an engineer, something counterintuitive happens: the systems you build get simpler, not more complex. In this episode, I explore why senior engineers tend to collapse abstractions, accept certain risks, and reduce the surface area they're responsible for — and what drives that shift underneath the surface.
Shoptalk Show: After Dark Edition! Microlighter, Tri-state Drama, and Editing Video Quickly
Dave and Chris try to get their LUTS in a row, figure out which app to use to edit and publish video quickly, Dave's new syntax highlighter microlighter, could web MCP be a good thing to help agents use CodePen better, and saying no is as important as what you do ship.
WP Builds: 481 – A new video hosting solution for WordPress users and Vimeo refugees
The conversation focused on Livid, a newly launched video hosting platform positioned as a strong alternative to Vimeo, especially for users facing steep price increases following Vimeo’s acquisition by Bending Spoons.
PHP Architect: The PHP Podcast 2026.08.20
Shirley MacLaine is the answer — but what’s the question? RAM prices went up 500%, GitHub fell over for eight hours, and the crew figured out how you can actually contribute to PHP. Glasses optional.
Mostly Technical: 146: Do Things & Tell People
Ian and Aaron discuss Aaron's trip to Copenhagen for Laravel Live DK, meeting DHH, having "the hell trip home", using AI to beat Air Canada's bureaucracy, and so much more.
Syntax: Stripe Buys OpenRouter for $7B
Scott and CJ break down Stripe's $7B acquisition of OpenRouter, the SvelteKit 3 release candidate, and their first look at TanStack Charts.
|
|
Beyond CRUD: Event Sourcing Architecture in Laravel
The vast majority of web applications are built on the CRUD paradigm (Create, Read, Update, Delete). If a user updates their shipping address, you run an UPDATE SQL query on the users table. The old address is overwritten, permanently destroyed, and replaced by the new address.
The Active Flag Trap: unvalidated-but-logged-in in CakeDC/Users
If you ship email validation with CakeDC/Users, you eventually hit a question the plugin quietly hands back to you: what should happen when someone registers, never clicks the validation link, and then tries to log in?
Migrating from spatie/laravel-permission to Redis: A Production Playbook
spatie/laravel-permission is the de facto standard for roles and permissions in Laravel, and for most apps it is exactly the right choice. This post is for the minority case: your authorization checks are a measurable share of your database load, or permission changes at scale keep triggering full cache reloads.
When `@deprecated` cries wolf: Making Shopware’s next major upgrades easier
When PHPStan reports that your extension calls a deprecated method, the expected next step is quite clear: find the replacement and migrate your code.
Laravel Queue Jobs Explained: How to Run Time-Consuming Tasks in the Background
When I first started building Laravel applications, I eventually ran into a problem that looked simple but had a big impact on performance: some tasks were taking too long to finish.
Webhook Security 101: Why You Should Never Trust an Incoming Payload
Webhooks are the connective tissue of modern web ecosystems. Whether you are receiving payment confirmations from Stripe, message delivery reports from telecommunication providers, or repository events from GitHub, webhooks allow your application to react to external triggers in real-time.
|
Interesting Projects, Tools and Libraries
violet/streaming-json-encoder
Library for iteratively encoding large JSON documents piece by piece.
dotswan/filament-map-picker
Easily pick and retrieve geo-coordinates using a map-based interface in your Filament applications.
dektrium/yii2-user
Flexible user registration and authentication module for Yii2.
wp-forge/wp-query-builder
A lightweight and efficient SQL query builder for WordPress.
utopia-php/system
A simple library for obtaining information about the host's system.
erag/laravel-disposable-email
A Laravel package to detect and block disposable email addresses.
php-translation/symfony-storage
A translation file storage using Symfony translation component.
editorconfig-checker/editorconfig-checker
A tool to verify that your files follow the rules of your .editorconfig.
chromatic/php-gd-config-check
Composer plugin to check for the presence and status of specified formats for the PHP GD library.
genealabs/laravel-caffeine
Keeping Your Laravel Forms Awake.
|
Jobs
------
Do you have a position that you would like to fill? PHP Weekly is ideal for targeting developers and the cost is only $75/week for an advert. Please let me know if you are interested by emailing me at [email protected] |
Please help us by clicking to our sponsor:
 Protect your PHP Code
Why not try SourceGuardian 17. Click here to download a 14 Day Trial copy. Protect your code using Windows, Linux or Mac and run everywhere with our free Loaders. |
So, how did you like this issue?
|
|
|
|
