Hi everyone,
If you're keen on working for the PHP Foundation, then you're in luck, because they're opening for applications for contractors for next year. Interested parties have 'till the 20th of this month to submit their application from anywhere in the world. Check out the news section for more details. This week in tutorials we have the Complete Guide to Laravel Events, REST API Authentication, and How to Upload Files and Reuse File IDs in Telegram Bot API with PHP. We have articles on Incremental Rewrite for Legacy PHP Applications, Domain Driven Design in Symfony, and What a PHP variable actually is. Finally in our Reading section we have another article handed in by Yannick Chenot on How to Train Your AI: A Short Tale of Context Engineering. We also have Prompt Injection Is a Laravel Problem Now, and You Should Use a Persistent Object Cache.
We have all that and more, so we do hope you enjoy this week's newsletter. If you have an article, tutorial or podcast that you would like to be featured in our newsletter, feel free to reach out to us at [email protected].
All the best,
Adrian
|
Please help us by clicking to our sponsors:
Give Your Unused Startup a Second Chance
List your unfinished SaaS, app, or project for free. Sell it, find a co-founder, or let someone else bring it to life. No fees, no hassle - just new opportunities!
|
Articles
What a PHP variable actually is
A zval is sixteen bytes, a value union and a type tag. What that tag says decides whether an assignment copies anything, what a reference costs, and which variable pays.
Incremental Rewrite for Legacy PHP Applications
Working with legacy CakePHP or Yii applications presents a specific set of challenges. These frameworks, while once robust, often run on unsupported PHP versions, rely on outdated libraries, and make it difficult to attract new development talent.
composer.json vs composer.lock in Laravel — The Story Behind Your Dependencies
One day, you join a Laravel project. You clone the repository, run: composer install. Everything works perfectly. A few days later, another developer joins the same project. He runs the same command.
Domain Driven Design in Symfony
Today, a coding harness like Claude Code or Codex makes generating code much more efficient and saves us a lot of time.
PHP Developer Roadmap 2026: From Core PHP to AI-Powered Backend
If you started with PHP just to build a contact form or a basic CRUD app and are now wondering whether PHP is still worth investing time in — the answer is yes. But the PHP ecosystem in 2026 looks nothing like it did five years ago.
Your Symfony Logs Are a Shadow Database of Personal Data
How PII escapes Doctrine into Monolog, Messenger failures, profiler traces and exception reports — and the allowlist pattern that closes the gap.
|
Tutorials and Talks
Decide with Jev: Three Questions in One Request with the Laravel AI SDK
A single yes or no doesn't tell you much about a draft. It can tell you the draft matches the brief, but not what kind of text it is or whether the steps are easy to follow. So in this episode of Decide with Jev, I ask Jev three questions about the same draft and still send only one request.
Building a Laravel CRUD API: Menu Categories for Django Developers
As a Django developer learning Laravel, I wanted to understand how Laravel handles CRUD APIs.
REST API Authentication: Cookie+Nonce vs. Application Passwords
This article looks at the mechanism behind that: cookie+nonce authentication, and a separate mechanism built for a different purpose, Application Passwords.
How to Upload Files and Reuse File IDs in Telegram Bot API with PHP
This guide demonstrates how to upload local files to Telegram using CURLFile (which sends a multipart/form-data request), how to extract and reuse the resulting file_id to save bandwidth, and when to use public URLs instead of direct uploads.
How I Built an AI Agent in PHP
I kept seeing AI agent projects built in Python with LangGraph. Every tutorial, every article, every repo. All Python. I have been working with PHP for years. So I wanted to know one thing. Can we do the same in PHP?
Laravel Environment Setup: PHP, Composer, .env, and Package Management
When starting a new Laravel project, many developers immediately run: composer create-project laravel/laravel my-app And start coding. But a Laravel application depends on several things working together:
Laravel Events: The Complete Guide (With What’s New in 2026)
Most Laravel apps grow the same way. A controller starts doing too much — creating a user, sending a welcome email, logging analytics, notifying a Slack channel — all in one method. Laravel’s event system exists specifically to pull that apart. |
News and Announcements
Laravel 14 Adds a defaults() Method to Eloquent Models
Eloquent models set default attribute values with the $attributes property. It works for fixed values, but PHP only allows constant expressions in a property's default value, so you cannot call config(), now(), or a feature flag there. Laravel 14 adds a defaults() method that returns the same array from code that runs when the model is created.
September 28 – October 4, 2026 - A Week of Symfony #1031
This week, Symfony 6.4.47, 7.4.20, and 8.1.8 were released, along with Symfony Reprise 1.3.0. Meanwhile, we continued introducing Symfony 8.2 features, including OpenID Connect login, PGP/MIME signed and encrypted emails, sudo mode, more flexible serialization groups, and performance improvements. Finally, we announced more talks for SymfonyCon Warsaw 2026.
2027 Applications for Contractors are Open
As we have done in past years, The PHP Foundation is opening applications for contractors for 2027. Foundation contractors are responsible for a variety of core development areas, and we are open to hearing your ideas. The application form will be open until October 20, 2026, end of day, Anywhere on Earth (AoE).
This Week in PHP Internals | Oct 1, 2026
Pick a password longer than 72 bytes and PHP's default hash keeps the first 72 and quietly drops the rest — so a shortened password can still log you in. Sjoerd Langkemper's new RFC would make password_hash() refuse instead, and the list can't agree it's worth the break. Plus: a regex object several people want renamed, Io\Terminal as a real RFC, a DateTime bridge for Time\Instant, Weilin Du's [=$x] array shorthand, Jakub Zelenka's IO Hooks for Fibers, and a contributor removed from the internals list.
SymfonyCon Warsaw 2026
The ultimate gathering for PHP enthusiasts is heading to Poland! On November 26-27, SymfonyCon Warsaw 2026 delivers two full days of technical insights, 3 parallel tracks, and rich networking opportunities. Reserve your seat with the global community!
|
Podcasts and Vlogs
The Stack Overflow: Tales from the 2026 Developer Survey results
Ryan chats with Erin Yepis, Senior Analyst at Stack Overflow, about the results from this year’s Annual Developer Survey, including the overwhelming daily usage of AI coding assistants despite lingering developer trust issues, the critical role of well-organized documentation in providing verifiable context to mitigate AI hallucinations.
Maintainable Podcast: Matija Šošić: Abstractions Aren’t Going Anywhere
What makes software maintainable might have less to do with how clean the code looks and more to do with how well it serves the people responsible for it. Matija Šošić, co-founder and CEO of Wasp, joins Robby to talk about boring and predictable code, resisting unnecessary abstractions, and why understanding the ugly parts of a system matters.
Developer Tea: How History Can Inform a Dynamic Understanding of Technological Revolutions Mirroring this Moment In Software Engineering
Fundamentals come up in every field, from sports to chess to software, but we rarely stop to define what a fundamental is. In this episode of Developer Tea, I look at why fundamentals matter now more than ever for software engineers, and why a profession built on layer after layer of abstraction makes that understanding so important.
Shoptalk Show: 735: Design System Docs, CodePen’s API, and Bucket Filling Conversations
Dave and Chris explore the evolving landscape of design systems, CodePen's new API features, what happens when an app moves your cheese and how to respond, and Regretful API's.
PHP Architect: The PHP Podcast 2026.10.01
It’s John’s birthday, so naturally he skipped. The PHP Foundation is hiring, 8.6 picks up a surprise RC, and the crew goes deep on ABI promises, deprecation pile-ups, generics, and a childhood firefighter who’s still “a hit.”
Mostly Technical: 152: Feel The AGI
Ian and Aaron discuss OpenAI's Dots, Aaron's trip to Denver, working with tests in the AI era, big things coming to Laravel, and a whole lot more.
Syntax: Ruby on Rails is Dead
Scott, Wes, and CJ ask whether Ruby on Rails is really dead (and whether Rust is just Rails you don't have to read), then dig into Meta's new Muse agent, which is free, comes with its own VM, and is already reading messages nobody asked it to.
|
|
How to Train Your AI: A Short Tale of Context Engineering
Most AI coding mistakes aren’t caused by bad prompts, but by missing context. A practical guide to context engineering and teaching AI agents how to write code that fits your codebase.
The Migration You Keep Postponing Is Cheaper Than the Setup You Keep Tolerating
Developers stay on infrastructure they hate for years. The fear is rational, the math usually isn't. A field guide to the migration myth.
You're a Tenant, Not the Owner: 6 Doors in Someone Else's wp-admin, and How Not to Be a Bad Neighbor
wp-admin isn't a blank canvas — it's a shared apartment building, and every active plugin is a tenant with a key. This is the etiquette guide nobody hands you, one rule per hook, from a real 4wp.dev deep dive.
Prompt Injection Is a Laravel Problem Now
A support ticket is plain text. So is a PDF a customer uploads, a webpage your app scrapes, an email it summarizes. None of it looks like code, which is exactly why an attacker can hide an instruction inside it: not a malicious file, not a malformed request, just a sentence a language model reads and follows like any other instruction in its context.
Doctrine Lifecycle Listeners Are a Dangerous Place for GDPR Erasure
Why I keep erasure explicit in the domain instead of hiding it in preRemove, preUpdate or a magical Doctrine subscriber.
You Should Use a Persistent Object Cache: WordPress Is Counting Rows, Not Measuring Speed
When WordPress Site Health prints “You should use a persistent object cache,” it has not found a fault. It sits under the Performance badge as a recommendation, never as a critical issue, and nothing in the test measures how fast your pages load or how many people visit them.
|
Interesting Projects, Tools and Libraries
sandermuller/laravel-fluent-validation
Fluent validation rule builders for Laravel.
arrilot/data-anonymization
Anonymize any data in your SQL database.
mariosimao/notion-sdk-php
A complete Notion SDK for PHP developers.
byjg/webrequest
A lightweight PSR-7 implementation and highly customized CURL wrapper for making REST calls.
menarasolutions/geographer
A PHP library that knows how any country, state or city is called in any language.
jeidison/signer-php
Open-source PHP library for PDF digital signing with multiple signatures, RFC3161 timestamping, PAdES profiles, and PDF protection.
fooman/emailattachments-implementation-m2
Automatically attach pdf and terms and conditions documents to outgoing sales emails.
caresome/filament-auth-designer
Transform Filament's default auth pages into stunning, brand-ready experiences.
ignited/laravel-omnipay
Integrates Omnipay with Laravel and provides an easy configuration.
flugger/laravel-responder
A Laravel Fractal package for building API responses, giving you the power of Fractal and the elegancy of Laravel.
|
Jobs
------
Do you have a position that you would like to fill? PHP Weekly is ideal for targeting developers and the cost is only $75/week for an advert. Please let me know if you are interested by emailing me at [email protected] |
Please help us by clicking to our sponsor:
 Protect your PHP Code
Why not try SourceGuardian 17. Click here to download a 14 Day Trial copy. Protect your code using Windows, Linux or Mac and run everywhere with our free Loaders. |
So, how did you like this issue?
|
|
|
|
