Hi everyone,
Well that was an awful 24 hours in the PHP world! After having very little sleep last night, I thought I’d drop a quick message hoping that you are all ok, that your sites and your client websites are OK and that you are not too stressed. It’s an interesting world that we live in that AI vulnerabilities can be found that have been there all this time. What was also interesting is how quickly the PHP community comes together to create solutions to mitigate the issues. Personally I sat on Hacker News and X for much of yesterday reading and occasionally writing to help other people.
I am keeping this short today, as I am sure you all have a lot to do. There’s quite a bit in this issue, should you have the time to read
As ever, I would love to hear from you. If you have anything to contribute, please drop us an email to [email protected].
All the best,
Adrian
|
Please help us by clicking to our sponsors:
Give Your Unused Startup a Second Chance
List your unfinished SaaS, app, or project for free. Sell it, find a co-founder, or let someone else bring it to life. No fees, no hassle - just new opportunities!
|
Articles
PHP Enums From the Query String: tryFrom() vs from()
You add ?status=paid filtering to an endpoint, write Status::from($_GET['status']), and it works. Then somebody requests ?status=PAID or ?status=refunded and the page returns a 500, because from() throws on any value it does not recognise. The fix everyone gives is "use tryFrom()", and it is correct for string-backed enums. For int-backed enums it is only half the story, and I tested exactly where it breaks on PHP 8.3.
Symfony 8.0 Got 8 Months of Support. Your Upgrade Bill Depends on Where Symfony Lives
Symfony 8.0.0 came out on November 27, 2025. On July 29, 2026, the project shipped 8.0.16, its last release, and the branch closed at the end of the month: no more bug fixes, no more security fixes. That is the whole life of a major version, eight months, according to Symfony's own end-of-maintenance post. The 8.0 release page now says "Unmaintained" and tells you to move to 8.1.
WordPress in late 2026: what's new since 7.0 and what to check before you update
WordPress has moved fast this year. Version 7.0 arrived on May 20 and 7.1 followed on August 19, so if you look after client sites, here is a plain summary of what matters.
Symfony AI in 2026: Did the 'School Bus' Actually Get Rocket Boosters?
Back in my last post ('Symfony AI: A Rocket, a School Bus, or Something In Between?'), we dug into the community's hot takes. We asked whether Symfony AI was genuinely useful or just an HTTP wrapper trying to do too much in a synchronous PHP world.
AI Agents Broke Into 100+ Sites at About $50 Each. The Confirmed One Used Old PHP Flaws
One operator, fewer than 100 Chinese characters of instructions, and roughly $5,000 in tokens. By the estimate Reuters reported on October 19 (via BNN Bloomberg), that was enough for AI agents to break into websites belonging to more than 100 companies, at around $50 in tokens per successful hack.
The N+1 Query Problem in Laravel: The Silent Performance Killer
Your Laravel code works perfectly, but your API is slow. Here’s one common reason why — and how to fix it.
|
Tutorials and Talks
Run Large PlanetScale Queries in Laravel With DB::olap()
PlanetScale's MySQL databases run on Vitess, which limits each query in its default OLTP workload. On PlanetScale, a query can return, update, or delete at most 100,000 rows, and the result set can be at most 64 MiB. A reporting query or a CSV export over a large table can fail on those limits, even though the same query runs fine on a local MySQL server.
Fluent Rule Builders for All Laravel Validation Rules
Many Laravel validation rules are written as strings, with parameters after a colon split by commas. A rule like required_without:email works, but your editor cannot autocomplete it, and a misspelled rule name only fails when the validator runs.
The Basics of `$wpdb->prepare()` — Why You Should Never Build SQL Queries With String Concatenation
When a WordPress plugin or theme needs to talk to the database directly, it uses the core-provided global object $wpdb. The one thing to absolutely avoid when doing so is dropping user input straight into a SQL string through concatenation.
WordPress Hooks Explained: How Plugins and Themes Extend Core Without Editing It
WordPress plugins and themes change what gets displayed and how data gets processed without ever touching WordPress core's own files (the code under wp-includes / wp-admin). What makes that possible is a mechanism called hooks, which come in two flavors: actions and filters. This blog's own theme, wpmm-blog, uses both extensively in its functions.php, so this article walks through real code from it.
Catch Silent Outbound Failures When Dispatching Telegram Messages via PHP cURL
When an order is placed on your web application or a user requests a notification through a Telegram bot, your backend needs to send an outbound message using the Telegram Bot API. Developers often reach for quick implementations like file_get_contents or a basic curl_exec script. On the surface, if the token is correct and the target chat ID is valid, the message delivers instantly.
How to Retrieve Data From Database Using Vue in Laravel
Learn how to fetch MySQL records in Laravel using Vue 3, Eloquent, JSON routes, and the Fetch API, with working code and fixes for common errors.
How to Connect Your App to an SMM Panel API (PHP and Python Examples)
In this post I will show the full flow with working PHP and Python code: list services, check balance, place an order and track its status.
How to Solve Google v3 reCAPTCHA Timeout in PHP Forms
Why does your reCAPTCHA v3 form work when you submit it quickly but fail when a user takes their time? It's because the token has already expired. If you've been searching for how to solve google v3 recaptcha timeout?, the fix is less about server settings and more about when your JavaScript asks Google for the token. |
News and Announcements
Rule Builders for Every Validation Rule in Laravel 13.36
The Laravel team released v13.36.0 with Rule:: builders for the validation rules that only had string syntax, DB::olap() for large queries on PlanetScale and other Vitess databases, an opt-in reset of sticky database connections between queue jobs, synchronous Mercure broadcasts by default, and more.
Critical Token Guard Auth Bypass Fixed in Laravel 13.29 and 12.68
Laravel has published a critical security advisory for its token-based API guard. On MySQL and MariaDB, an unauthenticated attacker could authenticate as an existing user without knowing that user's API token. Hristijan Manasijev reported the issue, and the fix is in Laravel 12.68.0 and 13.29.0.
October 12–18, 2026 - A Week of Symfony #1033
This week, Symfony 5.4.54, 6.4.48, 7.4.21, and 8.1.9 maintenance versions were released, along with three security fixes for HttpFoundation, ExpressionLanguage, and Yaml. We also released Symfony UX 3.6, which adds three experimental packages: UX Inspector, UX Image, and UX Router. Meanwhile, we kept publishing articles about Symfony 8.2 features, such as proving authentication methods, safer logout, attribute-based workflows, encrypted Doctrine columns, and locking controllers, and we added a new JsonSchema component.
How the PHP Security Team Handles Your Reports
If you've ever sent a security report to PHP and then refreshed the advisory page every morning for three weeks, hi, this one's for you, and yes, we read it. PHP runs a large share of the web, so keeping it secure and staying responsive matters far beyond this project, and we take that seriously.
SymfonyCon Warsaw 2026
The ultimate gathering for PHP enthusiasts is heading to Poland! On November 26-27, SymfonyCon Warsaw 2026 delivers two full days of technical insights, 3 parallel tracks, and rich networking opportunities. Reserve your seat with the global community!
|
Podcasts and Vlogs
The Stack Overflow: Don't forget about the UI for AI
Recorded at OpenAI Dev Day 2026, Ryan sits down with Andrew Ambrosino, member of the technical staff at OpenAI, for a conversation on OpenAI's strategy for merging ChatGPT and Codex into a unified experience.
North Meets South Podcast: Whacking trees, conference operations, and AI tests
In this episode, Jake and Michael discuss the value of consistency, the final preparations for Laracon AU, and how AI is changing the economics of building software.
Software Engineering Radio: SE Radio 742: Tim Varelmann on Mathematical Optimization for Software Engineers
Tim Varelmann, the founder of Bluebird Optimization, which helps companies automate complex decision-making, speaks with host Sriram Panyam about mathematical optimization.
Shoptalk Show: 737: CSS alpha(), SVG with linked-parameters, and Arguing with Humans
On this episode we're chatting about how to make modern tooling more collaborative and human-friendly, CSS alpha() and color-mix() features, Chris quizzes Dave on SVG features, voting for interop, CodePen + AI tools, and how to detect when elements overlap with CSS.
WP Builds: 485 – WP Builds hijack – how show.fm simplifies podcasting for WordPress creators
Today, Marc Benzakein from MainWP takes over the podcast for a chat about Nathan (and Dan Maby’s) new podcasting app: show.fm. We get into why it was built, what it does and how it’ll save you loads of time by removing so many of the boring parts of a podcasters life.
PHP Architect: The PHP Podcast 2026.10.15
Longhorn PHP kicks off, agentic commerce gets scary, bots keep scanning, and a Cold War satellite schematic proves software is harder than hardware.
Mostly Technical: 154: Ian Laravel New'd Again!
Ian and Aaron talk about Laravel New'ing....again....and what that means for Outro, plus huge updates coming to Solo, Aaron's generative universe, and more.
Syntax: Deno Is Dead
Deno is shutting down and the team is heading to Cloudflare — Scott, Wes, and CJ break down what that means for the runtime, JSR, and workerd. Plus OpenCode 2.0 on durable objects, TanStack Start 1.0, SubQ Snap, Gemini 4 Argon, and Wes's accidental $50 photo frame movement.
|
|
False Affordance in WordPress (4wp.dev Methodologies): When UI Promises What Code Doesn't Deliver
A "Show more" button on my own portfolio showed nothing, and the console stayed clean. This post is the write-up: what a false affordance is, why it slips into WordPress themes and plugins, and how to fix it in a classic PHP template and in a block theme (FSE) with a Query Loop + JS. It is part of the Methodologies series on 4wp.dev.
What we learned running WordPress on Cloudflare Workers
The usual answer to "can WordPress run on Cloudflare?" is no: Workers run JavaScript and WebAssembly, WordPress needs PHP and MySQL, so you either export a static copy or keep a server. That answer is out of date. The WordPress Playground project builds PHP for WebAssembly, and that build runs inside a Worker.
Pin a Legacy Laravel Controller With Golden-Master Tests, Then Extract the Use Case
The ticket says "add a corporate tier to order quotes." You open QuoteController::store and it is 300 lines of Eloquent calls, magic numbers and an if that checks whether today is a weekend. There are no tests. You know the pricing rules belong in a class of their own, and you also know that the first time you move a line, nothing will tell you whether a gold customer still gets the same total.
Drupal issues urgent security fixes for serious remote control issue
Drupal core addresses a critical remote code execution vulnerability in the Field UI module (CVE-2026-108097), alongside fixes for Link and Navigation module flaws. Learn which versions include the patches and how unsupported branches are affected.
One Symfony Form, Two Views: Read-Only Summaries Without Duplication
A form often has a second life. First, someone uses it to enter or update information. Then, somewhere else in the application, someone needs to read that same information: on a confirmation screen, an internal detail page, or a review step before submitting a request.
Why One Redis Key Per Counter Is Wasting Your Laravel App’s Memory
A simple change to how you store data in Redis, with Laravel code you can copy today.
|
Interesting Projects, Tools and Libraries
zetacomponents/cache
A solution for caching, supporting multiple backends allowing you to specify the best performing solution for your caching-problem.
codeat3/blade-simple-icons
A package to easily make use of "Simple Icons" in your Laravel Blade views.
craftcms/laravel-dependency-aware-cache
A dependency aware cache repository for Laravel.
visus/cuid2
A PHP library for generating collision-resistant ids (CUIDs).
wyrihaximus/html-compress
Compress/minify your HTML.
innocraft/php-experiments
PHP Experiments is a library that lets you run A/B and split tests.
tomatophp/filament-users
Manage your users with a highly customizable user resource for FilamentPHP with integration of filament-shield and filament-impersonate.
eliashaeussler/cache-warmup
Composer package to warm up website caches, based on a given XML sitemap.
meteo-concept/hcaptcha-bundle
A Symfony bundle to use hCaptcha in forms.
roots/multisite-url-fixer
Fixes WordPress issues with home and site URL on multisite when using Bedrock.
|
Jobs
------
Do you have a position that you would like to fill? PHP Weekly is ideal for targeting developers and the cost is only $75/week for an advert. Please let me know if you are interested by emailing me at [email protected] |
Please help us by clicking to our sponsor:
 Protect your PHP Code
Why not try SourceGuardian 17. Click here to download a 14 Day Trial copy. Protect your code using Windows, Linux or Mac and run everywhere with our free Loaders. |
So, how did you like this issue?
|
|
|
|
