Hi everyone,
Two weeks in and we're still getting articles on PHP2Shell. For those who are late to the party, we still have plenty of articles for you to read and catch up. If you're already caught up we still have plenty for you to read about. In tutorials we have guides for PHP Allowed Memory Size Exhausted: Causes and Fixes, Three checks to see whether a site has been compromised: checksums, admin accounts, and PHP in uploads, and Laravel Spatie Packages: A Developer’s Quick Guide to 25+ Useful Packages. In Podcasts we have new episodes from North Meets South Podcast, and they discuss the final preparations for Laracon AU, using AI to build and rehearse conference presentations. Laravel Podcast has David Hemphill, while Ian and Aaron discuss a short-lived Laravel New and other topics on Mostly Technical. Finally in our Reading section we have articles on Embracing Imperfection through Open-Source Software, Rescuing a Non-Profit’s Legacy PHP Server, and Is PHP Still Safe to Use? Recent Security Issues, Updates & the Future of PHP.
We have all that and more, so we do hope you enjoy this week's newsletter. If you have an article, tutorial or podcast that you would like to be featured in our newsletter, feel free to reach out to us at [email protected].
All the best,
Adrian
|
Please help us by clicking to our sponsors:
Give Your Unused Startup a Second Chance
List your unfinished SaaS, app, or project for free. Sell it, find a co-founder, or let someone else bring it to life. No fees, no hassle - just new opportunities!
|
Articles
Four ways a WordPress site hands out its usernames, and the curl checks for each
Before anyone guesses a password, they need a username. On a default WordPress site, getting one is easy, and it costs the attacker nothing to try. So the first thing I check on a site I'm handed is how many of its usernames it gives away for free. There are four routes to look at. You can test each with curl from a machine that isn't logged in.
PHP2Shell: Why Laravel didn’t protect your app, and how I patched mine
All my client apps running PHP 8.4 in Docker were on 8.4.27, tested and redeployed, in under four hours. Getting there was mostly a waiting game, and the slowest part had nothing to do with the code.
Why WordPress Sites Get Hacked
WordPress core is not inherently insecure. It’s one of the most scrutinized codebases on the internet, maintained by a dedicated security team, with a formal disclosure process, bug bounties, and automatic background patching for security releases. Serious core vulnerabilities are rare, and when they appear they’re typically patched and auto-deployed to millions of sites within hours.
Exploitation Started Four Days Before the Patch: PHP2Shell and the End of the Patch Window
Attackers were recorded trying PHP2Shell on October 17, 2026. The patch shipped on October 21. If your exposure clock starts at disclosure, your clock is wrong by four days before you have done anything else.
One week after PHP2Shell: attacked in the wild, and now a Linux kernel flaw on top
A week later the question has changed: were you attacked in the meantime, and what can an attacker do once PHP is breached? 4 daysattacks reported before the patches came out50,000+exploitation requests tracked by TU Delft600+ / 70IP addresses / countries8new CISA KEV entries this week, 4 of them server software.
When Counting Overlapping Bookings Is Not Enough: Capacity-Aware Availability in PHP
Imagine you’re building a scheduling feature for a loading dock, a shared workspace, or a storage area.
10 Common Laravel Errors and How to Fix Them
In this article, I will discuss 10 common laravel errors, what causes them and how to solve them.
|
Tutorials and Talks
Decide with Jev: Tie Every AI Check to the Exact Draft
In this episode, we connect the checks to a small review screen. Every check saves a run with the text we sent and the answers we got back. The page also keeps a hash of the brief and the draft. When the text changes, the old result shows up as stale until you run the check again.
Delete Expired Sessions in Laravel With a Scheduled Command
If your Laravel app uses the database or file session driver, expired sessions stay in storage until Laravel deletes them. On Laravel 13.39 or later, you can delete them with the session:garbage-collect Artisan command on a schedule.
Why I proxy video downloads through my own server instead of hotlinking
Every video downloader has to answer one question: when the visitor clicks Download, does the file come from your server, or do you just hand the browser the provider's URL and get out of the way?
PHP2Shell: Simulating an Incident Response for 200+ EC2 Instances Using AWS Inspector, Systems Manager, and Terraform
When CVE-2026-109618 and CVE-2026-109619 — collectively known as "PHP2Shell" — dropped on October 21, 2026, I decided to build a full incident response simulation around them. The CVEs are real. The vulnerabilities are real. I constructed a realistic scenario — a fleet of 200+ PHP EC2 instances across multiple AWS accounts — and walked through every step of detection, containment, patching, and verification using real AWS services and production-ready configurations.
PHP2Shell: The PHP Vulnerability Everyone Is Talking About Right Now (And How to Fix It)
If you have been seeing "PHP hacked", "PHP vulnerability" or "PHP2Shell" everywhere lately — in tech news, on Twitter, or from developer friends — you are not imagining it.
PHP Allowed Memory Size Exhausted: Causes and Fixes
The quick fix is to raise memory_limit. The better fix is to find out why the script needs that much memory, because in most cases it is holding something it could have processed piece by piece. Here is how to read the message, raise the limit properly, and cut the memory use itself.
Upgrading an old PHP app in steps: the order we follow before PHP 8.2 runs out
A lot of the PHP apps we're asked to look at have the same story. They were built a few years ago, they still work, and nobody has touched the server's PHP version since launch.
What is a supply chain attack? When "just update" is not enough
Applying updates is the basis of maintenance. But reports show that the update itself can be tampered with, including around WordPress. This article looks at how supply chain attacks work using public information, then sorts out how to balance "apply quickly" with "wait a little", and how to reduce the scripts your site loads from outside. The aim is calm planning, not alarm.
App Store Listing Audits in PHP: Lookup API Checks for Titles, Screenshots and Release Notes, and the Walls You'll Hit (2026)
This post builds a small PHP command-line tool that does it. You give it your app id and a few rival ids. It pulls the public listing from Apple's iTunes Lookup API, runs about a dozen checks, prints a side-by-side table per storefront, and can write JSON for later. One file, around 100 lines, no framework, no Composer packages.
Three checks to see whether a site has been compromised: checksums, admin accounts, and PHP in uploads
Updates keep things out. But how do you check whether something is already in? This article walks through three checks you can run with WP-CLI: verifying core and plugin checksums, taking stock of administrator accounts, and looking for PHP files under uploads. We cover how to read each result and where it stops being useful. These checks are defensive routine work, and a clean result is not a guarantee of safety.
Laravel Spatie Packages: A Developer’s Quick Guide to 25+ Useful Packages
In this guide, we will explore some of the most useful Spatie packages, their purposes, practical use cases, and installation commands. |
News and Announcements
Compromised eMudhra Certificates: Update Your JetBrains IDEs, ReSharper, .NET Tools, Toolbox App, and Gateway Now
The private keys of eight eMudhra intermediate certificates were compromised. A network attacker could use them to impersonate websites and services that JetBrains tools connect to.
Cooldown Dependency Policy now in Composer 2.11
Composer 2.11.0 has a new cooldown dependency policy. You set a waiting time, such as one day, and Composer skips any package version published more recently than that. Composer 2.10 added the first dependency policies, which block versions with security advisories or known malware.
PIE 1.5 Changes PHP Extension Installs in CI
The PHP Installer for Extensions manages extensions for your PHP runtime. PIE 1.5 adds support for installing multiple extensions in one command, introduces an upgrade command, and changes how unattended installs select extension packages.
Scheduled Session Garbage Collection in Laravel 13.39
The Laravel team released v13.39.0 with a session garbage collection Artisan command, a way to turn off a model's primary key, job durations on the JobAttempted event, and more.
October 26 – November 1, 2026 - A Week of Symfony #1035
This week, Symfony 5.4.55, 6.4.49, 7.4.22, and 8.1.10 maintenance versions were released. We also released Symfony AI 1.0.0-BETA1 and kicked off the Symfony AI & MCP Hackathon, which runs until November 22. Meanwhile, we kept publishing articles about Symfony 8.2 features, such as the Messenger inbox, cross-application messaging, security expressions everywhere, and recovering from controller attribute failures. Finally, we shared the schedule highlights of SymfonyCon Warsaw 2026, which starts in less than a month.
Designed Once, Usable Everywhere: An Investment in PHP’s Standard Library
All PHP projects have one thing in common, regardless of whether they are built on a full-stack framework, on a microservice framework with carefully selected standalone libraries, or as an extension for a CMS: the PHP standard library. Functions such as str_replace() or array_map() and classes like DateTimeImmutable or Uri\Rfc3986\Uri from PHP 8.5 are always available, always work the same, and always have the same meaning. This makes PHP’s standard library a “lingua franca”, enabling specialized standalone libraries to seamlessly integrate into full-stack frameworks and allowing developers to transfer knowledge and experience across the different parts of PHP’s ecosystem.
This Week In PHP Internals | Oct 29, 2026
A week after two critical bugs in PHP's own engine, one developer asked the internals list to freeze new features and cosmetic deprecations until PHP has a formal spec and four independent implementations. Four people who work on PHP replied, and Larry Garfield called fixing PHP's bugs a money problem. Also this week: rebuilt Windows packages for the Brotli fix and a php.net advisory on session upload progress, a year of data on what happens to newcomers' pull requests in php-src, a Scope RFC that gives every request an identity, effect declarations for functions that run processes or touch the network, array_partition(), two votes heading in opposite directions, and more.
|
Podcasts and Vlogs
The Stack Overflow: Oh, your agents need OAuth2, too
Recorded at LDX3 by LeadDev, Ryan chats with Dan Moore, Senior Director of CIAM Strategy and Identity Standards at FusionAuth, about adapting established OAuth2 protocols for the agentic era, the security necessity of giving autonomous AI agents their own distinct identities, and how AI coding tools are shifting developers' focus toward solving core business problems.
North Meets South Podcast: Preparing conference talks, mentoring juniors, and planning projects
In this episode, Jake and Michael catch up on the final preparations for Laracon AU, using AI to build and rehearse conference presentations, and the tools and workflows making their lives easier.
Software Engineering Radio: SE Radio 744: Danilo Krummrich on Rust in the Linux Kernel
Danilo Krummrich, a software engineer at Red Hat, speaks with host Gregory M. Kapfhammer about the using the Rust programming language in the Linux kernel. After introducing the Nova project, which leverages Rust for building NVIDIA GPU drivers, they explore the benefits associated with Rust, such as GPU driver memory safety.
Shoptalk Show: How to Build a Great Puzzle Game with Josh Collinsworth
Triple (or maybe even quadruple?) threat Josh Collinsworth is back on the show to talk about his new game, Tupo. They cover how the puzzles are generated and kept fair, why the usual Sudoku pencil marks don't help, and what Josh's player data shows about hints and checks.
WP Builds: 487 – Building WordPress plugins: lessons from Newsletter Glue and EventKoi
Today Lesley Sim talks about transitioning from niche to mass-market WordPress plugins, comparing experiences building Newsletter Glue and EventKoi. She gets into learning to market in a competitive environment, experimenting with different strategies, and balancing short-term and long-term efforts.
Laravel Podcast: David Hemphill is Chasing Dopamine
Matt Stauffer catches up with David Hemphill, co-creator of Laravel Nova and creator of the Beard CSS framework. They cover David’s years as an amateur MMA fighter, his punk rock roots, and why he keeps chasing flow states.
PHP Architect: The PHP Podcast 2026.10.29
Patrick Stewart has passed. Tailscale handed out root. The PHP RCE patch landed. And MediaWiki contributer Brooke Vibber tells us how Wikipedia survives celebrity deaths, 500 languages, and Apple’s file system.
Mostly Technical: 156: Batten Down The Hatches
Ian and Aaron discuss a short-lived Laravel New, Aaron's first onsite with the marketing team, a successful trip to Philly, the seemingly inevitable security apocalypse, and more.
Syntax: Github Universe Keynote Recap
Scott, Wes, and CJ broadcast live from a fancy news-style set at GitHub Universe in San Francisco, covering the Syntax meetup swag, hacking the Pimoroni badges, and the keynote's explosive growth numbers, infrastructure rebuild, and Copilot announcements.
The Changelog: The future is Postgres
Craig Kerstiens returns to talk about the ever-expanding world of Postgres: a deliberately boring core, a thriving extension ecosystem, and pg_lake bringing DuckDB and Iceberg into the mix. We dig into the pain of ETL, what Craig is watching in Postgres 19, the impact of AI on open source maintainers, and why the database still has plenty of room to grow.
|
|
We Don't Write PHP. PHP2Shell Still Made Us Audit Everything: A Runtime-Patching Playbook for Polyglot Teams
This post is the playbook that came out of it. It isn't about PHP being bad. Every mature runtime has had critical bugs, and the PHP project shipped a coordinated fix across four supported branches. It's about how a polyglot team makes sure a runtime-level fix actually lands everywhere it needs to.
How to Block PHP Execution in Magento Media Folders
To block PHP execution in Magento media folders, deny web access to the upload directories at the web server, before any rule that hands .php requests to PHP-FPM.
PHP2Shell Reaches the Factory Floor: The PHP Bug Is Now an OT Problem
The critical PHP flaw has moved past web servers into gear from Schneider Electric, Siemens, ABB and others. A web bug in a factory controller is a different kind of problem, and this week it got two steps more serious.
Is PHP Still Safe to Use? Recent Security Issues, Updates & the Future of PHP
Honestly, I wouldn’t recommend abandoning PHP just because newer technologies are getting attention. However, I also wouldn’t recommend using an outdated PHP version and assuming everything will be fine.
Embracing Imperfection through Open-Source Software
Every article I’ve written this year has had to do, in some respect, with my journey to learn iOS and Swift development, including the launch of my first app, API Canvas and the app that I expect to launch later this year. Today’s article is going to be a bit different.
Two RCEs, Two SQL Injections and a 94% Full Disk: Rescuing a Non-Profit’s Legacy PHP Server
You’ve probably heard: a few days ago, PHP had two critical vulnerabilities. Critical enough that the Government of Canada took some of its own websites offline as a precaution.
I Replaced 50+ PHP Workers With One Go Process
Why Sentinel moved its monitoring regions from Laravel and Horizon workers to a single Go probe: the TLS fingerprint that made Go the pick, the replay path that keeps every verdict in PHP, the manifest and release pinning, measured before and after numbers, and what went wrong.
One Missing Tenant Scope Can Expose Every Customer in Your Laravel App
Your authorization policies may be perfect. Your database queries can still leak everything.
|
Interesting Projects, Tools and Libraries
meteo-concept/hcaptcha-bundle
A Symfony bundle to use hCaptcha in forms.
oneduo/nova-file-manager
A handy file manager tool for Laravel Nova.
symfony/ux-pagination
Cursor and numbered pagination for Symfony applications.
contributte/bare
This is an empty library skeleton to speed up new package development.
marein/symfony-lock-doctrine-migrations-bundle
Perform concurrent doctrine migrations safely.
moxio/commonmark-ext-fancy-lists
Extension for league/commonmark to support additional numbering types for ordered lists.
patchlevel/hydrator
A library for seamless hydration of objects to arrays - and back again, optimized for developer experience and performance.
neos/diff
This is a comprehensive library for generating differences between two strings or arrays.
scheb/tombstone
Dead code detection with tombstones for PHP.
mouf/classname-mapper
Provides a way to find in which PHP files a class will be looked upon.
|
Jobs
------
Do you have a position that you would like to fill? PHP Weekly is ideal for targeting developers and the cost is only $75/week for an advert. Please let me know if you are interested by emailing me at [email protected] |
Please help us by clicking to our sponsor:
 Protect your PHP Code
Why not try SourceGuardian 17. Click here to download a 14 Day Trial copy. Protect your code using Windows, Linux or Mac and run everywhere with our free Loaders. |
So, how did you like this issue?
|
|
|
|
