Hi everyone,
Week after week we bring you the latest news, updates and guides about PHP. This week in Tutorials, we have guides for Reviewing a Laravel Codebase Before You Inherit It, How to Remove the Japanese Keyword Hack from WordPress, and How to send WooCommerce SMS and WhatsApp notifications from your own phone number. In Our news section we have updates on What’s New in PhpStorm 2026.3, a new release for Symfony 8.1.11, and Slow Job Alerts and Replica Commit IDs in Laravel 13.40. Finally on our Reading section we have articles on Shipping Software Updates to Servers You Don't Control, Soft Deletes vs. Unique Constraints: The Duplicate SKU Bug That Hid for a Year, and More Confidence, Not More Code Review.
We have all that and more, so we do hope you enjoy this week's newsletter. If you have an article, tutorial or podcast that you would like to be featured in our newsletter, feel free to reach out to us at [email protected].
All the best,
Adrian
|
Please help us by clicking to our sponsors:
Give Your Unused Startup a Second Chance
List your unfinished SaaS, app, or project for free. Sell it, find a co-founder, or let someone else bring it to life. No fees, no hassle - just new opportunities!
|
Articles
PHP2Shell makes runtime inventory the urgent patch problem
The most common failure is to patch a CMS plugin while the PHP runtime under it remains old.
Why "defer" breaks WordPress sites (and how to test it before your visitors notice)
Adding defer to your scripts is one of the cheapest speed wins on a WordPress site. It is also the setting most likely to break a menu, a slider or a checkout field. This post explains why, with a small example, and shows a safe way to roll it out.
PHP2Shell on a mixed fleet: auditing 5.6 to 8.4 and proving each build is actually patched
Short answer: Install two Laravel style skills in Claude Code and the agent gets opposite orders. Laravel Boost names controllers ArticleController, Spatie names them PostsController.
Your Laravel Queue Is Not a Payment System
How Retries, Race Conditions, and Duplicate Jobs Can Cost You Real Money.
PHP2Shell: What PHP Developers Can Learn from a Critical Security Discovery
Understanding the October 2026 PHP security issue, its root causes, and open-source collaboration are helping strengthen the PHP ecosystem.
Your Laravel Security Boundary Doesn’t End at the Controller
The request passed authorization. The job was dispatched. The user lost access. And the application kept working as if nothing had changed.
|
Tutorials and Talks
Real-Time Inertia Props With Laravel Reverb
Inertia live props, added in v3.11.0, keep a page current when data changes on the server. Mark a prop as live, broadcast an event, and every page showing that prop reloads it.
Insert Middleware Before or After Existing Laravel Middleware
Some middleware has to run at a specific point in Laravel's default stack. A middleware that reads the client IP needs to run after TrustProxies. A middleware that reads the session needs to run after StartSession, and one that changes how route models resolve needs to run before SubstituteBindings.
How to send WooCommerce SMS and WhatsApp notifications from your own phone number
Email order updates have a problem: people don't read them. They land in a promotions tab, or they get read three days later. A text that says "Your order #1042 has shipped" gets read almost immediately.
Forgotten files in your public directory: how to find them on your own site, and where to keep them instead
When people think of data leaks, they often picture a sophisticated outside attack. In practice, one common entry point is much plainer: a file you placed in a public directory and then forgot.
Reviewing a Laravel Codebase Before You Inherit It: An 8-Point Checklist
Taking over a Laravel app from another vendor, or about to sign with a new one? Laravel itself is rarely why projects end up rebuilt. The usual causes are structural, and you can spot most of them in an afternoon of review.
PHP Dies After Every Request. How the Zend Engine Actually Runs Your Code.
PHP does not even have a persistent application server. It boots up, runs a script, and dies after every single HTTP request. How could anyone build serious software on an architecture like that?
Securing an EOL Host Against PHP2Shell
This guide details how to decouple the PHP runtime from your host operating system. By running an up-to-date PHP version inside a Docker container while retaining your native Apache web server for SSL and routing, you can address critical PHP vulnerabilities (like PHP2Shell) without upgrading or replacing your host OS.
How to Remove the Japanese Keyword Hack from WordPress
If Google shows search results for your website filled with Japanese text, your site has been compromised by SEO spam. Here is the step-by-step process to locate the malicious files, restore your clean WordPress installation, and request a fresh crawl from Google.
AI Helped Expose Old PHP Bugs. Here Is How to Find Every Runtime You Need to Patch
A security patch is easy to approve. Finding every PHP runtime hidden in an old container, appliance, control panel, or forgotten staging server is the harder part. |
News and Announcements
What’s New in PhpStorm 2026.3
PhpStorm 2026.3, the third major update of the year, is here! This release includes a new workspace for agentic development and multi-agent setups, support for PHP 8.6, improvements to remote development and WSL scenarios, and PHP code insight enhancements.
Slow Job Alerts and Replica Commit IDs in Laravel 13.40
The Laravel team released v13.40.0 with callbacks for queue jobs and scheduled tasks that run too long, commit IDs for checking whether a read replica has a write, insertBefore() and insertAfter() for the middleware stack, a strict flag on request input helpers, and a security fix for the Concurrency process driver.
PHP 8.6.0 RC5 available for testing
The PHP team is pleased to announce the fourth release candidate of PHP 8.6.0, RC5. This continues the PHP 8.6 release cycle, whose rough outline is specified in the PHP Wiki.
November 2–8, 2026 - A Week of Symfony #1036
This week, Symfony 5.4.56, 6.4.50, 7.4.23, and 8.1.11 maintenance versions were released with many security fixes for components such as Routing, Serializer, Config, and HtmlSanitizer. We also published the first beta of Symfony 8.2 so you can test it before its final release, along with Symfony UX 3.7. Meanwhile, we kept publishing articles about Symfony 8.2 features, such as validated and compiled expressions, polymorphic form collections, firewalls and routes, and the HTTP recorder. Finally, we announced more talks for SymfonyCon Warsaw 2026.
Symfony 8.1.11 released
Symfony 8.1.11 has just been released. Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.
This Week In PHP Internals | Nov 5, 2026
Kévin Dunglas, who created FrankenPHP, says PHP's engine can't tell when a web request ends if the same long-running script serves the next one, and FrankenPHP has fixed security bugs this year because of it. He proposed two engine hooks to fix that, and explained how they'd work with the Scope RFC. Also this week: a second RFC to lift bcrypt's 72-byte limit, Larry Garfield on Scope's empty superglobals, Time\Instant after a 15-point review, a JSON comments vote pulled the morning it was due, number-base exceptions accepted and Filter enums declined, and more.
|
Podcasts and Vlogs
The Stack Overflow: Customer support is the gnarliest AI problem
Ryan chats with Ahmad Al-Dahle, CTO at Airbnb, about deploying multi-party AI agents to tackle the uniquely gnarly problem of customer support, how a moving target of rigorous evaluations helps engineers balance latency against accuracy, and the ways in which AI coding tools demand an even higher level of judgment from software engineering teams.
Software Engineering Radio: SE Radio 745: Andrew Tridgell on Flight Control Software
Dr Andrew Tridgell of the Ardupilot project discusses flight control software for autonomous and remote controlled aircraft. This field has advanced considerably in recent years, and autonomous vehicles are playing an increasingly important role in many industries — from package delivery to scientific surveying and film-making — as well as in the consumer market.
Shoptalk Show: 740: Looking for a Great Webcam and a Great Browser
Chris upgraded his webcam (YOLO amiright?), Dave broke up with Elgato but helped bring automatic picture-in-picture to Chromium, left tabs vs pin tabs, the quest to replace Arc, and Chromium and Webkit browser options in 2026.
WP Builds: 488 – WPVibe and the AI-powered future of WordPress sites
The conversation focused on WPVibe, an AI-driven WordPress plugin enabling users to interact with and manage their sites through natural language. John Turner and I discussed was how WPVibe simplifies website creation and maintenance, making advanced tasks accessible even to non-technical users.
PHP Architect: The PHP Podcast 2026.11.05
Two months, a dozen new stream buttons, and a 6 AM crypto-mining emergency. Eric falls in love with a developer-only social network, the PHP2Shell CVE tests the team, and PHP Tek season kicks off. Welcome to the Boss Level.
Mostly Technical: 156: Batten Down The Hatches
Ian and Aaron discuss a short-lived Laravel New, Aaron's first onsite with the marketing team, a successful trip to Philly, the seemingly inevitable security apocalypse, and more.
Syntax: Reddit Closing it’s Doors
Reddit forces logins to starve the AI scrapers, ARC gets sunset, and a new terminal called Rex wants to replace your whole setup. Plus CSS Tricks gets a new owner, Redact tries to replace React, and a certificate authority's private key turns out to be the number four.
The Changelog: We now have Kerr’s Law
Dave Kerr created hacker laws, and now he finds himself reviewing agent-written code for them. Back on the show after six years, Dave names what he sees limiting teams today: keeping everyone’s mental model in sync with what’s actually been built.
|
|
The Internet Doesn't Have a Single Off Switch
How a critical PHP vulnerability changed the way I think about internet infrastructure, shared dependencies, and the systems we depend on.
Shipping Software Updates to Servers You Don't Control
TL;DR: When your software runs on servers you can't SSH into, an update has to be safe without anyone watching. In Bicitra Commerce, a self-hosted eCommerce platform, the update pipeline checks every planned file write (permissions, ownership, disk space) before touching anything, verifies each release against a checksum, skips vendor/ when dependencies haven't changed, and rolls back completely on any failure.
PHP2Shell on PHP 7: patch applied is not patch compiled is not patch working
Short answer: PHP 7 has no fixed release and still has a fix for every branch: the official minimal backport 712e60f9edfd for 7.4 (17 files, +240/−59) and Ondřej Surý's sury patch sets for 7.3, 7.2 and 7.1.
Soft Deletes vs. Unique Constraints: The Duplicate SKU Bug That Hid for a Year
Soft deletes are almost mandatory in ERP and CRM systems. You rarely want to physically delete a product, a customer or a supplier, because invoices, orders and audit logs still point at it. Laravel makes this easy with the SoftDeletes trait and a deleted_at column.
Multi-Tenancy in Laravel, Without the Magic: A Middleware, a Global Scope, and a Trait
How two companies can share one app and one database, and never see each other’s data.
AI Is Writing More of Our Code. So What Is the Developer’s Job Now?
AI is changing how software gets built. But as code becomes easier to generate, engineering judgment, system thinking, and human responsibility are becoming more important than ever.
Laravel Cache Stampede: How One Expired Key Takes Down Your Database
Why Cache::remember() isn't enough on a busy site, and three fixes you can test in your own app.
More Confidence, Not More Code Review
When an agent can produce another change while we're still reviewing the last one, the question is no longer just how quickly we can write code. It’s how we decide which changes deserve confidence. The risk is a growing queue of pull requests that nobody has had time to properly understand.
|
Interesting Projects, Tools and Libraries
berlindb/core
A collection of PHP classes and functions that aims to provide an ORM-like experience and interface to WordPress database tables.
evoweb/recaptcha
Easy on Humans, Hard on Bots.
brain/hierarchy
No-dependencies package that embodies WordPress template hierarchy.
ryangjchandler/blade-cache-directive
Cache chunks of your Blade markup with ease.
biostate/filament-menu-builder
An Elegant Menu Builder for FilamentPHP.
sniccowp/php-scoper-wordpress-excludes
A list of all WordPress core classes, functions and constants. Meant to be used with the PHP-Scoper exclusion functionality.
stellarwp/field-conditions
A set of serializable classes for handling conditional logic for fields in PHP.
dantsu/php-image-editor
PHP library to easily edit image with GD extension.
adriengras/pkce-php
A simple utility to use PKCE (Proof Key for Code Exchange) in PHP.
flarum/markdown
Allow posts to be formatted with Markdown.
|
Jobs
------
Do you have a position that you would like to fill? PHP Weekly is ideal for targeting developers and the cost is only $75/week for an advert. Please let me know if you are interested by emailing me at [email protected] |
Please help us by clicking to our sponsor:
 Protect your PHP Code
Why not try SourceGuardian 17. Click here to download a 14 Day Trial copy. Protect your code using Windows, Linux or Mac and run everywhere with our free Loaders. |
So, how did you like this issue?
|
|
|
|
