PHP: The latest news in the PHP world

Weekly help thread

2026-05-25T06:00:06+00:00

Hey there!

This subreddit isn't meant for help threads, though there's one exception to the rule: in this thread you can ask anything you want PHP related, someone will probably be able to help you out!

submitted by /u/brendt_gd
[link] [comments]

Who's hiring/looking

2026-05-19T08:00:13+00:00

This is a bi-monthly thread aimed to connect PHP companies and developers who are hiring or looking for a job.

Rules

No recruiters
Don't share any personal info like email addresses or phone numbers in this thread. Contact each other via DM to get in touch
If you're hiring: don't just link to an external website, take the time to describe what you're looking for in the thread.
If you're looking: feel free to share your portfolio, GitHub, … as well. Keep into account the personal information rule, so don't just share your CV and be done with it.

submitted by /u/brendt_gd
[link] [comments]

Symfony 8.1 released!

2026-05-29T17:58:00+00:00

submitted by /u/wouter_j
[link] [comments]

Composer 2.10 just dropped — it directly addresses the May 22 attack.

2026-05-28T16:14:36+00:00

Version tags on Packagist.org are now immutable — the exact trick the attacker used to rewrite tags to their malicious fork is now rejected at the registry level.
Also: composer install now blocks malware even if it already slipped into your lockfile,
and composer audit now fails on flagged malware versions.

run: composer self-update to update

full breakdown: https://medium.com/@abderahmane.merradou/update-composer-now-version-2-10-blocks-the-exact-attack-that-hit-laravel-on-may-22-a46e54bdbefd

submitted by /u/True_Musician_3911
[link] [comments]

Laravel Notify Matrix — per-user notification preferences package

2026-05-29T16:16:43+00:00

I just shipped my second Laravel package: Notify Matrix. It manages per-user notification preferences with per-channel opt-in/opt-out and per-group default policies. The pattern came from rebuilding the same notification settings logic in every SaaS I've worked on. The question is always "should this user receive this notification on this channel?" and the answer is always a hand-rolled mess of config arrays and `if/else` in `via()`. Usage: // User model use Scabarcas\LaravelNotifyMatrix\Concerns\HasNotificationPreferences; class User extends Authenticatable { use HasNotificationPreferences; } // Notification class use Scabarcas\LaravelNotifyMatrix\Attributes\NotificationGroup; #[NotificationGroup('orders')] class OrderShipped extends Notification { /* ... */ } // Anywhere $user->wants('orders', 'mail'); // true | false $user->disable('orders', 'mail'); $user->enable('orders', 'database'); A listener on `NotificationSending` filters channels automatically — no changes to your existing `via()` methods. Forced channels (security alerts) bypass user preferences. Third-party notifications without an attribute can be mapped via config. Architecture is intentionally boring: `PreferenceManager` orchestrates resolution, `PreferenceRepository` and `GroupResolver` are contracts you can swap. Pest 27/27, PHPStan max clean, Laravel 11/12/13, PHP 8.3/8.4. - Repo: https://github.com/scabarcas17/laravel-notify-matrix - Packagist: https://packagist.org/packages/scabarcas/laravel-notify-matrix Would love feedback on the API — especially if you've shipped notification settings before. What did you miss?

submitted by /u/Informal-Coyote9142
[link] [comments]

Composer 2.10 Release

2026-05-28T11:22:22+00:00

submitted by /u/naderman
[link] [comments]

I redesigned my PHP version manager after Reddit feedback: Per-shell switching is now live in phpvm v2.5.1 (No sudo, no global breaks)

2026-05-28T18:00:22+00:00

Last week, I posted here about a minimal TUI/GUI tool I built (phpvm) to make switching PHP versions on Linux easier. The feedback was great, but one comment by u/rycegh completely changed the direction of the project.

A fundamental flaw: relying on update-alternatives to change the global PHP binary is a bad pattern. It means you cannot work on two different projects on different versions in parallel, and switching global PHP knocks over unrelated background CLI tools (like global time trackers).

Suggested pivoting was to manage isolated local environments instead.

That feedback inspired me to rewrite the architecture from scratch for the 2.5 line. The v2.5.1 is live with fully isolated, per-shell version switching.

How the New Architecture Works

Instead of touching /usr/bin/php globally, phpvm now functions like nvm or rbenv:

Shell Hook: The installer adds a shell hook (for bash, zsh, or fish) that prepends a shim directory to your PATH.
Path Shim: A small executable shim at <hook-dir>/shims/php intercepts calls to php.
Environment Resolution:
- Shell Pin: Pinned manually via phpvm shell <version> (sticky for that terminal tab only, no sudo).
- Project Default: Read automatically from .php-version or composer.json requirements when you cd into a directory.
- Global Default: Falls back to the global update-alternatives symlink if no local pin exists.

This means you can have PHP 8.2 running in one tab and PHP 8.4 running in another, with zero password prompts and zero impact on other shells or system processes.

Install: bash curl -fsSL https://raw.githubusercontent.com/rijverse/phpvm/main/install.sh | sudo bash

Website: https://rijverse.github.io/phpvm

GitHub Repository: https://github.com/rijverse/phpvm

submitted by /u/BackgroundCompany721
[link] [comments]

PHPStan 2.2: Unsealed Array Shapes, Safer Array Keys, and More!

2026-05-28T08:44:17+00:00

submitted by /u/OndrejMirtes
[link] [comments]

Reading through the new generics RFC and sharing my thoughts on why this is the way.

2026-05-29T11:55:08+00:00

submitted by /u/brendt_gd
[link] [comments]

Rector but for the database: Indoctrinate

2026-05-28T08:04:33+00:00

I’m launching a book on June 15th, Legacy to Symfony: The Enterprise Blueprint for Zero-Downtime PHP Migrations, which documents an end-to-end blueprint for zero-downtime, vertical-slice migrations.

Throughout the process, I found that standard migration tools weren't enough to bridge the gap between a 10-year-old mutated schema and Doctrine ORM. So, I built indoctrinate.

Think of it as Rector for your database schema. It’s an open-source, rule-based audit and remediation tool designed to align your legacy database with Doctrine or simply fix database issues.

For example you can run the DoctrineCompatibilitySet with the dry flag to check exactly what issues are preventing Doctrine ORM integration.

If anyone ends up testing it against their own legacy database, I’d love to know if it misses any of your weird edge cases. Happy coding!

submitted by /u/AbstractStaticVoid
[link] [comments]

Call for Papers - Longhorn PHP 2026

2026-05-28T15:02:34+00:00

Note that the schedule this year is slightly different - just 2 days (Tutorial day + main conference days). Because of this tickets are also cheaper than previous years. Grab your ticket or submit a talk idea!

submitted by /u/d_abernathy89
[link] [comments]

An Update on Composer & Packagist Supply Chain Security

2026-05-27T15:22:34+00:00

submitted by /u/naderman
[link] [comments]

The PHP Foundation Impact and Transparency Report 2025

2026-05-27T19:36:59+00:00

submitted by /u/elizabethn
[link] [comments]

VS Code / Cursor Extension

2026-05-29T00:39:00+00:00

I'm tired of switching to the browser or opening Ray to see my dumps. I'm building a VS Code extension that renders Laravel payloads inline. Would anyone pay $30/yr for this?

submitted by /u/7ncyy
[link] [comments]

Automate your PHP security updates

2026-05-28T19:44:22+00:00

submitted by /u/yoeriboven
[link] [comments]

Tokei, a Time handling library for PHP

2026-05-27T13:48:42+00:00

Tokei is a PHP library dedicated to time-of-day handling, circular intervals and durations — all with microsecond precision and a developer-friendly API. It brings proper abstractions for modeling opening hours, night shifts, and any logic that crosses midnight.

submitted by /u/nyamsprod
[link] [comments]

What does the middleware request lifecycle really look like?

2026-05-27T10:52:44+00:00

I know that middlewares has been around forever, but I can't find a graph that properly explains the flow of a request in a middleware application.

In this article I tried to highlight each step in the flow, from the request, to the middleware pipeline (a simplified version), and the response.

It's focused on our Dotkernel Light, but it should be similar for other applications.

https://www.dotkernel.com/architecture/request-lifecycle-for-a-mezzio-based-application/

submitted by /u/arhimedosin
[link] [comments]

PHP is too verbose

2026-05-28T14:40:55+00:00

Oh no, what about principle of least privilege?

submitted by /u/Euphoric_Crazy_5773
[link] [comments]

Built an open-source MCP server with 105 tools for WordPress page building — lessons from scaling past 100 tools

2026-05-28T06:45:23+00:00

Been working on this for a few months, started at 37 tools and it kept growing. Now sitting at 105 and open-sourced under MIT.

The server connects any MCP client to WordPress through Bricks Builder, a visual page builder. Architecture is pretty straightforward — MCP server talks to a custom REST API plugin on the WordPress side, no PHP eval, no filesystem access, everything goes through structured endpoints.

Some things I ran into that might be useful for others building larger MCP servers:

Tool organization gets real fast. I ended up grouping into 17 categories (pages, SEO, templates, backup, styles, media, etc.) and keeping each tool focused on a single operation. Tried combining related operations into fewer tools early on but the AI clients handled discrete single-purpose tools much better.

Batch operations matter more than I expected. Going from one element per call to 20 per request cut page build time roughly in half. If your MCP server touches any kind of document structure, batch support is worth adding early.

Runtime multi-site switching was a late addition that changed the workflow completely. Instead of reconfiguring credentials, the AI just says "switch to staging" mid-conversation.

Named snapshots turned out to be the safety net that made the whole thing usable for production sites. Every destructive operation gets a snapshot first, rollback is one tool call.

Stack is Node.js, three npm dependencies, works with Claude Code, Cursor, Windsurf, and Hermes Agent. Also runs as a self-hosted MCP environment on Railway for mobile access via the Claude Code app.

GitHub: https://github.com/developer2013/bricks-mcp-open

Curious what patterns others have found when building MCP servers past the "10 tools" stage.

submitted by /u/wwwery-good-apps
[link] [comments]

Making over 130k in PHP?

2026-05-28T03:59:52+00:00

I'm in the us. Making 130k as a senior PHP dev. The job is very flexible. Everything about it is pretty good, but I wish I could make more. Maybe I should accept that what I make it pretty good?

I don't want to lose the flexibility and work life balance just to make a 20k more.

Where do I go from here? I work for a large company and everyone is always complaining that our salary needs to be market corrected and the C suite always ignores us.

I have a lot of stock but it's privately owned. Has been for years. When they finally sell my stock it will be worth a good deal. But who knows when that is going to be.

Raises are pathetic. Maybe 2.4 percent if I am lucky.

submitted by /u/mrmanpgh
[link] [comments]

Mantenimiento de código abierto con ayuda de IA: Yii2 pasó de 488 issues abiertas a 273

2026-05-28T01:41:32+00:00

submitted by /u/Terabytesoftw
[link] [comments]

Critical Vulnerability discovered for Mirasvit Full Page Cache Warmer

2026-05-26T21:40:02+00:00

submitted by /u/superterran
[link] [comments]

how did you tell your founders the Magento 1 stack has to go?

2026-05-25T18:04:51+00:00

Joined a mid-sized fashion brand earlier this spring as a senior backend dev.

Background in Laravel and Symfony, a bit of Magento 2 work years ago, never owned a full commerce stack before, and current brand is around €60M GMV across European markets.

Last week our payment provider sent us a sunset notice on their v1 API and gave us a few weeks to migrate, which should have been routine until I opened the repo to scope the work and now i can't unsee what's in there.

Our entire returns and refund flow runs through one custom Magento 1 module last touched a few years back, written by a contractor who finished his engagement around that time, whose email bounces and whose Linkedin says he's at a games studio in Lisbon.

The module hardcodes the Klarna v1 API key directly in the class constants, the endpoint returns 410 now, and the fallback writes every failed return attempt to a log file that is now 14GB.

There is also a cron job that runs every night at 03:17 with no documentation, which i disabled in staging to see what would happen, and returns broke almost immediately so i re-enabled it without ever figuring out what it does.

And then there is this comment in the source (literally):

// DO NOT REMOVE - this is what makes the size chart work

The size chart is not referenced anywhere else in the codebase. we are running Magento 1 in 2026 and the size chart logic is held together by a comment.

We do €60M a year through this…

The founders had asked me earlier why our infrastructure costs kept climbing, and when i sent them the dependency map they agreed to take the meetings with SCAYLE and commercetools they had refused the last time someone in my seat pushed for an evaluation.

For PHP devs who've inherited a production Magento 1 install past EOL, how did you handle the conversation about telling the founders the real migration timeline?

I don't want to be the one blaming the person before me and i don't see how this gets fixed in a single quarter.

submitted by /u/Influenceseful96
[link] [comments]

J'ai créé un générateur de sites statiques : kiss-php

2026-05-26T21:46:48+00:00

I built a static site generator : kiss-php

(First post,I'm learning the hard way about machine translation, and the fact that you can't change the title)

I'd like to share kiss-php a static site generator built around data first. One of those projects that started 1,000 years ago and was never finished, because the basic idea was cool, but finishing a personal project is always a bit of a gamble, given that there’s often a new interesting topic that comes along and takes precedence. And for this kind of side project, AI is, in my humble opinion, an incredible game-changer that makes the difference between a proof of concept and a publishable project.

So, kiss-php.

The basic idea is to write Twig templates, but populate your site using data files (YAML, JSON, INI, XML, PHP, MD) that are converted to PHP during compilation.

What's different: DataSources + DataTree

Instead of blindly re‑parsing every file on each build, I built a system where:

Each data source (YAML, JSON, PHP, etc.) is read once and transformed into plain PHP and cached.
The DataTree keeps a full, in‑memory/cached tree of all data sources.
With kiss watch (using inotifywait / fswatch), only the modified source is re‑parsed and reinjected into the tree. The rest of the data stays in cache, so partial builds are fast.

This could be great for sites with lots of content (blogs, catalogs, documentation) where you often change just one file. If this is something you can use, feel free to take it.

Note: I don't have a Mac on hand, only Linux machines, so support for fswatch is theoretical at this point.

Code : https://github.com/Amund/kiss-php

Docs : https://amund.github.io/kiss-php/

submitted by /u/Designer-Age7726
[link] [comments]

Fusio 7.0 released - API and Agent-Platform

2026-05-25T20:23:08+00:00

Hey everyone,

I'm the maintainer of Fusio, a self-hosted, open-source API management platform written in PHP. We just launched a major milestone with Fusio 7.0, and I wanted to share the key technical updates in this release:

We've introduced an action and schema Commit Log, along with a production "Freeze" mode.
Added a dedicated view for developers to visually inspect API schemas.
Implemented a new custom filter query language for the backend.
Added a new taxonomy system to categorize actions, schemas and operations.
An agent connection to a remote LLM based on Symfony AI.
The backend admin panel has been migrated to Angular 21.
Introduced a new Agent concept which helps create custom agents for internal or external usage.

If you are interested you can get more details through the links below:

GitHub Repository: https://github.com/apioo/fusio

Release post: https://www.fusio-project.org/blog/post/fusio-7.0-released

submitted by /u/k42b3
[link] [comments]