October 29th 2026
Hi everyone,
A week after the "aPHPocalypse" that informed the general public about 2 critical vulnerabilities that was a security risk has now been fixed. This will not be the last, but we can only hope that the next issue will just as be promptly sorted as this one. As expected, there are plenty of articles and think pieces about the RCE vulnerabilities in our articles and Reading section. We also have the security release fix if you haven't updated yet in our news section. In other news we have guides on How to Disable PHP Session Upload Progress Safely, What Breaks First When Your Laravel App Goes From 1K to 10M Users, and How to Handle HTML Forms in PHP: GET vs POST and Simple Validation. Finally in our Reading section we have articles on MySQL Explained, How Running Out of Memory Became a Server Takeover in PHP, and What Makes a Laravel Classifieds Script Truly Customizable?
We have all that and more, so we do hope you enjoy this week's newsletter. If you have an article, tutorial or podcast that you would like to be featured in our newsletter, feel free to reach out to us at [email protected].
All the best,
Adrian
Please help us by clicking to our sponsors:
Give Your Unused Startup a Second Chance
List your unfinished SaaS, app, or project for free. Sell it, find a co-founder, or let someone else bring it to life. No fees, no hassle - just new opportunities!
Articles
Volker Dusch on the PHP RCE Vulnerabilities and Disclosure
I sat down with Volker Dusch for the Laravel Creator Series to talk about this week's critical PHP security releases. Volker works at Tideways and is currently the AI Security Engineer in Residence on the PHP Foundation's Ecosystem Security Team, and he worked with the PHP security team on these fixes.
PHP2Shell: What Remains After the Headlines?
Seven claims. Seven fact checks. No hype. Applying PHP patchPHP2Shell made headlines about AI, millions of vulnerable websites, and an internet-wide security crisis. Let’s separate facts from exaggeration.
PHP2Shell: What Developers Should Check After the Critical PHP RCE Fixes
PHP’s October 21 security release fixed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which the PHP project says could allow unauthenticated remote code execution.
Your Website Can Be Vulnerable Even When Your Code Looks Perfect
Many developers believe that secure code is enough to protect a website. Unfortunately, that is not always true.
Is Your PHP Website Already Hacked? 7 Warning Signs Developers Should Never Ignore
Your website is online. Your homepage loads normally. Your login page works. Your SSL certificate is valid. Everything looks fine. But what if someone has already compromised your website — and you haven't noticed yet?
Your app was patched. Your PHP was not: PHP2Shell explained
If you run anything on PHP, this one is worth understanding properly, because the usual advice, update your app, does not fix it.
Tutorials and Talks
In this episode, we write a small PHP class called PreflightPolicy. It reads Jev's answers and gives back one label: ready for editor, revise, or needs review. None of these labels publish a draft. Even the best draft still goes to a person.
Laravel SMTP on cPanel: Fix 530, 535 & TLS Errors
Your Laravel application works on XAMPP, but after deploying it to cPanel, the first password reset email fails with Connection could not be established with host. Sometimes you get 535 Incorrect authentication data, Expected response code "250" but got code "530", or an SSL certificate verification error.
How to Handle HTML Forms in PHP: GET vs POST and Simple Validation
Handling a form in PHP means three simple jobs: show an HTML form, read what the user typed using $_GET or $_POST, and check the values before you use them. Use GET when the form asks for information, like a search box, because the values travel in the URL.
My pay tables kept getting cut off on phones. The fix was showing less, not shrinking more.
I build small calculator tools that run entirely in the visitor's browser. One of them is a Canada overtime calculator, and it kept failing the same way on phones: the Pay column was cut off on the right, and the per-day table lost its last column too.
Update the PHP Docker Image Security Patch, No Downtime
A security release is the one deploy you do not want to delay and also do not want to break. The patch should reach production fast, and your users should not notice it.
What Breaks First When Your Laravel App Goes From 1K to 10M Users
Your Laravel app feels fast with 1,000 users. At 100,000, pages start to crawl. At a million, the database gives up during a traffic spike. The usual reaction is to buy a bigger server, which costs the most and often fixes the least.
How to Disable PHP Session Upload Progress Safely
To disable PHP session upload progress, set session.upload_progress.enabled=0 in configuration that PHP applies at startup (php.ini, an FPM pool or the server configuration), make it non-overridable, then restart every PHP worker.
Your Laravel application doesn't have a performance problem. It might have a database problem.
I've seen developers add Redis, increase server resources, and optimize PHP code while ignoring the actual bottleneck.
News and Announcements
PHP Security Releases Fix Two Critical RCE Vulnerabilities
The PHP team just released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two critical vulnerabilities that can allow unauthenticated remote code execution. The team is asking everyone to update immediately, and it says there are no complete mitigations.
Prevent Stale Database Reads in Laravel 13.38
The Laravel team released v13.38.0 with a PreventStaleDatabaseReads middleware for applications that read from database replicas, a usingWritePdo() method that sends every read in a callback to the write connection, a health route that works with routes cached on a different machine, and more.
Updated PHP Windows builds for Brotli security fix
The PHP team announces updated Windows builds: PHP 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1. These builds include Brotli 1.2.1, which fixes CVE-2026-111497, an out-of-bounds write vulnerability in Brotli decompression. In PHP Windows builds, the vulnerable decoder can be reached through the cURL extension when automatic HTTP response decompression is enabled. This is disabled by default in cURL, but applications and HTTP client libraries can enable it.
PHP 8.2.35, PHP 8.3.36, PHP 8.4.27 & PHP 8.5.12 Released!
The PHP development team announces the immediate availability of PHP 8.2.35, PHP 8.3.36, PHP 8.4.27 & PHP 8.5.12. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthenticated remote code execution. All PHP 8.5 users are strongly encouraged to update immediately. There are no complete mitigations, updating is the only safe choice. See the security advisory for details.
October 19–25, 2026 - A Week of Symfony #1034
This week, development activity focused on polishing and fixing the new features of the upcoming Symfony 8.2 version. In addition, we showcased some of them, including the new JsonSchema component, signed Messenger transports, safer HTML in translations, and more MongoDB integrations. Meanwhile, we announced more talks for the SymfonyCon Warsaw 2026 conference.
Today's PHP Security Release, and How We're Strengthening PHP Security
Earlier today, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. These releases fix two critical vulnerabilities that, under the right conditions, allow an unauthenticated attacker to execute code on servers running PHP. If you run PHP, it is imperative that you update now. The announcement on php.net contains and references technical details on the vulnerabilities, attack vectors, and instructions on how to update on which systems.
This Week In PHP Internals | Oct 22, 2026
Two critical remote code execution bugs in PHP itself, both rated 9.2, got an emergency release on October 21, a day early, after their CVE numbers leaked online. We walk through how the out-of-memory and stale-state bugs work, what the 389-file fix changes, how the coordinated disclosure broke down, and why some governments took their own websites offline until they could patch. Update now. There was no episode last week, so this one covers both weeks: a CSV extension for PHP core, opt-in comments and trailing commas for json_decode, a challenge to bcrypt-sha256 over OWASP's guidance, the single binary for the CLI and FPM, PEAR's endorsement ending 40–0, binary parameters for PDO, SSRF protection in curl, and more.
Podcasts and Vlogs
Laravel News: Model defaults, agent skills, and fake assertions
Jake and Michael discuss all the latest Laravel releases, tutorials, and happenings in the community.
The Stack Overflow: Elevators, toasters, and the birth of Java
Ryan sits down with James Gosling, creator of Java at Sun Microsystems, to talk about the early networking friction that drove the need for interconnectedness, the stringent reliability requirements of consumer electronics companies that inspired the Java virtual machine.
No Compromises Podcast: From Webmaster to Software Developer in the Age of AI
In the latest episode of the No Compromises podcast, we discuss why the rise of vibe coding as a term says something important about where software development is headed.
Maintainable Podcast: Mark Stringer: Software Costs More Than We Want to Admit
Software is expensive to build, expensive to change, and expensive to keep alive. Yet organizations routinely make plans as though adding another feature or hitting an arbitrary deadline won't affect anything else. Mark Stringer joins Robby to explore why making those trade-offs visible is an essential part of maintaining software.
Software Engineering Radio: SE Radio 743: Sowjanya Pandruju on Managing Agent State
Sowjanya Pandruju, Cloud Application Architect with Amazon Web Services, Vice Chair of the IEEE Computer Society Madison Section, and Chair of the IEEE Women in Engineering (WIE) Madison Section (Region 4), speaks with SE Radio host Gavin Henry about managing agent state.
Shoptalk Show: 738: The Trouble with Tests and Bugs, Interop Voting, and AI Skills
Dave’s got a great concert story to kick off the episode before talking AI-assisted tests, a practical use for HTML markers and templates, Interop voting, browser features like margin-trim, and how to stream content into a page without first building a recursive tree.
WP Builds: 486 – Unlocking WordPress automations with Uncanny Automator
Today we’re focused on the evolution of Uncanny Automator, a WordPress plugin enabling users to build custom automations within their sites. We get into the challenges of bespoke integrations, the advantages over SaaS solutions like Zapier, and how plugin-based automation enhances privacy and speed.
PHP Architect: The PHP Podcast 2026.10.22
PHP ships an emergency security release a day early, Daniel Scherzer pushes the commits at 6:30am on four hours of sleep, and governments across Europe start pulling servers offline. Oh, and a 12-pound dog nearly killed Holly.
Mostly Technical: 155: The PHPocalypse
Ian and Aaron talk about Aaron's talk at Resend Forward, Ian's trip to the World Series, the PHPocalypse, Ian's dream job, and so much more.
Syntax: Everyone Is Hacking Their TV
Scott, CJ, and Wes dive into thrift store photo frame hacking, Void's framework going open source, and JEV's new image support that costs a hundredth of a cent per image. Plus, your home security cameras might finally get smart without selling your soul to the cloud.
The Changelog: Building what's next
This week I’m talking with Zeno Rocha, CEO of Resend, about scaling “boring” email to 3 million users, the secret Go rewrite behind it, and building for agents. We cover pricing.md, MCP, spam gangs, and why Resend keeps what’s next for email.
Reading and Viewing
MySQL Explained: The Database Behind Much of the Web
When you learned SQL (the SQL post), you learned a language — but a language needs a database to run in. MySQL, first released in 1995 and now owned by Oracle, is the most widely used open-source relational database in the world: it stores WordPress sites, runs parts of Facebook and Wikipedia, and is the default database in the classic LAMP stack (Linux, Apache, MySQL, PHP — three of which this blog has already covered).
10 Things I Learned at Meet Magento Germany (incl. PHP Vulnerability Disclosure)
A PHP vulnerability dropped the night before Meet Magento Germany. Ten things I took home: about people, patching, merchants who choose offline, and why badges don't stop bugs.
How Running Out of Memory Became a Server Takeover in PHP
"The server would have to run out of memory first." That sounds like a reason to file a bug under not urgent. On 21 October, two bugs that start exactly that way were published as critical. Both let someone on the internet, with no account and no password, run commands on the server. Both have been in PHP since version 5.4.
What Makes a Laravel Classifieds Script Truly Customizable?
Every classifieds script claims to be "fully customizable." Then a buyer asks for one extra field on the car category, and suddenly you're editing a Blade file, patching a controller, and hoping the next update doesn't erase it.
A Developer Portfolio That Gets Replies: A Practical Checklist
Most developer portfolios fail the same way: a grid of project cards, each with a screenshot, a tech-stack badge row and a "View Code" link. Recruiters and hiring managers skim them in under a minute and move on. Below is a checklist I'd use to turn a portfolio from a gallery into evidence.
Interesting Projects, Tools and Libraries
bakerkretzmar/nova-settings-tool
A Laravel Nova tool to manage application settings.
serialization/serialization
Library defining a Serializer and a Deserializer interface and basic utilities.
mindplay/readable
Formats PHP values as human-readable strings.
awcodes/overlook
A Filament plugin that adds an app overview widget to your admin panel.
shipmonk/doctrine-entity-preloader
Efficient & easy to use solution to n+1 problem in Doctrine ORM.
wbraganca/yii2-dynamicform
It is widget to yii2 framework to clone form elements in a nested manner, maintaining accessibility.
genesis/behat-fail-aid
Get more out of your test suite by getting it to work with you when tests fail. Screenshots and more. Works with Goutte and MinkExtension.
mostafaznv/pdf-optimizer
PDF optimization tool for PHP and Laravel applications.
eliashaeussler/cache-warmup
Composer package to warm up website caches, based on a given XML sitemap.
wmde/hamcrest-html-matchers
Set of Hamcrest matchers for HTML assertions.
Jobs
Do you have a position that you would like to fill? PHP Weekly is ideal for targeting developers and the cost is only $75/week for an advert. Please let me know if you are interested by emailing me at [email protected]
Please help us by clicking to our sponsor:
Protect your PHP CodeWhy not try SourceGuardian 17. Click here to download a 14 Day Trial copy. Protect your code using Windows, Linux or Mac and run everywhere with our free Loaders.
So, how did you like this issue?
We are still trying to grow our list. If you find PHP Weekly useful please tweet about us! Thanks.
Also, if you have a site or blog related to PHP then please link through to our site.
Because you signed for it!
Our mailing address is:
