I built a to-do app in Laravel (and it has zero stars)
I built a to-do app in Laravel (and it has zero stars)
A small open-source side project, the PHP2Shell aftermath and the 11 links worth your time this week.
Last week was all about patching. This week I want to show you something I built.
It’s called Plain Week.
A weekly planner and to-do list. One week on one screen. That’s it.
Most to-do apps ask for an email before you can write a single task. Then they want you to pick a workspace, a project, a board, a label.
Plain Week doesn’t.
You open it and you type. Click an empty row, write “17:30 Gym”, press Enter. The time is set for you, and you’re already on the next task.
No account. No sign-up. Your tasks stay in your browser, and it works offline.
But it’s not a toy:
Recurring tasks (every N days, some weekdays, monthly).
Drag and drop between days, or to the next week.
Colors, notes and subtasks.
Keyboard shortcuts, dark mode, and it installs as an app on your phone.
And here’s the part you’ll like: the backend is Laravel 13 on PHP 8.3+, with Pest, PHPStan and Inertia. It’s MIT licensed and you can self-host it with a single Docker container and SQLite. No Redis, no queue server, nothing else. There’s even a Coolify template.
So I need two things from you.
1. Leave a star on GitHub. ⭐
The repo is two weeks old and has almost no stars. A star takes you two seconds and helps other developers find it.
👉 github.com/victor-falcon/plain-week
2. Try it.
Open plainweek.eu and plan your week. No sign-up needed. If you want your tasks synced across your laptop and your phone, that’s the paid plan, and it’s what keeps the project alive.
And if something feels wrong or missing, just reply to this email.
Now, the links. PHP2Shell is still making noise, so I kept only what adds something new.
🔒 PHP2Shell, one week later
📚 How Running Out of Memory Became a Server Takeover in PHP
“The server would have to run out of memory first.” Sounds like a low-priority bug. It wasn’t. The clearest explanation I’ve read of how both bugs work, and they’ve been in PHP since 5.4.
📚 Volker Dusch on the PHP RCE Vulnerabilities and Disclosure
An interview with one of the people who worked on the fixes. What happened behind the scenes, from the inside.
📚 PHP2Shell: What Remains After the Headlines?
Seven claims, seven fact checks. If someone at work is still panicking (or still ignoring it), send them this.
📚 Update the PHP Docker Image Security Patch, No Downtime
Remember: a patched host doesn’t patch your images. How to ship the rebuild fast without your users noticing.
📚 How to Disable PHP Session Upload Progress Safely
The fix for the third CVE, in one setting. The catch: it has to be non-overridable, and you need to restart every worker.
📚 Updated PHP Windows builds for Brotli security fix
Running PHP on Windows? There are new builds (8.5.12-1, 8.4.27-1…) for an out-of-bounds write in Brotli, reachable through cURL. Yes, one more update.
🐘 PHP
📚 This Week In PHP Internals | Oct 22, 2026
Two weeks of internals in one episode: a CSV extension in core, comments and trailing commas in json_decode, a single binary for CLI and FPM, binary parameters for PDO, SSRF protection in curl and the end of PEAR’s endorsement (40–0).
🟥 Laravel
📚 Prevent Stale Database Reads in Laravel 13.38
Using read replicas? The new PreventStaleDatabaseReads middleware and usingWritePdo() fix the classic “I just saved it, why is it not there?” bug.
📚 What Breaks First When Your Laravel App Goes From 1K to 10M Users
The usual reaction to a slow app is a bigger server. It costs the most and fixes the least. Here’s what to look at first.
📚 Your Laravel application doesn’t have a performance problem. It might have a database problem.
Redis, more RAM, micro-optimized PHP… and the real bottleneck was always the database. A good pair with the link above.
🎵 Symfony
📚 A Week of Symfony #1034
Symfony 8.2 is taking shape: the new JsonSchema component, signed Messenger transports, safer HTML in translations and more MongoDB integrations.
That’s it for this week.
If you only do one thing from this email, make it the star. ⭐ Plain Week on GitHub
See you next week, Víctor
Invite your friends and earn rewards
© 2026 Víctor Falcón 🤟
548 Market Street PMB 72296, San Francisco, CA 94104