Critical PHP Security Release (21 October 2026): What We Know and How to Upgrade
Two critical PHP vulnerabilities (CVSS 9.2) are fixed on 21 October 2026: what is confirmed, what is rumoured, how to upgrade servers, Docker and hosting.
Posts about PHP development.
Two critical PHP vulnerabilities (CVSS 9.2) are fixed on 21 October 2026: what is confirmed, what is rumoured, how to upgrade servers, Docker and hosting.
PHP 8.6 for experienced developers: partial function application, clamp(), Time\Duration, new session defaults, stricter validation and deprecations.
Payment webhooks arrive out of order, and a naive handler hands out free subscriptions. A lead engineer's guide to robust Stripe webhook handling: deduplication, race conditions, fetching current state, reconciliation - with PHP and Symfony examples.
Scalable APIs survive more traffic, more consumers and more years. A solution architect's guide to contracts, statelessness, data access, caching, idempotency, rate limiting and evolution - with PHP and Symfony examples.
EU-hosted DMARC provider for SMBs - simple setup, strict protection, clear reports. Align SPF/DKIM, stage to reject fast with confidence.
PHP finally gets serious about generics. Explore the RFC, patterns, and future in my new book Generics in PHP - now on Amazon.
The Symfony serializer tries to (de)serialize Doctrine's Metadata and crashes in some cases. Read here when and how to fix.
Learn about the upcoming pipe operator in PHP 8.5, its meaning, origins, and why it matters for modern PHP development.
Quines in PHP - and in other languages - are an interesting concept for coding challenges. Read here why they are dangerous for production.
The PHP 8.5 release is planned for November 2025. Read here the current development state, as of April 2025.