PHP Architect Podcasts

<br />

Hosts: Joe Ferguson, Sara Golemon & Holly Schilling

The Surprise RC7 and the Last-Minute Regression

The decision was made easier by the fact that packagers like Remy need lead time to rebuild extensions. Because the team committed to an extra RC, they were also able to slip in a few nice-to-haves, including some use-after-free OpenSSL fixes that were all public knowledge and nothing security-embargoed.

Sara fully endorsed the “when in doubt, add an RC” philosophy, pointing out that releases happen on Thursdays precisely so the weekend acts as a buffer. A December GA wouldn’t be the end of the world either — uptime-conscious shops wait until January anyway, giving the packages and the public beta crowd time to shake out surprises. Holly reminded everyone: this is a release candidate, not a release. Don’t run it in production.

Reading Assembly to Hunt an ABI Break

Joe showed off Daniel Scherzer’s blog post, which drops down into the actual assembly and diffs the obj-dump output for the exception check. The trio squinted at near-identical instruction listings until the real difference surfaced: a jump target that moved from one address to another — about 32 bytes off from where the code expected to be looking.

Sara reverse-engineered the cause live: roughly four word-sized fields had been added to the end of a structure (it’s in Reflection), shifting every subsequent offset. She explained the ABI lesson clearly — a header says “this field is X bytes into the structure,” and if you mix an 8.5 header with an 8.6 build, you read garbage memory. For a plain integer that’s bad data; for a pointer, the CPU politely tells you to fuck off, mate. The catch: it only bites extensions built as separate shared objects, not statically built ones.

Claude as a Contributor and the “Humans.txt” Problem

The real sticking point, Joe argued, is that AI-generated contributions haven’t been tested against open-source licensing in any legal system, yet those contributions are now in the project. Sara pointed to php.net/humans.txt, which still reads “built by humans, mostly” — a “mostly” she thinks may have quietly been there all along.

The conversation also detoured into Claude’s new 5.2 behavior around security: it’ll audit your own code and describe exploits with suggested patches, but it won’t generate a proof-of-concept exploit to actually validate the vulnerability. Holly found that limitation a bit pointless, while the gang schemed about pointing it at localhost.

Why Teams Don’t Upgrade PHP

Holly aired a pet peeve that upgrading a language version shouldn’t break things, prompting a friendly “citation needed” from Sara. Joe countered that the real pain in legacy apps (pre-8) is usually unvetted, unmaintained dependencies — the one-off package that did one thing well but got abandoned, so even 5.5 to 5.6 broke it. Sara agreed that’s an ecosystem problem, not PHP’s fault, and challenged the group to name actual PHP-caused breaks: pulling mysql out of core, the ternary precedence swap, and little surprises like opcache becoming standard.

That opcache change was exactly Holly’s lived example: an 8.3-to-8.5 Docker build broke because a now-unnecessary build step for opcache failed with no obvious documentation. Sara’s gentle suggestion to read the migration guides (plural, since it was a two-version jump) sparked some mock outrage, but the underlying point stood — unnecessary friction is a real cost, and the bigger the version gap, the more insurmountable the step. The survey also noted 56% cite missing tests or staging environments, and even many who run automated tests lack confidence in their coverage.

Home Automation, Portuguese Wiring, and the Spouse Test

The group compared setups and the all-important “spouse test.” Joe keeps it minimal — doorbell camera, backyard security cam, and a Google Nest thermostat that keeps re-adding a schedule he deleted — and admitted his Jellyfin server didn’t pass the spouse test at all. Sara and Joe both evangelized Home Assistant: mostly Python but happy to call out to PHP scripts that return JSON, container-friendly via docker-compose, and far from the painful early days of home automation.

They swapped favorite automations — Holly’s litter-box nag texts and fridge-door-left-open light color alerts, Joe’s jealousy over people graphing solar production in the Rove Discord’s home automation channel. Add an MQTT broker and Node-RED and you’ve got message buses the whole house can listen to. Holly offered to info-dump on anyone who drops by Discord’s general channel (dark mode supported, naturally).

The NVIDIA Spy Saga and a GA on the Horizon

Back to business: PHP 8.6.0 is scheduled to hit general availability on November 19th, and the team floated doing some live server upgrades as a “release party” during next week’s recording. Huge shout-out to Matteo (watching live from a very late timezone) for herding php-src pull requests and pinging contributors for approvals to get RC6 and RC7 ready. And as always — there are socks that need selling, a freshly leaked phparch.com redesign to break, and a PHP Arch cowboy hat the people are now demanding.

Looking to hire PHP developers? Email [email protected] – Joe and the team are available for consulting, infrastructure work, Ansible playbooks, and code review.

This podcast is made a little better thanks to our partners

OurCVEs

Your security posture, on autopilot with OurCVEs

CodeRabbit

Cut code review time & bugs in half instantly with CodeRabbit.

PHP Architect Consulting

Your PHP codebase deserves a partner, not a contractor. PHP Architect provides long-term technical partnerships for organizations that need senior-level PHP expertise that you can depend on. https://www.phparch.com/consulting/

https://www.epidemicsound.com/

Youtube Channel

Got feedback? Join us on Discord at discord.phparch.com

The post The PHP Podcast 2026.11.12 appeared first on PHP Architect.

Hosts: Joe Ferguson, Sara Golemon & Holly Schilling

A surprise RC7, assembly-level ABI detective work, Claude landing commits in php-src, a survey on why nobody upgrades, Portuguese wiring codes, and the corporate spy saga that ate your RAM. Just an "off week."

Joe, serving as a first-time release manager alongside Matteo Beccati, walked through why PHP 8.6.0 RC7 appeared seemingly out of nowhere. RC6 was tagged on the usual Tuesday cadence, but a regression needed to land, leaving the team a choice: ship 8.6.0 GA with a known regression where working 8.5 code would break on upgrade, or throw another RC. As Joe put it, he'd rather apologize for a last-minute RC than apologize for a regression on GA.

The decision was made easier by the fact that packagers like Remy need lead time to rebuild extensions. Because the team committed to an extra RC, they were also able to slip in a few nice-to-haves, including some use-after-free OpenSSL fixes that were all public knowledge and nothing security-embargoed.

Sara fully endorsed the "when in doubt, add an RC" philosophy, pointing out that releases happen on Thursdays precisely so the weekend acts as a buffer. A December GA wouldn't be the end of the world either — uptime-conscious shops wait until January anyway, giving the packages and the public beta crowd time to shake out surprises. Holly reminded everyone: this is a release candidate, not a release. Don't run it in production.

The RC saga tied back to an earlier mistake: the ABI version bump that was missed in RC3 because of the CVE scramble on the 21st. That meant RC3 and RC4 could have had nasty extension conflicts, and anyone seeing weird extension behavior on those builds was likely hitting the ABI break that wasn't caught until RC5.

Joe showed off Daniel Scherzer's blog post, which drops down into the actual assembly and diffs the obj-dump output for the exception check. The trio squinted at near-identical instruction listings until the real difference surfaced: a jump target that moved from one address to another — about 32 bytes off from where the code expected to be looking.

Sara reverse-engineered the cause live: roughly four word-sized fields had been added to the end of a structure (it's in Reflection), shifting every subsequent offset. She explained the ABI lesson clearly — a header says "this field is X bytes into the structure," and if you mix an 8.5 header with an 8.6 build, you read garbage memory. For a plain integer that's bad data; for a pointer, the CPU politely tells you to fuck off, mate. The catch: it only bites extensions built as separate shared objects, not statically built ones.

Joe raised a spirited discussion happening in the PHP Foundation's internals Slack: Claude Code now shows up as a contributor in php-src, and some worry that reads like the project endorsing a commercial AI tool. Sara pushed back — commits attributed to @yahoo.com or @facebook.com addresses aren't endorsements, they're just people contributing while earning a living. Holly added that mailing lists and git clients have appended "Sent from my iPhone" style signatures forever and nobody cared.

The real sticking point, Joe argued, is that AI-generated contributions haven't been tested against open-source licensing in any legal system, yet those contributions are now in the project. Sara pointed to php.net/humans.txt, which still reads "built by humans, mostly" — a "mostly" she thinks may have quietly been there all along.

The conversation also detoured into Claude's new 5.2 behavior around security: it'll audit your own code and describe exploits with suggested patches, but it won't generate a proof-of-concept exploit to actually validate the vulnerability. Holly found that limitation a bit pointless, while the gang schemed about pointing it at localhost.

Joe dug into a recent opt-in survey about what blocks teams from upgrading. The headline findings: it's almost never a single blocker (47–51% cite more than one), 86% cite at least one business or resource reason, and 51% say there's no visible ROI in upgrading. Sara's immediate rebuttal: if you're on PHP 5, there absolutely is an ROI — you can run half as many servers.

Holly aired a pet peeve that upgrading a language version shouldn't break things, prompting a friendly "citation needed" from Sara. Joe countered that the real pain in legacy apps (pre-8) is usually unvetted, unmaintained dependencies — the one-off package that did one thing well but got abandoned, so even 5.5 to 5.6 broke it. Sara agreed that's an ecosystem problem, not PHP's fault, and challenged the group to name actual PHP-caused breaks: pulling mysql out of core, the ternary precedence swap, and little surprises like opcache becoming standard.

That opcache change was exactly Holly's lived example: an 8.3-to-8.5 Docker build broke because a now-unnecessary build step for opcache failed with no obvious documentation. Sara's gentle suggestion to read the migration guides (plural, since it was a two-version jump) sparked some mock outrage, but the underlying point stood — unnecessary friction is a real cost, and the bigger the version gap, the more insurmountable the step. The survey also noted 56% cite missing tests or staging environments, and even many who run automated tests lack confidence in their coverage.

A tangent about testing "wiring" turned literal when Sara revealed she's been rewiring her new place in Portugal — where brown is live and blue is neutral (IEC color codes), which Joe immediately flagged as a nightmare for the colorblind. Sara's home is heavy on automation: motorized metal sun shutters, IKEA smart bulbs in GU10 sockets, Shelly modules behind the light switches, internet-connected heat pumps, and a smart plug that only runs the water heater in the cheap overnight electricity window.

The group compared setups and the all-important "spouse test." Joe keeps it minimal — doorbell camera, backyard security cam, and a Google Nest thermostat that keeps re-adding a schedule he deleted — and admitted his Jellyfin server didn't pass the spouse test at all. Sara and Joe both evangelized Home Assistant: mostly Python but happy to call out to PHP scripts that return JSON, container-friendly via docker-compose, and far from the painful early days of home automation.

They swapped favorite automations — Holly's litter-box nag texts and fridge-door-left-open light color alerts, Joe's jealousy over people graphing solar production in the Rove Discord's home automation channel. Add an MQTT broker and Node-RED and you've got message buses the whole house can listen to. Holly offered to info-dump on anyone who drops by Discord's general channel (dark mode supported, naturally).

Somewhere between RAM shortages and bad TV writing, the crew riffed on the ex-NVIDIA CEO news — allegedly running GPUs on Chinese hardware he wasn't married to, plus a third "integration" that shouldn't have been happening, with a spy in the mix and the board already preparing to oust him. Joe shared a Mastodon favorite: a "NVIDIA CEO transitions" headline quote-tooted with "I'm so happy for her," which Holly and Sara declared very brave in this climate.

Back to business: PHP 8.6.0 is scheduled to hit general availability on November 19th, and the team floated doing some live server upgrades as a "release party" during next week's recording. Huge shout-out to Matteo (watching live from a very late timezone) for herding php-src pull requests and pinging contributors for approvals to get RC6 and RC7 ready. And as always — there are socks that need selling, a freshly leaked phparch.com redesign to break, and a PHP Arch cowboy hat the people are now demanding.

Looking to hire PHP developers? Email [email protected] - Joe and the team are available for consulting, infrastructure work, Ansible playbooks, and code review.

This podcast is made a little better thanks to our partners.

Your security posture, on autopilot with OurCVEs.

Cut code review time & bugs in half instantly with CodeRabbit.

Your PHP codebase deserves a partner, not a contractor. PHP Architect provides long-term technical partnerships for organizations that need senior-level PHP expertise that you can depend on. Learn more about PHP Architect Consulting.

Music provided by Epidemic Sound.

Watch on our YouTube Channel

Got feedback? Join us on Discord at discord.phparch.com

<span data-mce-type="bookmark" style="display: inline-block; width: 0px; overflow: hidden; line-height: 0;" class="mce_SELRES_start"></span>

In this episode, Scott talks with Zach Watkins about coding through osteoarthritis with Talon Voice, a split keyboard mounted to his chair, and foot pedals with macOS head tracking.

Chapters:

Links:

Mentioned in this episode:

Zach’s Links:

Scott’s Links:

PHP Architect Social Media:

Subscribe to our magazine: https://www.phparch.com/subscribe/

This podcast is made a little better thanks to our partners.

OurCVEs

Your security posture, on autopilot with OurCVEs

CodeRabbit

Cut code review time & bugs in half instantly with CodeRabbit.

PHP Architect Consulting

Your PHP codebase deserves a partner, not a contractor

Music provided by Epidemic Sound https://www.epid

The post Community Corner Podcast: Zachary Watkins Codes With His Voice, Feet, and Face appeared first on PHP Architect.

<br />

Hosts: Eric Van Johnson & Joe Ferguson (John Congdon)

Back After Two Months — and Everything Is On Fire (Audio-Wise)

Once they got the sound working, they reintroduced the show. This is the monthly “Boss Level” episode where the two people behind PHP Architect pull back the curtain on the magazine, the conference, and the consulting business — with a little more candor than usual, since, as Eric put it, John can’t fire him and he can’t fire John.

Leaked AWS Keys and a 6 AM Bitcoin-Mining Nightmare

The team rallied — four or five people each terminating instances region by region — and disabled the compromised key before new instances could spawn. Using AI tools to dig through the logs, they discovered the key had first been quietly tested back in September, likely by whoever was selling it to prove it was valid before putting it on the market. Identifying and rectifying took about 20 minutes, but it was not a fun morning.

/Dev/Null: A Social Network Built for Developers in a Day

He also highlighted a TUI built by Wendell (a Laravel employee and PHP Architect columnist) that mirrors the web app so closely it’s become Eric’s home for DevNull right inside his Tmux setup. That led into a tour of his terminal-centric workflow — one Tmux session per project (a trick from Jess Archer), panes for Claude, nvim, and dev servers, lazygit for commits — and why he quietly retired PHPStorm earlier this year in favor of nvim and the terminal. Pauline, a fantastic conference speaker known for Git talks, has even started livestreaming on Twitch following the build.

PHP Tech 2027: Call for Speakers Closed, Evaluation Begins

Eric reminded listeners that submitting multiple talks improves their odds of being selected when narrowing the final list. Speakers with more than one accepted talk get priority since they’re the biggest bang for the buck. This year’s third track rotates: a JavaScript day, a Laravel day, and a DevOps day. John noted it was exactly that deployment knowledge gap that first drew him to PHP Tech back in 2010, when he had no idea how to actually deploy an application. All the details live at phptek.io.

The PHP-to-Shell CVE and Why a DevOps Person Matters

The fallout rippled outward: NativePHP published a candid write-up about having to issue its first-ever security advisory, since a PHP vulnerability affects anything that compiles PHP into a mobile app. The hosts wondered how projects like NativePHP can get into the “consortium” that receives early patch access alongside the big distros. They also pushed back on the “PHP is dead” crowd — this was a memory bug that has lived in the code for 20 years and affects roughly 70% of the web, but memory bugs happen in every language, from Node to npm. The silver lining: a visible spike in PHP Foundation financial contributions, with Eric clarifying that the Foundation funds internal developers but doesn’t dictate PHP’s direction.

Git Workflows, SVN War Stories, and the Specialization of Developers

Eric defended his fork-based Git workflow: a single clean “upstream” repo that only deploys to servers, with everyone forking into their own private GitHub account and sending back only clean, deployment-ready code, essentially the open-source model. The chat gave him grief, including jabs about failing at Git worktrees, which Eric conceded he understands in principle but finds painful in a PHP workflow with its multiple Composer and npm installs and environment files.

Looking to hire PHP developers? Email [email protected] – Joe and the team are available for consulting, infrastructure work, Ansible playbooks, and code review.

This podcast is made a little better thanks to our partners

OurCVEs

Your security posture, on autopilot with OurCVEs

CodeRabbit

Cut code review time & bugs in half instantly with CodeRabbit.

PHP Architect Consulting

Your PHP codebase deserves a partner, not a contractor

https://www.epidemicsound.com/

Youtube Channel

Got feedback? Join us on Discord at discord.phparch.com

The post The PHP Podcast 2026.11.05 appeared first on PHP Architect.

<span data-mce-type="bookmark" style="display: inline-block; width: 0px; overflow: hidden; line-height: 0;" class="mce_SELRES_start"></span>

In this episode, Scott talks with Jamison Bryant about what sets CakePHP apart from Laravel and Symfony, the plugin ecosystem, and how he moved TicketSauce from CakePHP 2 to 5 with the strangler fig pattern.

Links:

Mentioned in this episode:

Jamison’s Links:

Scott’s Links:

PHP Architect Social Media:

Subscribe to our magazine: https://www.phparch.com/subscribe/

This podcast is made a little better thanks to our partners.

OurCVEs

Your security posture, on autopilot with OurCVEs

CodeRabbit

Cut code review time & bugs in half instantly with CodeRabbit.

PHP Architect Consulting

Your PHP codebase deserves a partner, not a contractor

Music provided by Epidemic Sound https://www.epidemicsound.com/

The post Community Corner Podcast: cakePHP with Jamison Bryant appeared first on PHP Architect.

<br />

Hosts: Joe Ferguson, Sara Golemon & Holly Schilling

Patrick Stewart, Cache Stampedes, and the Michael Jackson Outage

Back in 2009, when Michael Jackson died, so many people tried to edit the Wikipedia article simultaneously that the entire system fell over. Each save triggered a full re-render, link table updates, and layers of other work — and with a thousand of those happening at once, it destroyed everything.

The emergency fix was a hack that served stale cached data to anyone viewing the Michael Jackson page, which instantly brought the site back online. The proper fix came later: a pressure valve for high-concurrency situations, a textbook cache-stampede problem they should have anticipated but didn’t catch until real planetary-scale load exposed it. Since fixing it correctly, they’ve never had a repeat — even for later celebrity deaths.

Tailscale SSH Root and the PHP RCE Patch

Talk turned to the big PHP RCE vulnerability. Joe, as a release manager, actually got early access to the patch and noted it was massive — lots of files touched. The Foundation blog explained the bug was found in the 2024 security audit, but the security team struggled not with *how* to fix it but how to fix it *best*, producing competing implementations with different tradeoffs while it remained only a theoretical exploit.

Sara underlined that memory-corruption RCEs like this — where a bailout leaves data somewhere it shouldn’t be, eventually turning into bytecode or binary — are extremely hard to pull off, depending on architecture and memory layout. Despite claims of in-the-wild exploitation, most were retracted, and performance impact of the fix turned out to be negligible. Wikimedia’s own response was to simply shut down all user-generated cloud services code until the patch was installed — sometimes the biggest circuit breaker is the best security.

HHVM, PHP 7, and the Phantom PHP 6

Sara took partial credit for grabbing the clever bits out of HHVM and getting them into PHP 7, all without a JIT (that didn’t arrive until PHP 8). Wikimedia stuck with mainline PHP for broader compatibility and because they’d written their entire codebase in PHP and had no desire to switch to Hack.

Naturally, the conversation detoured into the legend of PHP 6. Sara confirmed the last version of PHP 6 lives on in a Git tag — something like an experimental first Unicode attempt — and it will generally compile, just don’t expect performance, since it runs about a third the speed of PHP 7. Holly floated secretly shipping PHP 8.6 as the PHP 6 branch, and Sara noted that re-adding Register Globals would be trivially easy and really ought to be an April Fool’s joke someday.

500 Languages, Unicode, and the Localization Cache

The infrastructure runs across roughly 2,200–2,500 Kubernetes-hosted application servers in data centers in Virginia and Texas (with a smaller caching center in San Francisco). Every MediaWiki update is packaged into an image with the pre-compiled localization cache and atomically rolled out across all nodes.

Brooke worked on a patch to move the localization cache from a disk-backed database to an in-memory one built from PHP array literals, letting OPcache deduplicate all the strings automatically. In isolated testing it should yield several percent throughput improvement — which, at Wikipedia’s traffic volume, translates to tens or hundreds of thousands of dollars of equipment saved.

The Esperanto Unicode Origin Story

Because the early wikis ran 8-bit Latin-1, Esperanto’s accented characters didn’t work. So Brooke patched the open-source code to use UTF-8 for the Esperanto edition — doing Unicode before UTF-8 was the universal standard. As MediaWiki (built by Magnus Manske) took over, every new language wiki went straight to Unicode, and eventually English Wikipedia was converted too, using on-demand dynamic conversion of old Latin-1 revisions to minimize downtime.

That led into a gleeful MySQL gripe session: early MySQL 3 had no transactions and no Unicode, so Wikimedia stored UTF-8 in binary fields and managed their own collations. When MySQL 4 “added Unicode,” the fine print revealed it only supported the Basic Multilingual Plane — useless for the rare CJK characters an encyclopedia must store.

Normalization Forms and Cursing Apple

Since a compatible ICU library couldn’t be guaranteed, Brooke wrote a pure-PHP fallback that validated UTF-8 *and* normalized it to the precomposed form, so every way you type a name links the same way. Brooke cursed the Unicode Foundation many times — but cursed Apple a lot more, since everything else did the right thing by default.

The group agreed the Intl extension (which provides exactly this normalization) is one of the few things that really should be installed by default — Wikipedia requires it outright now. They closed with a quick nod to Holly’s pet project on scalar extension functions for strings and a final push for the PHP Tech CFP, open through October 31.

Looking to hire PHP developers? Email [email protected] – Joe and the team are available for consulting, infrastructure work, Ansible playbooks, and code review.

This podcast is made a little better thanks to our partners

OurCVEs

Your security posture, on autopilot with OurCVEs

CodeRabbit

Cut code review time & bugs in half instantly with CodeRabbit.

PHP Architect Consulting

Your PHP codebase deserves a partner, not a contractor. PHP Architect provides long-term technical partnerships for organizations that need senior-level PHP expertise that you can depend on. Learn more.

https://www.epidemicsound.com/

Youtube Channel

Got feedback? Join us on Discord at discord.phparch.com

The post The PHP Podcast 2026.10.29 appeared first on PHP Architect.

<br />

Hosts: Holly, Sara, Joe – Special Guest Daniel Scherzer

The PHP2Shell Security Release

Daniel described the stress of it all, including waking up at 1am with a headache before a 5am alarm and a release process planned for 1300 UTC. In the end he volunteered to push every change himself, running three commands to push a whole bunch of commits across three repositories in a single atomic operation — four tags and seven branches at 1335 UTC, just before public disclosure.

He also drew a clear line around the hats he wears. As a release manager he had early access to the fix, but he deliberately did not patch his own PHP-powered website ahead of time, explaining that the community trusted him to help release PHP, not because he was important enough to get early access for personal use. Governments in Europe were turning off public-facing sites and the NSA published guidance, leaving Daniel marveling at how he ended up with a front-row seat to something heads of government were paying attention to.

A Two-Year-Old Bug and the AI Angle

Daniel pushed back on the framing that AI simply “found” the bug, emphasizing the two years in between where it was known but there weren’t enough maintainer hours or infrastructure to address it. At the time it was essentially a theoretical bug with no consistently provable exploit path. He cautioned that AI-discovered vulnerabilities shouldn’t be assumed correct without a human reviewing them, noting he hadn’t yet seen a clean proof-of-concept that didn’t also rely on some other underlying server vulnerability.

The group discussed the rate of security reports skyrocketing as LLMs become common, with Sara describing the bandwidth problem the volunteer security team faces: triaging what’s likely to be exploited, confirming fixes are actually complete, and avoiding publishing an incomplete fix that tips off bad actors. Amazon claimed to have seen exploitation attempts beforehand, but the release manager chat showed no indication the bug was ever exploited in the wild before the release.

Fund the Volunteers Who Hold Up the Internet

The crew highlighted a Mastodon post from Nils Alderman arguing that if the governments shutting down servers, the hosting companies, and the enterprises terrified by this vulnerability each gave even $50,000 a year to the PHP Foundation, things could look very different. Daniel echoed this: had there been infinite money and maintainer hours, every theoretical vulnerability might get fixed as a hardening measure.

Joe shared how PHP Architect Consulting had its first client patched roughly 30 minutes after the fix went live — thanks to a tip from Marco Pavetta about forking the Docker PHP library repo and building your own base image before the mirrors saturated. He also recounted his own role helping Derick Rethans keep php.net patched before the announcement so the site wouldn’t fall over under load, including one odd bug where the patched version broke Apache directory listing on downloads.php.net.

Life as a Release Manager

They dug into an ABI change in the security release that added new fields to the executor globals. The group debated whether that counts as an ABI break — the consensus being it technically is one, but a safe one as long as you’re not mixing newer extensions depending on those fields with older versions in the same branch. Sara and Holly stressed that extensions should never be wholesale copying global blocks in the first place, especially given how differently that memory behaves in threaded versus non-threaded builds.

Daniel shared his origin story: just over two years contributing to PHP, starting with a typo fix to a test name after creating a professional GitHub account under Daniel E. Scherzer. Holly and Sara warned him there’s no escaping — Sara sent her first patch 24 years ago and is still here. The bit about “settling for Joe” ran throughout the whole episode.

Rust, C, and the Rewrite Temptation

Holly, half-joking, said she’s one sponsor away from pulling a “bun” and throwing hundreds of thousands of AI agents at a hard rewrite of the PHP engine, predicting this is the first of many memory-safety bugs AI agents will surface in the C codebase. Daniel tempered the hype, noting AIs hallucinate and that this being the first of 100,000 reports doesn’t mean there are 100,000 real memory issues.

The segment wrapped with Daniel’s recent work building PHP extensions in Rust (he gave a workshop on it at Longhorn), digging into the C macros for globals and how ZTS thread-support mode changes everything. The repeated advice: learn it, experiment on your own fork, but don’t mess with it until you actually understand it — and never hit git push to the public source.

Looking to hire PHP developers? Email [email protected] – Joe and the team are available for consulting, infrastructure work, Ansible playbooks, and code review.

This podcast is made a little better thanks to our partners

OurCVEs

Your security posture, on autopilot with OurCVEs

CodeRabbit

Cut code review time & bugs in half instantly with CodeRabbit.

PHP Architect Consulting

PHP Architect provides long-term technical partnerships for organizations that need senior-level PHP expertise that you can depend on. Your PHP codebase deserves a partner, not a contractor. Learn more.

https://www.epidemicsound.com/

Youtube Channel

Got feedback? Join us on Discord at discord.php.com

The post The PHP Podcast 2026.10.22 appeared first on PHP Architect.

<span data-mce-type="bookmark" style="display: inline-block; width: 0px; overflow: hidden; line-height: 0;" class="mce_SELRES_start"></span>

In this episode, Scott talks with Damien Seguy about the history of the elePHPant, from Vincent Pontier’s logo doodle to 6,054 plush toys in Damien’s home, how the community trades them through the Community Postal Service, and what it takes to create your own.

Chapters:

Links:

Mentioned in this episode:

Damien’s Links:

Scott’s Links:

PHP Architect Social Media:

Subscribe to our magazine: https://www.phparch.com/subscribe/

This podcast is made a little better thanks to our partners.

OurCVEs

Your security posture, on autopilot with OurCVEs

CodeRabbit

Cut code review time & bugs in half instantly with CodeRabbit.

PHP Architect Consulting

Your PHP codebase deserves a partner, not a contractor

Music provided by Epidemic Sound https://www.epidemicsound.com/

The post Community Corner Podcast: elePHPants with Damien Seguy appeared first on PHP Architect.

<br />

Hosts: Joe Ferguson & Holly Schilling

Swag, Longhorn PHP, and “Am I Even a PHP Developer?”

The conversation turned to Longhorn PHP 2026, which kicked off with a tutorial day and runs through the main talk day on Friday. Holly is presenting remotely after travel plans fell through, giving a talk on her pet peeve: websites that get “packaged up” and shipped as apps instead of being built as real native applications.

That led into a heartfelt riff on imposter syndrome. Holly admitted she’s spent years insisting she’s “not really a PHP developer” despite submitting RFCs, speaking at conferences, and having an elephpant named after her. Joe shared his own years at a Python startup where he felt like a fraud for only writing PHP nights and weekends. The takeaway: showing up in community spaces — Discord, social media, GitHub, conferences — is all it takes to belong.

Agentic Commerce and Single-Use Card Security

Much of the underlying tech, they noted, lives in Stripe and resembles Apple Pay-style single-use card numbers: time-limited, amount-limited tokens that protect the real source card. Holly drew on her experience at a buy-now-pay-later company (now branded FlexPay) doing one-time code generation, where even 15-minute-lived card numbers required full PCI compliance, certificate pinning, HMAC, encryption at rest, and constant audits across every layer from mobile SDK to backend.

Bots, Scrapers, and Cloudflare to the Rescue

Holly praised Cloudflare Pages for static content, calling it free and “it just works” with zero bandwidth worries, though WordPress makes things more complicated. Joe talked about his work-in-progress effort to standardize robots.txt across php.net properties, while acknowledging it only helps the well-behaved crawlers — malicious scrapers and AI training bots will simply ignore it. Holly estimated AI scrapers now outnumber legitimate bots roughly 10 to 1, and both lamented how the internet has lost some of its earlier friendliness.

How the PHP Security Team Handles Your Reports

He explained that every report is read, triaged, and prioritized — someone in Discord recently got confirmation their advisory was “in the backlog.” The sobering reality is that the greater PHP security team is only one or two humans, reflecting the open-source nature of the project. The team can now issue its own CVEs rather than waiting on GitHub, so fixes and packager updates can ship as fast as possible. Joe noted serious, wild remote-code-execution-level vulnerabilities remain rare, especially this early in the 8.6 cycle, which just branched from master.

New PHP News Site, Design, and php.net’s Redesign

That sparked a running theme of developer respect for design as a discipline neither host feels competent in. Joe mentioned a php.net redesign in progress — mock-ups are available in the PHPC Discord’s PHP Foundation Ambassador Marketing subgroup, though it’s still a work in progress and not yet mobile friendly. Both admitted feeling like outsiders in design meetings the way non-developers feel in dev meetings. Joe shared Anthropic’s guidance to tell Claude what you *don’t* want for front-end work, to which he replied that as a developer, he often doesn’t even know what he doesn’t want.

A Satellite Schematic vs. a Million Lines of Code

She then described a treasured artifact: a 3-by-9-foot schematic of an entire FSC-78 Bravo-mod satellite terminal from her Army SATCOM days at Fort Detrich — the whole Cold War-grade, anti-jamming system fitting on roughly 65 letter-sized pages. Contrast that with Margaret Hamilton’s famous photo beside the Apollo code printouts: around a million lines, a scale that’s routine in modern projects. Her point: software complexity dwarfs even elaborate hardware, and developers rarely give themselves credit for it — leaky abstractions, uncaught exceptions, and endless edge cases don’t plague hardware the way they plague code.

The discussion wrapped with fault tolerance stories: Joe discovered a three-node Elasticsearch staging cluster where failover had never been enabled (and only one node was taking all the traffic), and Holly recalled a satellite timing setup with redundant cesium sources where the only part that kept failing monthly was the single non-redundant box joining them together. Fault tolerance, they agreed, is important.

Looking to hire PHP developers? Email [email protected] – Joe and the team are available for consulting, infrastructure work, Ansible playbooks, and code review.

This podcast is made a little better thanks to our partners

OurCVEs

Your security posture, on autopilot with OurCVEs

CodeRabbit

Cut code review time & bugs in half instantly with CodeRabbit.

PHP Architect Consulting

Your PHP codebase deserves a partner, not a contractor. PHP Architect provides long-term technical partnerships for organizations that need senior-level PHP expertise that you can depend on. Learn more.

https://www.epidemicsound.com/

Youtube Channel

Got feedback? Join us on Discord at discord.phparch.com

The post The PHP Podcast 2026.10.15 appeared first on PHP Architect.

<span data-mce-type="bookmark" style="display: inline-block; width: 0px; overflow: hidden; line-height: 0;" class="mce_SELRES_start"></span>

In this episode, Scott talks with Paul Conroy about agentic commerce: how AI agents buy things on our behalf, how Stripe’s shared payment tokens keep them on a budget, and how the Machine Payments Protocol finally puts HTTP 402 Payment Required to work in your API middleware.

Links:

Mentioned in this episode:

Paul’s Links:

Scott’s Links:

PHP Architect Social Media:

Subscribe to our magazine: https://www.phparch.com/subscribe/

This podcast is made a little better thanks to our partners.

OurCVEs

Your security posture, on autopilot with OurCVEs

CodeRabbit

Cut code review time & bugs in half instantly with CodeRabbit.

PHP Architect Consulting

Your PHP codebase deserves a partner, not a contractor

Music provided by Epidemic Sound https://www.epidemicsound.com/

The post Community Corner Podcast: Agentic Commerce with Paul Conroy appeared first on PHP Architect.