php[podcast] episodes from php[architect]

By php[podcast] episodes from php[architect]Technology

php[podcast] episodes from php[architect] episodes

June 18The PHP Podcast 2026.06.17
 
 
PHP Podcast – June 17, 2026
Hosts: Sara Golemon & Holly Schilling | Guests: Paul Reinheimer & Sean Coates
Eric and John are still locked in the basement. Sara is literally on a boat in Spain. Normal show, totally normal.
Sara Broadcasts from a Harbor in A Coruña
Sara is joining this week’s show from a marina in A Coruña, northwest Spain — in the Galicia region, where they speak Galician (not quite Spanish, not quite Portuguese). It’s 1am local time and the boat is visibly rocking on camera. Holly is holding down the fort from Chicago. This is what Sara calls pirate radio, except one of the pirates is actually on a boat.
Meet the Guests: Paul Reinheimer & Sean Coates
Paul Reinheimer and Sean Coates are PHP veterans from an earlier era — both were closely involved with PHP Architect around 2005–2010, back when Sara was already a PHP core contributor and the community was small enough to fit in one bar. Paul now runs Wonder Proxy, a service that lets you test your website’s behavior from locations around the world (checking GDPR banners, geo-targeted content, checkout flows, etc.), and is also building a startup called StudioWorks — business management software for creative studios, with an invoicing product and a proposals product in development. Sean is based in Montreal and has been spending time at a local hackerspace called Food Lab, where he got pulled into MeshTastic and MeshCore mesh networking, and is now surrounded by vintage computers, including a PDP-11 and five-and-a-quarter-inch floppy disks.
The Quarter-Million-Line Commit
Paul committed 250,000 lines of code directly to Wonder Proxy’s repo without a PR last week — and he’s not particularly sorry about it. The context: it was a pre-generated SQLite amalgamation file (all of SQLite compiled into a single C file), which Wonder Proxy is now checking in as a pinned static dependency rather than regenerating each build. Paul’s argument is unanswerable: you cannot meaningfully review 250,000 lines of generated C code in a PR. If there’s something malicious in there and you’re good with C, you could hide it in parameterized defines and no one would see it. The right approach, which Paul landed on, was creating a separate package with its own CI — and including the command to regenerate the amalgamation so reviewers can verify the output themselves, not just stare at the diff.
Measuring Wrong — Sean’s Rant
Sean has been ranting about this for 10–15 years and it hasn’t gotten less true: companies systematically measure things that make them look good and avoid measuring things that make them look bad. A marketing team adds a spin-to-win wheel to the homepage and celebrates their 1% sales increase. Nobody measures how many people found the wheel so obnoxious they immediately left. Cookie and GDPR banners are the same story — they go up, they’re never removed, and the conversion impact is never tracked because nobody wants to report bad news up the chain. Sean’s broader point: an epidemic of motivated measurement is a big part of why the web is as bad as it is.
PHP in 2026 vs. PHP Then — What’s Still Working
Paul’s honest take: the LAMP stack still works great. In 2004 you could build a productive web application with Linux, Apache, MySQL, and PHP — and you still can today. The fundamental approach is the same. Having since done Ruby at Stripe and other languages elsewhere, Paul keeps coming back to how much sense the PHP model makes to him. The longevity is the feature, not a bug. Wonder Proxy’s web app — built in server-side Swift using the Hummingbird framework — returns pages in under 50 milliseconds almost always and under 30 most of the time, with almost no client-side JavaScript. Server round trips are fast. The web doesn’t have to be seven seconds.
Swift Concurrency and What PHP Could Learn
Sara asked Sean — who has used Swift on the server for StudioWorks — what he’d want to see in PHP’s threading model. His answer: anything the compiler can enforce beats anything you have to remember yourself. Swift’s concurrency model has the compiler reject code that would allow a thread to trample on a sendable object after it’s been sent off. You find out about threading mistakes at compile time, not when corrupt data shows up in production. Sean’s verdict: an early warning system for threading problems is 10,000 times more valuable than discovering them too late. PHP’s async/await path is cooperative task switching (not true threading), which avoids some of these issues but can still deadlock if someone forgets to hand off control.
Composer, require_once, and Supply Chain Security
The chat raised whether anyone still uses require_once in the PSR-4 world. Sara’s answer: PHP.net does — it doesn’t use Composer at all, because the site needs to be framework and library agnostic. Grep for require_once across typical vendor dependencies and you’ll find around 100 instances still in the wild, mostly inside packages like Doctrine. The supply chain security conversation from there: Composer’s lock file pins to specific hashes, which is what you want — but a lot of projects don’t commit their lock file, and pinning to a version tag isn’t enough because tags can be updated if someone takes over a GitHub account. To really be safe, pin to a specific commit hash. It’s a pain to maintain, but it’s much harder to fake.
The PHP Foundation — The Biggest Change in PHP
Paul called out the PHP Foundation as the single biggest change in PHP since he and Sean were actively involved. Having an organization that can receive money from individual supporters and use it to fund core PHP work has been talked about since before PHP had package management. The foundation now has over 1,000 individual supporters — including Rasmus Lerdorf himself, which Sara found funny. Paul and Wonder Proxy support it financially; Wonder Proxy also holds a private Packagist account as an indirect way to fund Composer development. Sara works directly with the foundation on PHP core. Elizabeth Barron (from last week’s show) is doing exceptional work moving it forward.
PHP.net Redesign and the Dark Mode Problem
Sara copped to a php.net rabbit hole: she tried to implement dark mode for the site and succeeded everywhere except code samples. PHP’s built-in highlight_string() function has hard-coded colors that assume a light background, and there’s no way to override them. Sara wrote the patch to make the colors configurable at the internals level, then realized it should actually be a separate PHP project, then lost track of caring about it because it became yak shaving. On the redesign side: the foundation ran a competition to redesign the releases page (the per-version page with changelogs and download links), and the results look much better. The downloads page has been getting more beginner-friendly content — how to actually get PHP running, not just a reference manual. There are homepage mockups being iterated on as well.
What Talk Would You Give?
Sara asked both guests what conference talk they’d give if they were speaking today. Paul: marketing for developers. Too many developers believe “if you build it, they will come,” and AI is making this worse — the barrier to shipping something that looks professional has dropped so far that the noise floor is rising fast. Hollywood knows to spend as much on marketing as on production. Paul doesn’t claim to be good at marketing, but he thinks someone should be giving this talk at every developer conference. Sean: reliable deployment and supply chain integrity — specifically how to actually control the path from git to production without sneaking in vulnerabilities. Containers have helped, but there’s still a lot of infrastructure that fetches things at build or request time that is genuinely dangerous.
PHP Tek 2027
The PHP Tek 2027 website is live at phptek.io. No date confirmed on air, but the site is up and people should keep an eye on it.
Links from the show:
Wonder Proxy — Test your website from around the world
PHP Tek 2027 — phptek.io
The PHP Foundation — Support PHP development
PHP Architect Discord
Guest Hosts:
Sara Golemon
Currently sailing in the Atlantic (broadcasting from A Coruña, Spain)
PHP core contributor; code contributor via the Curl project (which means she technically has code on Mars)
Holly Schilling
Primary mobile developer; built the PHP Tek 2026 conference app
Based near Chicago, IL
Guests:
Paul Reinheimer
Founder, Wonder Proxy — test your website’s geo-targeted behavior from 300+ global locations
Founder, StudioWorks — business management tools for creative studios (invoicing & proposals)
Former PHP Architect team member; wrote a book on PHP and APIs
Sean Coates
Based in Montreal; regular at the Food Lab hackerspace
MeshTastic/MeshCore mesh networking enthusiast; vintage computer collector (PDP-11 era)
Former PHP Architect team member and longtime PHP community contributor
Streams:
Youtube Channel
Twitch
Connect & Hire
PHP Architect Website
Twitter/X
Mastodon
Hire PHP Developers
Looking to hire PHP developers? Email [email protected] – Joe and the team are available for consulting, infrastructure work, Ansible playbooks, and code review.
Partner
This podcast is made a little better thanks to our partners
Displace

Infrastructure Management, Simplified
Automate Kubernetes deployments across any cloud provider or bare metal with a single command. Deploy, manage, and scale your infrastructure with ease.
https://displace.tech/

PHPScore
Put Your Technical Debt on Autopay with PHPScore

CodeRabbit

Cut code review time & bugs in half instantly with CodeRabbit.

Music Provided by Epidemic Sound
https://www.epidemicsound.com/
Join Us Live Next Week
Youtube Channel
Got feedback? Join us on Discord at discord.phparch.com
The post The PHP Podcast 2026.06.17 appeared first on PHP Architect.
1 hr 20 min
June 11The PHP Podcast 2026.06.11
 
 
PHP Podcast – June 11, 2026
Guest Hosts: Sara Golemon, Elizabeth Barron & Holly Schilling
Eric and John are out this week — Sara, Elizabeth, and Holly take over. Here’s what they covered:
PHPVerse Recap
PHPVerse just wrapped up, and Elizabeth was there in Amsterdam. The format is unusual — all speakers are flown to one location, but the audience is entirely virtual. It was a class act: professional TV crew, studio lighting, and a makeup and hair team on site. Around 2,500–3,000 people watched the live stream. Everything was broadcast as one long block; individual talk segments and possibly the documentary trailer will be cut and released separately. The full stream is available now — the PHP documentary trailer (produced by Jet Breeze, covering 30+ years of PHP history) appears around the 2:24:30 mark.
PHP Foundation 2026 Strategy Document
Elizabeth and the PHP Foundation released their 2026 strategy document the same day as this recording. The foundation gathered community input across numerous conversations and conferences, synthesized it into findings, and has now published a plan for the rest of the year. Key themes: repositioning PHP’s public perception (which Elizabeth calls a solvable problem), creating six special interest groups, and launching an Onboarding Initiative to build a real on-ramp for new PHP developers. Elizabeth’s view is that the two things giving her the most hope for PHP’s future are the passion and expertise of the community, and how good the language itself has gotten. Visit thephp.foundation to read the full document.
The Onboarding Initiative
One of the six special interest groups the foundation is launching is specifically focused on bringing new developers into PHP. Goals include creating a true learning path (not just a reference manual that assumes existing knowledge), improving educational resources, and potentially working with the php.net website to improve the first-time experience. Holly made the point that PHP’s barrier to entry is genuinely lower than almost any other language — the Hello World program is 11 characters — but that story isn’t being told outside the PHP bubble. New developers are turning to JavaScript as a first language and running into minified spaghetti instead of something approachable.
AI Writing PHP — And PHP as a Second Language
Holly built the entire PHP Tek conference app backend in Laravel without writing a single line of code herself — AI-generated throughout, which she reviewed and approved. The code held up to peer review at the conference with only minor style nits. She ran it on PHP 8.3 and used modern standards throughout (one piece of feedback: stop using empty()). The consensus: AI models write good modern PHP because of the vast amount of open source PHP they were trained on. The caveat Sara raised is worth thinking about — how much of that training data is PHP 4-era code and WordPress 3 repositories? Either way, Holly’s case for PHP as a second language is strong: low ceremony, low boilerplate, readable syntax, and it’s a language where you can do something useful in minutes.
PHP’s Reputation Problem (and Why It’s Fixable)
The group dug into PHP’s perception gap — the mismatch between how good the language actually is and how it’s perceived outside the community. Holly’s experience as a mobile developer who recommends PHP to others: the pushback is immediate (“isn’t that slow?”, “isn’t that dead?”). The benchmarks don’t support that reputation — PHP outperforms Python on most comparable workloads — but data alone doesn’t shift perception. Elizabeth’s point is that this is primarily a storytelling and coordination problem, not a language problem, and that the foundation’s repositioning work is exactly aimed at closing that gap. The community has the passion. It just needs to tell the story outside its own bubble.
PHP Polling API RFC
Sara walked through the RFC for a new Polling API in PHP (wiki.php.net/rfc/poll_API). The short version: PHP currently has five or six different ways to do I/O multiplexing (watching multiple streams and acting on whichever one is ready first), and which one works depends on the OS, available extensions, and PHP version. The Polling API proposal creates a single, unified interface that abstracts all of that. The immediate beneficiaries are async frameworks like Amp PHP, ReactPHP, and Revolt, which currently have to maintain multiple backend implementations to cover different environments. The bigger picture: this is a building block on the path toward true async PHP, likely contributing to something more complete in PHP 9.0. Most app developers won’t use it directly — but the libraries they depend on will. RFCs are all listed at wiki.php.net/rfc.
PHP.net: Do As We Say, Not As We Do
Sara, who has contributed to php.net, copped to the state of the codebase: some of it dates to the PHP 3 era, there are functions.inc files, and it is very much “do as we say, not as we do.” The historical reason is that php.net used to rely on community-administered mirrors (r-synced servers running everything from PHP 5.1 to 5.6 simultaneously), so modernizing the code was impossible without controlling the runtime. That’s changed with CDN-based load balancing — they can now control what PHP version runs on php.net — and the code has been getting better. But it’s a slow process.
PHP Podcasts Past, Present, and Future
Holly asked about the PHP Town Hall podcast (Ben Edmonds and Phil Sturgeon), and the group did a quick tour of PHP podcast history. The PHP Roundtable — originally started by Sammy, taken over by Eric — has produced about three episodes. Sara and producer Joe are planning to take it off Eric’s hands and actually do it properly. And Elizabeth announced that the PHP Foundation is launching a new podcast: tentatively called PHP at Scale, hosted by Ben Marx, focused on telling the stories of organizations pushing PHP to its limits. No launch date yet, but there’s already a queue of interested guests.
Next Week’s Show — Moved to Wednesday
Sara will be on a boat off the coast of Galicia on Thursday, so next week’s episode is moving to Wednesday. Guests will include Paul Reinheimer and (hopefully) Sean Coase — two veterans from PHP’s podcasting past. Elizabeth is going to try to make it work around the Canadian Grand Prix.
Mac Mini M4 for Local LLMs
Holly picked up a refurbished Mac Mini M4 (16GB RAM, 512GB storage) specifically to run LLM models locally via Ollama. Apple Silicon is a solid choice for this because the unified memory architecture gives the neural cores access to far more RAM than a discrete GPU setup. Sara is waiting for the M5, which is reportedly not coming until fall — and is already resigned to spending too much on it when it lands.
Links from the show:
PHP Foundation — 2026 Strategy Document
PHP RFC: Polling API
PHP RFC Wiki — All RFCs Under Discussion
Amp PHP — Async framework
ReactPHP — Event-driven async PHP
Revolt — Event loop for PHP
php.net website source code (github.com/php/web-php)
PHP Architect Discord
Guest Hosts:
Sara Golemon
Based in Lisbon, Portugal
PHP core contributor; code contributor via the Curl project (which means she technically has code on Mars)
Elizabeth Barron
Executive Director, PHP Foundation
Based in Germany
Holly Schilling
Primary mobile developer; built the PHP Tek 2026 conference app
Based near Chicago, IL
Streams:
Youtube Channel
Twitch
Connect & Hire
PHP Architect Website
Twitter/X
Mastodon
Hire PHP Developers
Looking to hire PHP developers? Email [email protected] – Joe and the team are available for consulting, infrastructure work, Ansible playbooks, and code review.
Partner
This podcast is made a little better thanks to our partners
Displace

Infrastructure Management, Simplified
Automate Kubernetes deployments across any cloud provider or bare metal with a single command. Deploy, manage, and scale your infrastructure with ease.
https://displace.tech/

PHPScore
Put Your Technical Debt on Autopay with PHPScore

Music Provided by Epidemic Sound
https://www.epidemicsound.com/
Join Us Live Next Week
Note: Next week’s show is on Wednesday (not Thursday) with guests Paul Reinheimer and Sean Coase.
Youtube Channel
Got feedback? Join us on Discord at discord.phparch.com
The post The PHP Podcast 2026.06.11 appeared first on PHP Architect.
1 hr 18 min
June 05The PHP Podcast 2026.06.04
 
 
PHP Podcast – June 4, 2026
Hosts: Eric Van Johnson & John Congdon
Another fun episode of the PHP Podcast! Here’s what we covered:
PHP Tek 2027 — New Dates, Bold New Format
Mark your calendars: PHP Tek 2027 is happening April 27–29 in Chicago, and Eric and John are shaking things up. Rather than a straight three-day PHP conference, next year gets three tracks — two of which are familiar PHP-focused content, and a third specialty track that rotates each day: one day of JavaScript, one day of DevOps, and one day of Laravel. The Laravel track is specifically focused on how developers actually use the framework day-to-day, not a product pitch. Single-day passes will be available, so if you’re only coming for the DevOps or JS day, you’re covered. One important heads-up: there’s a big convention happening at a venue nearby in Rosemont, so the hotel block could sell out faster than usual. When they open reservations, don’t wait.
Holly the Elephant Is Going Fast
The PHP Architect conference elephant, named Holly, is now available at store.phparch.com, and demand has been remarkable. Eric woke up one morning to a flood of orders and genuinely couldn’t figure out what happened. The warning from last year applies here: people said they’d grab Tony later, and now Tony is gone forever. Holly ships June 17th for most orders, but if you’ve already ordered, it’s likely on its way. Get yours while you can.
PHP Tek TV Is Doing Something Different This Year
In past years, conference talk videos would get edited and uploaded weeks (or months) after the event. This year, John is doing things differently: the raw, unedited recordings are going up now, with timestamps in the description so you can jump straight to specific talks — some rooms recorded a seven-hour continuous feed and just left it running. The clean edited versions are still coming (a video editor friend in the UK is on it), but if you want to see a talk right now, the raw version is there. Audio quality varies by room, but it’s watchable.
Immich — A Self-Hosted Google Photos That Actually Works
John has been running Immich, a self-hosted photo management platform, in a Docker container for about a month and loves it. It does facial recognition, GPS tagging, and auto-uploads from his phone — essentially everything he cares about in Google Photos, without handing his photos to Google or Apple. He’s now planning to use it as the PHP Architect conference photo library, centralizing all the Tech photos in one browsable, shareable place. It’s fully open source, with no licensing cost, and an optional donation tier. If you’re sick of paying ever-increasing storage bills to big tech companies, this is worth a look.
Ben Ramsey’s PHP Tek Homecoming Article Is Free to Read
The May issue of PHP Architect magazine is now available to digital subscribers, and this month’s free article is Ben Ramsey’s piece on the PHP Tek homecoming experience. Eric reached out to Ben last minute and he delivered. If you’ve never subscribed, this is a low-barrier way to see what the magazine is like. Head to phparch.com, grab the free article, and if you like what you see, subscriptions are not expensive.
John Is Resurrecting a Legacy Laravel App — With Claude’s Help
John has been grinding away on a Laravel 6 app that was a passion project years ago and has now been revived as an actual client project. Using Claude to methodically baby-step through each version upgrade — starting with writing tests to establish a baseline — he’s worked up through the major Laravel versions. The turning point came when he hit the version where the old event sourcing package (Prooph) was clearly on its way out, and the decision was made to migrate to Verbs, Nuno Maduro’s Laravel-native event sourcing package. John’s now looking forward to it. He’s also accidentally been burning tokens on the company Anthropic account (not his personal account), which Eric caught live on air. They are going to talk about it after the show.
Eric’s Mystery Side Project Is Almost Ready — If DNS Would Cooperate
Eric teased a new side project last week and intended to reveal it this week, but he’s stuck waiting on DNS propagation. The domain was registered with DigitalOcean DNS already in use by a previous owner, so Eric moved it to Cloudflare — only to discover there may be a conflict because the previous owner was also on Cloudflare. The result: the name servers are stuck on old values. John’s live suggestion was to move it to Route 53, and Eric was immediately sold. The project is almost ready to show the world, DNS gods willing.
Meta’s AI Support Bot Got Socially Engineered
Eric shared a video demonstrating how someone prompt-injected Meta’s AI customer support bot into sending a verification code to an attacker-controlled email address — and then using that code to add the email to an account, enabling a full password reset and account takeover. The irony: Meta is the company behind Llama and has some of the deepest AI expertise on the planet, and they still shipped a support bot with permissions it shouldn’t have. Eric’s point was pointed: you can fire a human employee who gets social engineered, which creates accountability throughout the team. An AI has no such incentive structure. Crowbarring AI into account-modification workflows without appropriate guardrails is just asking for this.
The PHP Foundation Now Publishes Board Meeting Minutes
Eric discovered that the PHP Foundation has started publishing their board meeting minutes in a public GitHub repository. Nothing earth-shattering yet, but seeing who attended, what was discussed, and what decisions are being made gives the community a real window into how the foundation operates at scale. It also helps explain something Eric and John have always found interesting: why PHP stalled so hard between versions 5 and 7. There was no foundation, no financial backing, just volunteer hours. Now there’s a paid staff and governance structure — and the minutes show exactly how complex running something at PHP’s scale actually is.
The PHP Foundation Has a Dedicated Security Team Now
Speaking of the Foundation, it now has a dedicated security team — a sign of how seriously the supply chain attack problem has gotten. AI tools are being deployed by black hat actors to find vulnerabilities in open source projects at a scale that wasn’t possible before. PHP is not just another open source project; it underpins a massive slice of the web, and companies depend on it staying secure. Having a team specifically focused on this is the right call, even if it’s a sobering reminder of where the threat landscape is heading.
Moat — Nuno’s GitHub Security Auditing Tool
Nuno Maduro (of Laravel fame) quietly shipped a tool called Moat that audits your GitHub presence for security gaps. Install it globally via Brew or Composer, point it at your GitHub org, a specific repo, or even a specific branch, and it gives you a report on where your security posture could be improved. It’s read-only — it won’t change anything — and it’s explicit that it is not a security certification. Eric wants to use it to audit the PHP Architect organization’s repos, many of which haven’t been touched in years. Think of it as a fast, opinionated triage tool, not a replacement for a real security audit.
Links from the show:
PHP Tek 2027 — Chicago, April 27–29
PHP Architect Store — Holly the Elephant
Immich — Self-Hosted Photo Management
PHP Architect Magazine
Verbs — Laravel Event Sourcing by Thunk
Moat — GitHub Security Auditing by Nuno Maduro
PHP Foundation on GitHub
PHP Architect Discord
Host:
Eric Van Johnson
X: @shocm
Mastodon: @[email protected]
Bluesky: @ericvanjohnson.bsky.social
PHPArch.me: @eric
John Congdon
X: @johncongdon
Mastodon: @[email protected]
Bluesky: @johncongdon.bsky.social
PHPArch.me: @john
Streams:
Youtube Channel
Twitch
Connect & Hire
PHP Architect Website
Twitter/X
Mastodon
Hire PHP Developers
Looking to hire PHP developers? Email [email protected] – Joe and the team are available for consulting, infrastructure work, Ansible playbooks, and code review.
Partner
This podcast is made a little better thanks to our partners
Displace

Infrastructure Management, Simplified
Automate Kubernetes deployments across any cloud provider or bare metal with a single command. Deploy, manage, and scale your infrastructure with ease.
https://displace.tech/

PHPScore
Put Your Technical Debt on Autopay with PHPScore
CodeRabbit

Cut code review time & bugs in half instantly with CodeRabbit.

Music Provided by Epidemic Sound
https://www.epidemicsound.com/
Join Us Live Next Week
Youtube Channel
Got feedback? Join us on Discord at discord.phparch.com
The post The PHP Podcast 2026.06.04 appeared first on PHP Architect.
58 min
May 30The PHP Podcast 2026.05.28
 
 
PHP Podcast – May 28, 2026
Hosts: Eric Van Johnson & John Congdon
Links from the show:
PHP barely avoided disaster – YouTube
CVE-2026-45793: Anatomy of a 14-Hour PHP Supply-Chain Near-Miss · graycoreio/github-actions-magento2 · Discussion #261 · GitHub
An Update on Composer & Packagist Supply Chain Security
PHP Tek: A Homecoming by Ben Ramsey
Tek Roundup – Roave
Speaking at PHP Tek 2026! #tech – YouTube
PHP Tek is behind us, the ballroom is cleaned up, and we’re back to talk about all of it. Here’s what we covered:
RIP Archie Bot
After a long fight to keep him alive, Eric has officially retired Archie — the Discord bot built on OpenClaw that handled team standups, monitored PHP Architect’s Twitter/X group for join requests, and did a surprising amount of background work for the consulting team. When Anthropic shut down the OpenClaw API, Eric tried every model and service he could find to bring Archie back to form, but nothing got him all the way there. After a month of “almost working,” the call was made. He’s dead. Eric hasn’t ruled out revisiting it eventually — maybe with Claude Cowork — but for now, the bot is gone and the starting-soon link in Discord is broken because of it.
Reviving a Six-Year-Old Codebase
A client PHP Architect Consulting worked with from 2018 to 2021 has come back. The project — a reimagining of their app — was killed off when COVID hit and the CEO couldn’t align with the team’s vision. The last commit was six years ago. Now the client wants to bring it back, and Eric is spending the next few days analyzing what it’ll take to get it running again. Outdated packages, an old PHP version, and the general entropy of time are all on the checklist. Eric has genuine affection for this codebase — it was one of the first projects where he felt like the team was truly operating as a team, not just as an extension of him. Now it’s time to dust it off.
Partner Spotlight: PHP Score → Our CVEs
The PHP Score sponsor read may be getting a refresh — the folks at Artisan Build, who built PHP Score, have a new product they’re excited about: ourCVEs.com. It monitors your codebase’s Composer and NPM packages — and optionally your servers via a lightweight agent — for exposure to open CVEs, and alerts you when something needs attention. Pricing is generous: free forever for open source projects, $17/month for solo devs, $83/month for teams (or $1,000/year), with server monitoring scaling at $1 per server above 50. Ed from Artisan Build was at PHP Tek and made a strong impression. Go check it out at ourcves.com.
How PHP Barely Avoided a Supply Chain Disaster
Brent Roose released a 22-minute video covering a near-miss in the PHP ecosystem involving GitHub and Composer. The short version: GitHub changed their token format and briefly released it before Composer was ready to handle it. Composer was logging the token when the format check failed — meaning GitHub tokens were ending up in CI logs. In GitHub Actions, depending on how your action is configured, that container (and its token) might stick around for a while, giving an attacker a window to act. An alert developer caught the issue, used Claude to help research it, then did responsible disclosure — contacting the Composer maintainers and reaching out to Taylor Otwell, Vincent Pontier, and others in the ecosystem to disable their actions until the fix was in place. Update your Composer. GitHub rolled back the new token format but won’t keep it rolled back forever.
Packagist MFA and Account Security
Following up on the supply chain theme: Nils and Igor (Composer/Packagist maintainers) released a blog post on what they’re doing to improve supply chain security. The immediate ask for anyone publishing packages is to enable MFA on your Packagist account — it’s not required yet, but it will be. Eric went to check his own account, found MFA was already on, but noticed his username was still “diegodev” and he was using an old email. While updating it, he noted that Packagist didn’t require him to re-authenticate or confirm the change via the old email — a gap worth flagging if you have popular packages and someone ever gets into your session.
PHP Tek 2026 Recap — The Good
PHP Tek 2026 in Chicago is done, and despite everything (see below), the team is proud of how it went. Some highlights:
Holly (CodeLorax) built a conference mobile app from scratch, released on both Google Play and the Apple App Store within 24 hours of the conference opening. The app let attendees build their own schedule, detected conflicting talk selections, sent push notifications when talks moved rooms, and even included a vendor lead-scanning feature where vendors could scan attendee QR codes to capture contacts. It was a genuine game-changer for the event. Eric and John named the conference elephant after Holly in appreciation — she also changed a trailer tire during setup, which sealed the deal.
Clayton Kendall sponsored and produced the conference shirts and bags on an extremely tight timeline — shirts two weeks out, bags just one week before the event. Both were a hit. Attendees at the conference were getting questions about the rainbow PHP Architect shirt in particular.
A job fair ran for the first time, with four companies represented. One hiring manager showed up even though they already had 1,400 applicants — because they knew that conference attendees are exactly the kind of motivated, self-improving developers they want. Attendees got to ask questions directly, including the real-world stuff like remote vs. office. Eric would love feedback on how to make it better next year.
JS Tech debuted as a fourth track alongside the three PHP tracks, bringing in fresh faces from the JavaScript community. Eric came away energized by the cross-pollination — different people, different approaches to similar problems.
Ben Ramsey and James Tickham (Rove) both wrote great blog posts about the conference. Ben’s will be featured in the magazine. Diana Pham also put together a video recap. Links in the show notes.
PHP Tek 2026 Recap — The Incident
On Monday during final setup, a hotel employee had a medical incident while walking through the main ballroom — leaving a trail that required hazmat-suited cleanup crews and forced the team to quarantine the ballroom, the hallway leading to it, and the adjacent bathroom. The person is okay and was back at the hotel by Friday, which was a relief. But in the moment, nobody knew what was happening or how long the room would be unavailable.
The team had to rebuild the entire conference footprint overnight. The keynote moved, the JS Tech track went into the quiet room, vendors moved to the atrium, and the hotel staff — to their enormous credit — cleared their own furniture and accommodated every ask without complaint. Attendees were equally patient; once they understood the situation, there was no drama, just “tell us where to go.”
The incident also took out the streaming setup for day one, compounding an already-difficult start. The solution that eventually worked — plugging the Ethernet into a hub before the streaming equipment — wasn’t tried until day three. Eric is mad at himself for thinking of it and not doing it sooner.
PHP Tek 2027 — Save the Date (TBD)
Planning for next year is already underway. The current target is April 2027 — away from the May timing that caused Eric to miss two of his kid’s band performances this year. Nothing is locked yet, but they’re working through venue and date options and hope to have an announcement soon.
Links from the show:
ourCVEs.com — Daily security audit on autopilot
PHPScore — Technical debt monitoring for PHP
Brent Roose — “How PHP Barely Avoided Disaster” (YouTube)
Packagist — Enable MFA on your account
PHP Architect Discord
PHP Architect Merch Store
PHP Architect YouTube
Host:
Eric Van Johnson
X: @shocm
Mastodon: @[email protected]
Bluesky: @ericvanjohnson.bsky.social
PHPArch.me: @eric
John Congdon
X: @johncongdon
Mastodon: @[email protected]
Bluesky: @johncongdon.bsky.social
PHPArch.me: @john
Streams:
Youtube Channel
Twitch
Connect & Hire
PHP Architect Website
Twitter/X
Mastodon
Hire PHP Developers
Looking to hire PHP developers? Email [email protected] – Joe and the team are available for consulting, infrastructure work, Ansible playbooks, and code review.
Partner
This podcast is made a little better thanks to our partners
Displace

Infrastructure Management, Simplified
Automate Kubernetes deployments across any cloud provider or bare metal with a single command. Deploy, manage, and scale your infrastructure with ease.
https://displace.tech/

PHPScore
Put Your Technical Debt on Autopay with PHPScore

CodeRabbit

Cut code review time & bugs in half instantly with CodeRabbit.

Music Provided by Epidemic Sound
https://www.epidemicsound.com/
Join Us Live Next Week
Youtube Channel
Got feedback? Join us on Discord at discord.phparch.com
The post The PHP Podcast 2026.05.28 appeared first on PHP Architect.
1 hr 12 min
May 15The PHP Podcast 2026.05.14
 
 
PHP Podcast – May 14, 2026
Hosts: Eric Van Johnson & John Congdon
Another fun episode of the PHP Podcast! Here’s what we covered:
PHP Tek Is Four Days Away
The countdown clock is basically ticking in real time — PHP Tek 2026 in Chicago is just four days and ten hours out as this episode begins. Eric flies Friday, John flies Saturday, and the team descends on the venue Sunday to get the trailer unloaded, the booth assembled, and everything tested before the conference kicks off. The conference magazines — ordered three weeks ago and still showing “printing” on Tuesday — pulled through at the last minute and are set to arrive at the venue tomorrow. That’s cutting it close, but it counts.
Win a Free PHP Tek Ticket — Live on Air
John put a full conference ticket up for grabs: DM him on any social platform, and he’d draw a winner on the live stream. The caveat? You had to be watching live — audio listeners are out of luck on this one. The lucky winner drawn on air was Jeffrey Davidson, who will now be at PHP Tek. Eric offered to even bring him to the team’s Saturday minor league baseball game if he flies in early enough. Jeffrey gets a hand-printed sticker name badge, but he’ll have a badge.
New PHP Architect Conference Merch
Fresh shirts are coming to the PHP Tek booth courtesy of Clayton Kendall, who is producing the apparel. The new design goes with a smaller logo placement — a more subtle, wearable-anywhere look compared to the big bold prints. If you’re headed to Chicago, swing by the PHP Architect table and see what’s there.
Holly’s Conference App Gets a Vendor Mode
The PHP Tek attendee app built by Holly (developed by CodeLorax) has been upgraded ahead of the conference. What started as a schedule browser with conflict detection and push notifications has now merged with a vendor lead scanning tool. Attendees can log in by scanning the QR code on their badge, and vendors can scan attendee badges to capture leads — all in a privacy-preserving way that doesn’t expose raw contact data. Eric’s wife Bek figured out the app entirely on her own without being told anything, which remains one of the best usability endorsements you can give.
Something Big Is Happening in the PHP Community
Eric teased something he can’t officially talk about yet — a community acquisition that’s still working through the legal and DNS transfer process. A new droplet has been created. Joe has already figured out what it is. Eric is too excited not to bring it up but too responsible to spill the details before it’s official. The plan is to announce after PHP Tek. If you want to know early, apparently getting Joe drunk at the conference is your best strategy.
Grok AI Exploited via Morse Code in Bank Transactions
A video from the Dave’s Garage YouTube channel surfaced a genuinely unsettling AI exploit: someone used a Grok-powered AI banking agent and embedded hidden instructions inside transaction memo fields — written in Morse code. The agent decoded the dots and dashes, interpreted them as instructions, and followed them, ultimately losing somewhere between $154,000 and $200,000 in crypto transfers. This is prompt injection in its most creative and alarming form yet. The attack surface for AI agents hooked into real financial systems is not theoretical — it’s happening.
TanStack Hit by NPM Supply Chain Attack
The TanStack ecosystem — the popular query, router, and table libraries — was hit by a supply chain attack via GitHub Actions cache poisoning. The attack vector was a forked pull request: a malicious fork can trigger GitHub Actions workflows and potentially inject poisoned artifacts into the build cache, which then get picked up by the legitimate package. Simon Hamp from NativePHP caught it and raised the alarm in the PHP Architect Discord. It’s a good reminder that the supply chain attack surface extends well beyond just what’s in your `composer.json` or `package.json` — your CI pipeline’s caching behavior matters too.
PHP Tek Job Fair — Wednesday Afternoon
There will be a job fair at PHP Tek this year, scheduled for Wednesday afternoon. At least one confirmed hiring manager will be there. If you’re looking for PHP work, or if you’re a company looking for PHP talent, this is worth planning around. Eric and John both see it as a natural fit for the conference — the PHP community is tight-knit enough that a job fair actually means something.
Eric’s Birthday Spa Day in Palm Springs
Eric’s wife Bek surprised him with a birthday spa day in Palm Springs. It was his first massage ever, and he paired it with a mineral soak in the natural springs. He came away thoroughly convinced — the combination of the mineral water and a proper massage left him feeling better than he expected, and he’s already thinking about going back. Beck planned the whole thing, and Eric was appropriately grateful.
John’s First Couples Massage
John has now also had his first couples massage, and it did not go quietly. He opted for deep tissue — which means the therapist was working hard — and his wife, in the room next door, was apparently convinced something was wrong based on the sounds coming through the wall. John described it as the kind of massage where you’re not entirely sure if you’re being helped or attacked, and the answer turns out to be both. He’d do it again.
PHP Architect Becomes Padres Season Ticket Holders
Eric and John are now official San Diego Padres season ticket holders — their first year in the program. As first-timers, they’re at the very bottom of the seniority ladder, which means they were among the last to pick seats. John blames Eric for not signing up years ago. There’s an upcoming Wednesday day game against the Dodgers with available tickets if anyone in San Diego wants them — reach out to John.
Links from the show:
PHP Tek 2026 — Chicago
TanStack — Open Source Data Tools for the Web
NativePHP — Simon Hamp’s Native App Framework for PHP
PHP Architect Store
PHP Architect Discord
Host:
Eric Van Johnson
X: @shocm
Mastodon: @[email protected]
Bluesky: @ericvanjohnson.bsky.social
PHPArch.me: @eric
John Congdon
X: @johncongdon
Mastodon: @[email protected]
Bluesky: @johncongdon.bsky.social
PHPArch.me: @john
Streams:
Youtube Channel
Twitch
Connect & Hire
PHP Architect Website
Twitter/X
Mastodon
Hire PHP Developers
Looking to hire PHP developers? Email [email protected] – Joe and the team are available for consulting, infrastructure work, Ansible playbooks, and code review.
Partner
This podcast is made a little better thanks to our partners
Displace

Infrastructure Management, Simplified
Automate Kubernetes deployments across any cloud provider or bare metal with a single command. Deploy, manage, and scale your infrastructure with ease.
https://displace.tech/

PHPScore
Put Your Technical Debt on Autopay with PHPScore

CodeRabbit

Cut code review time & bugs in half instantly with CodeRabbit.

Music Provided by Epidemic Sound
https://www.epidemicsound.com/
Join Us Live Next Week
Youtube Channel
Got feedback? Join us on Discord at discord.phparch.com
The post The PHP Podcast 2026.05.14 appeared first on PHP Architect.
57 min
May 14Community Corner: Global Accessibility Awareness Day with Joe Devon

In this episode, Scott talks Global Accessibility Awareness Day with Joe Devon the creator of the day.
Links:
Our Discord – https://discord.gg/aMTxunVx
Buy our shirts – https://store.phparch.com/products/community-corner-podcast-t-shirt
Joe’s Links:
LinkedIn – https://www.linkedin.com/in/joedevon/
Global Accessibility Awareness Day – https://accessibility.day/
Accessibility and Gen AI Podcast – https://podcasts.apple.com/us/podcast/accessibility-and-gen-ai-podcast/id1759047581
Scott’s Links:
Website – https://scott.keck-warren.com/
Bluesky – https://bsky.app/profile/scottkeckwarren.bsky.social
LinkedIn – https://www.linkedin.com/in/scott-keck-warren-91689810/
Mastodon – https://phpc.social/@scottkeckwarren
PHP Architect Social Media:
X: https://x.com/phparch
Mastodon: https://phparch.social/@phparch
Bluesky: https://bsky.app/profile/phparch.com
Discord: https://discord.phparch.com
Subscribe to our magazine: https://www.phparch.com/subscribe/
Partners
This podcast is made a little better thanks to our partners.
Displace
Infrastructure Management, Simplified
Automate Kubernetes deployments across any cloud provider or bare metal with a single command. Deploy, manage, and scale your infrastructure with ease.
https://displace.tech/
PHPScore
Put Your Technical Debt on Autopay with PHPScore
https://phpscore.com/
CodeRabit
CodeRabbit – Cut code review time & bugs in half instantly with CodeRabbit.
https://www.coderabbit.ai/
Music Provided by Epidemic Sound https://www.epidemicsound.com/
#phpc #php #communityCornerPodcast #podcast #phptek
The post Community Corner: Global Accessibility Awareness Day with Joe Devon appeared first on PHP Architect.
19 min
May 08The PHP Podcast 2026.05.07
 
 
PHP Podcast – May 7, 2026
Hosts: Eric Van Johnson & John Congdon
Another fun episode of the PHP Podcast! Here’s what we covered:
PHP Tek Is 11 Days Away — And Everyone Is Stressed
The conference countdown is real: 11 days, 10 hours, and a handful of seconds on the clock. John’s travel plans hinge entirely on little league baseball — if his team wins their Tuesday playoff game, he coaches the Saturday game, then bolts for the airport. If they lose Tuesday, he’s sad but gets to Chicago earlier. Meanwhile, Eric is grinding through the PHP Tek TV redesign, trying to wire up the SessionIze API for schedule imports instead of doing it all manually from a CSV, and sending the design team a novel’s worth of badge and signage requests. Holly’s conference app now has notifications working: select a talk, and if Eric or John move it around, you’ll get pinged. Keynote and lunch notifications are also on the table for attendees who can never find the room.
Conference Stress Dreams: The Motorcycle Gunman Edition
John woke up mid-dream to his wife opening the blinds for the school run — and the dream he was pulled from was genuinely unhinged. He was in an Uber waiting for Uber Eats to arrive at an intersection when a motorcyclist pulled up behind them, got off, shot out the tire, then came to John’s door and started shooting at the lock to get in. The Uber app had briefly flashed the word “threat” on the map. John laid the seat back as far as it would go. The driver just stood there. Then the blinds opened and it was just a Thursday morning. John’s verdict: it’s conference stress. Hard to argue with that.
JS Tek — An Honest Conversation
John decided to say the quiet part out loud: JS Tek hasn’t brought in the JavaScript community the way they hoped. The PHP world is unusual in paying for speaker travel and hotel rooms; Joe in Discord confirmed this barely happens outside PHP, and somebody speaking at a Ruby/Rails conference once told Eric they not only weren’t reimbursed for travel — they had to buy their own conference ticket. Eric’s takeaway: the JS track itself is a great idea for PHP developers, but trying to recruit an entirely new community into the fold didn’t work out. Next year’s structure will probably look different.
The PHP 7-to-8 Upgrade That Failed Three Times
Eric’s consulting team has been struggling with a client upgrade from PHP 7 to 8 — unusual, because they’ve done this many times and know the pitfalls. After three failed attempts, a deep dive revealed the culprit: an abandoned Laravel Shift branch left behind by a previous developer who had started an upgrade and walked away, with missing config files baked right into the inherited codebase. The fix wasn’t just another attempt — it was getting the management team to produce a proper testing playbook, and more importantly, actually getting trained on the application. The team had been fixing bugs in code they’d never seen working correctly. Today they finally got that training session, and Eric says the excitement and “ah-ha” moments from his developers made it clear this should have happened much sooner.
The Database on the Same Server Problem
A related discovery from the same client: the database lives on the same machine as the application. Every upgrade means shutting the app down, exporting the database, migrating it somewhere else, and starting over. Eric’s head doesn’t compute why this is still the case in 2026. Even a second machine designated as a database server would be a massive improvement. In a moment of uncomfortable honesty, Eric also admitted that PHP Architect’s own conference site has the same setup — Forge makes it so easy to throw a database on the same box that you just don’t think about it, until you do.
Laravel Shift, Laravel Cloud, and the Pre-Check Tool
The conversation circled back to Laravel Shift — JMAC’s automated upgrade tool — which Eric notes has become less essential as Laravel’s upgrade paths have smoothed out considerably compared to the wild west of early Laravel development. But Shift is still out there and still useful. More interestingly, JMAC has a new free Shift specifically for Laravel Cloud readiness: run it against your app and it’ll tell you whether your application is compatible with Laravel Cloud’s serverless model, flag any system commands that won’t be available, and help you understand what services you’d need. Laravel Cloud itself is Taylor’s “don’t worry about servers” deployment platform, and if you’re not a sysops person, having a Shift that holds your hand through the setup could be the difference between trying it and not.
PHP Internals Made Readable — Externals and PHP RFC Watch
Eric plugged two tools for following what’s happening in PHP core. The first is externals.io — a much more readable front-end for the PHP internals mailing list, with search, read-tracking, and threaded discussions. The second is a newer discovery: php-rfc.watch, which focuses purely on RFCs, showing what’s active, what’s been voted on, and how the votes broke down. It’s more of a quick-glance dashboard than a full discussion forum. Eric also highlighted a specific RFC from Ben Ramsey: a proposal to update the PHP license, accompanied by a detailed blog post called “PHP License Simplified” that walks through the history and rationale. If you’ve ever been curious about why license choice matters (especially at the enterprise level where legal teams block open source based on license type), Ben’s post is worth the read.
NeoVim’s Flash Plugin — Used Wrong for Years
Eric has been using Flash.nvim, a NeoVim navigation plugin, for years. He recently discovered he had been using it completely incorrectly the entire time. He thought he understood what it did. He did not. A YouTube video explaining the plugin properly (titled something like “How to Jump Anywhere Instantly in NeoVim”) revealed that what he’d been doing was essentially pressing the wrong keybinding and stumbling through a fraction of the plugin’s actual functionality. This sent the conversation into a longer Vim origin story: Eric learned Vim because he was flying around the country installing Cyborg firewalls on remote servers and Vi was just there. John picked it up at an enterprise job and never thought about alternatives until he saw a developer using MacVim to write Rails and had his mind blown. The core message: you can use a tool for decades and still be using it wrong, and that’s okay — but watch the tutorial.
Eric Doesn’t Know How Old He Is
Eric has been confidently telling people for a full year that he’s 55. His wife Bek has known for some time that this is not correct. The moment of reckoning came when Eric asked Alexa: “If I was born in 1969, how old would I be now?” Alexa hedged on the birthday thing but confirmed the range. Bek stepped in. Alexa, a full 30-60 seconds later, stepped back in and confirmed: “Your birthday’s May 8th, you’re turning 57.” Eric is apparently going directly from 55 to 57, having skipped 56 entirely. He also noted at the Padres game with his wife that their Costco membership is older than a 13-year-old kid they saw on the Jumbotron, and that it could legally babysit him. John is turning 50 this year. Everyone is fine.
Links from the show:
externals.io — PHP Internals Discussion Reader
PHP RFC Watch — Track Active PHP RFCs
Ben Ramsey: PHP License Simplified
Laravel Shift — Automated Laravel Upgrade Tool
Laravel Cloud
How to Jump Anywhere Instantly in NeoVim (Flash.nvim Tutorial)
PHP Tek 2026 — Chicago
PHP Architect Store
PHP Architect Discord
Host:
Eric Van Johnson
X: @shocm
Mastodon: @[email protected]
Bluesky: @ericvanjohnson.bsky.social
PHPArch.me: @eric
John Congdon
X: @johncongdon
Mastodon: @[email protected]
Bluesky: @johncongdon.bsky.social
PHPArch.me: @john
Streams:
Youtube Channel
Twitch
Connect & Hire
PHP Architect Website
Twitter/X
Mastodon
Hire PHP Developers
Looking to hire PHP developers? Email [email protected] – Joe and the team are available for consulting, infrastructure work, Ansible playbooks, and code review.
Partner
This podcast is made a little better thanks to our partners
Displace

Infrastructure Management, Simplified
Automate Kubernetes deployments across any cloud provider or bare metal with a single command. Deploy, manage, and scale your infrastructure with ease.
https://displace.tech/

PHPScore
Put Your Technical Debt on Autopay with PHPScore

CodeRabbit

Cut code review time & bugs in half instantly with CodeRabbit.

Music Provided by Epidemic Sound
https://www.epidemicsound.com/
Join Us Live Next Week
Youtube Channel
Got feedback? Join us on Discord at discord.phparch.com
The post The PHP Podcast 2026.05.07 appeared first on PHP Architect.
1 hr 13 min
May 01The PHP Podcast 2026.04.30
 
 
PHP Podcast – April 30, 2026
Hosts: Eric Van Johnson & John Congdon
Another fun episode of the PHP Podcast! Here’s what we covered:
The Drone Slayer Strikes
Eric and John wrapped up a Padres game at beautiful Petco Park in downtown San Diego — and things got weird on the way out. A rogue drone started buzzing around a busy intersection, lingering on a guy on a scooter, before making a fateful attempt to fly in front of Eric’s car. It did not make it. The controller came running out, Eric kept driving, and John has already dubbed him “the drone slayer.” Eric still hasn’t looked at whether his wife’s car got scratched, which feels like the bravest choice of all.
Baseball Week Never Ends
The reason today’s episode started an hour early? Baseball. John’s week was wall-to-wall: a Tuesday night little league game, the Padres game with Eric on Wednesday, practice Thursday night, the playoff draft reveal Friday, a little league game Saturday, and another Padres game Sunday. Eric pointed out John was wearing his own last name on a jersey to a Padres game, which opened up a whole sidebar on why anyone buys a $200 jersey with a player’s name on it when players change teams every two years anyway.
Walking Pneumonia and the Power of the Right Antibiotic
John’s week was also scrambled because his son had been diagnosed with regular pneumonia — but after not getting better, a second doctor visit revealed it was actually atypical (walking) pneumonia, which requires a completely different antibiotic. Once on the correct medication, his son bounced back almost immediately. The kid had been pushing himself trying to feel well enough for sixth grade camp, but there’s really no faking it with the wrong treatment.
The Archie Situation — AI Standups Gone Sideways
Eric has had a rough stretch after Anthropic shut down OpenClaw, the platform that powered their internal Discord bot Archie (a.k.a. Alfred). Archie had been running daily team standups, generating weekly summaries, letting team members tag it with updates throughout the day, and even setting reminders. Everyone got spoiled by it. Since then, attempts to migrate to Ollama — both locally and through the web service — have been plagued by slow response times and dropped messages. Eric is close to pulling the plug and going back to the old manual method, and he’s not happy about it.
Claude SSH’d Into Eric’s Server and Fixed Everything
For weeks, Eric had been fighting a broken Postiz Docker container — a self-hosted social media scheduling tool he uses to post across platforms. After updates broke it and multiple attempts at a fresh install still left it broken, he dropped the problem in Claude’s lap and explained the whole situation. Claude asked for permission to SSH into the remote server on Eric’s Tailscale network, and Eric said sure. Thirty minutes later, Claude had identified the culprit — a Temporal workflow engine losing its configuration on restart — wrote a fix script, configured the service to reconfigure properly on boot, and even set up a cron job to restart the container on reboot. Eric’s still trying to find that chat to review exactly what it did, but the service is running.
GitHub is Getting Hammered by AI Agents
GitHub has had a rough patch of outages, and the numbers tell the story: 20 million new repos per month, 1.4 billion commits, 90 million pull requests — with a dramatic spike right at the start of 2026. Part of the culprit? AI agents being unleashed on codebases to automatically open pull requests from backlog tickets. Eric has a client doing exactly this, and while it sounds impressive from the owner’s perspective (“look at all this work getting done!”), the developers on the ground report that a high percentage of those AI-generated PRs require significant human correction before they’re anywhere close to mergeable. The comparison to Reddit’s early explosion — and the one engineer who basically didn’t sleep for two years — felt pretty apt.
The GitHub Security Vulnerability Nobody Talked About
As if the outages weren’t enough, GitHub quietly disclosed a serious security vulnerability: a specially crafted git push — using malformed options in the push metadata — could allow arbitrary code execution on GitHub’s own servers. Eric had to dig to find the blog post because GitHub was not exactly shouting about it. To their credit, they state that their investigation found no evidence the vulnerability was ever exploited in the wild. But knowing that a specific sequence of bytes in a git push could have handed someone the keys to GitHub’s servers is genuinely unsettling.
The Creator of Ghosty Is Leaving GitHub
Mitchell Hashimoto — creator of the Ghostty terminal and formerly of HashiCorp — announced he’s leaving GitHub, where he’s been a user since 2008 (user #1299). This comes shortly after the Zig programming language made the same move, also citing reliability concerns. Eric was mildly skeptical of the “announcing I’m leaving” genre of posts, pointing out that GitHub doesn’t especially need your permission to stop using it. Notably, Hashimoto’s post doesn’t say what he plans to use instead. John joined GitHub in 2009, which led to a fun live expedition through his commit history — turns out he got serious about coding right around July 2013, roughly when DiegoDev landed its first client.
Update Composer. Like, Right Now.
PHP developers tend to set Composer up and forget about it — but there’s been a serious security vulnerability patched in a recent release that you absolutely want. The fix is simple: just run composer self-update. It updates in place and keeps a rollback copy in case anything breaks. While you’re at it, if you have global Composer packages installed, run composer global update to catch those too. Eric noted that Composer should really warn you when you’re significantly behind versions, the way Claude Code does. Until it does, just make a habit of it.
Linux Kernel Exploit — Patch Your Servers
A CVE was shared in the phparch Discord that affects Ubuntu, Amazon Linux, and Red Hat: a Linux kernel exploit that lets an attacker gain root access with a remarkably small payload — around 732 bytes targeting setuid. It’s a good reminder that the old sysadmin badge of honor (“my server has 5-year uptime, never rebooted”) is the wrong mentality now. With tools like Terraform and infrastructure-as-code, spinning up a freshly patched machine is the move. Keep your operating systems current, especially Linux servers running in production.
Holly Built a PHP Tek App — And It’s Already Good
Community member Holly built a native attendee app for PHP Tek, available now in beta on iOS (via TestFlight) and Android. You can browse the schedule, select the talks you want to attend, and it’ll warn you if two of your picks are in conflict — a “merge conflict,” as Eric put it. Best of all, it sends push notifications when sessions you’ve favorited get moved or rescheduled, which happens constantly at tech conferences. Eric’s wife installed it without being told anything about it and figured it out on her own — about as good a usability test as you can get. The app is built natively in Swift and Kotlin. Be kind to Holly — this is a gift to the community.
PHP Tek in 19 Days + New PHP Architect Merch
PHP Tek is nearly here — 19 days out in Chicago. A brand new PHP Architect elephant is coming (tentatively named Holly, after a live-stream vote). Eric also walked through new merch at store.phparch.com: a v-neck version of the classic rainbow PHP Architect shirt, and his personal labor of love — the “I have standards, specifically PSR 0, 1” tee — which he admits has sold exactly zero copies. If the hotel room block is sold out by the time you read this, reach out to the team directly and they’ll see what they can do.
Links from the show:
Postiz — Open Source Social Media Scheduling
GitHub Security Advisory: Remote Code Execution via Git Push Options
PHP Tek 2026 — Chicago
PHP Architect Store
PHP Architect Discord
An update on GitHub availability
Migrating from GitHub to Codeberg
Ghostty Is Leaving GitHub
Securing the git push pipeline: Responding to a critical remote code execution vulnerability
Composer 2.9.6 fixes Perforce Driver Command Injection Vulnerabilities (CVE-2026-40261, CVE-2026-40176)
Copy Fail: 732 Bytes to Root on Every Major Linux Distribution.
Host:
Eric Van Johnson
X: @shocm
Mastodon: @[email protected]
Bluesky: @ericvanjohnson.bsky.social
PHPArch.me: @eric
John Congdon
X: @johncongdon
Mastodon: @[email protected]
Bluesky: @johncongdon.bsky.social
PHPArch.me: @john
Streams:
Youtube Channel
Twitch
Connect & Hire
PHP Architect Website
Twitter/X
Mastodon
Hire PHP Developers
Looking to hire PHP developers? Email [email protected] – Joe and the team are available for consulting, infrastructure work, Ansible playbooks, and code review.
Partner
This podcast is made a little better thanks to our partners
Displace

Infrastructure Management, Simplified
Automate Kubernetes deployments across any cloud provider or bare metal with a single command. Deploy, manage, and scale your infrastructure with ease.
https://displace.tech/

PHPScore
Put Your Technical Debt on Autopay with PHPScore

CodeRabbit

Cut code review time & bugs in half instantly with CodeRabbit.

Music Provided by Epidemic Sound
https://www.epidemicsound.com/
Join Us Live Next Week
Youtube Channel
Got feedback? Join us on Discord at discord.phparch.com
The post The PHP Podcast 2026.04.30 appeared first on PHP Architect.
1 hr 13 min
April 30PHP Alive And Kicking: Episode 29 Elizabeth Barron

Elizabeth Barron returns to the show just four weeks after her debut appearance for a wide-ranging follow-up on her first months as Executive Director of the PHP Foundation. Elizabeth shares the key findings from her community listening tour, covers the upcoming PHP community survey in partnership with JetBrains, talks about the Foundation’s plans for transparency, documentation, and guest blogging, and discusses the challenges of the PHP newcomer experience. The episode also features a candid conversation about public speaking anxiety, conference culture, and the enduring warmth of the PHP community.
Topics Covered
PHP Foundation Community Findings Main Topic
Elizabeth published a blog post summarising the findings from her listening tour across the PHP community. Four key themes emerged:
Foundation transparency — Many people don’t know what the Foundation is doing; the website is too generic and needs to better reflect the team’s actual work.
Marketing of PHP — How PHP is perceived externally, and how the community can better promote the language.
Community support — What the Foundation can do to better support developers, user groups, and sub-communities.
The language itself — Feedback and ideas relating to PHP’s ongoing development.
Elizabeth noted that the volume of feedback was a good sign — silence would be a much bigger problem. A Part Two of the blog post is in the works and will cover strategy and next steps.
Newcomer Experience & Documentation Gap
A recurring theme from the community feedback was how hard it is for brand-new developers to get started with PHP:
There is no single central “landing page” for newcomers — help is scattered across Discord, Reddit, local user groups, and elsewhere.
The PHP manual assumes a baseline of programming knowledge that true beginners don’t yet have.
Many existing beginner resources have not been updated as the language has evolved.
PHP lacks the kind of gamified, beginner-friendly learning apps that Python and JavaScript enjoy.
Mike noted that most coding bootcamps are JavaScript-first, leaving a gap for PHP-based introductory learning.
Elizabeth is exploring whether the Foundation can help coordinate and amplify existing resources rather than compete with them — and fill in the gaps that remain.
Matt Stafer’s recent involvement with the Foundation was highlighted as a potential access point for reaching newcomers, given his large following.
PHP Community Survey (with JetBrains)
The PHP Foundation is running a community survey in partnership with JetBrains (makers of PHPStorm).
The goal is to generate open, usable data that anyone — including the Foundation, JetBrains, and the broader community — can analyse.
Community members were invited to suggest their own questions (the submission window closed on the day of recording).
The full survey was expected to launch in early June.
Foundation Transparency & Hiring Update
The Foundation’s developer hiring process (which had been open in a previous cycle) was paused while Elizabeth settled into the role and internal processes were stabilised.
Many of the Foundation’s developers currently work in silos; improving collaboration and communication across the team is a near-term priority.
The Foundation’s blog will be opened up to guest bloggers — Elizabeth teased an upcoming post she’s excited about but couldn’t yet name.
Developer applications are expected to reopen in autumn 2025.
Public Speaking Anxiety & Conference Culture
An unexpectedly personal and engaging segment where all three speakers opened up about their experiences with social anxiety and public speaking:
Mike shared that despite running the show and talking to guests regularly, he struggled to approach familiar faces at PHP conferences in person.
The group discussed strategies: preparing thoroughly (Elizabeth and Shane), improvising with bullet points (Chris), and the benefit of pairing up to speak (Mike and Chris’s planed joint talk).
Elizabeth reminded Mike that audiences are always rooting for the speaker — and encouraged him to keep pushing through the discomfort.
Chris mentioned Merge PHP (online conference, 14th May) as a useful middle step between podcasting and live in-person talks.
PHP Appalachia — A Community Origin Story
Elizabeth shared the story of PHP Appalachia, one of the earliest informal PHP community gatherings, held in the Gatlinburg, Tennessee area starting around 2006. Around 12 people from the PHP IRC channel (phpC) rented a cabin with Wi-Fi, gave talks, and sat around a campfire — and Elizabeth is still friends with every single person who attended.
Links & Resources
PHP Foundation
The Executive Director’s Manifesto — Chris’s article on PHP Architect, based on Elizabeth’s previous episode (free to read)
Merge PHP — Online PHP conference, 14th May (Andy Snell: “More than just a cache, data-structured databases”)
PHP Tech Conference — Coming up in a few weeks, running alongside JS Tech for the first time
PHP Architect Magazine — Use code ALIVE3 for the first 3 months of a digital annual subscription free
PHP Architect Store — T-shirts, caps, mugs and more
PHP Architect Discord — Join the community, ask questions, and chat with PHP core contributors
PHP Architect Social Media
X: https://x.com/phparch
Mastodon: https://phparch.social/@phparch
Bluesky: https://bsky.app/profile/phparch.com
PHPArch.me: https://phparch.me/@phparch
Discord: https://discord.phparch.com
Partner
This podcast is made a little better thanks to our partner.
Displace
Infrastructure Management, Simplified. Automate Kubernetes deployments across any cloud provider or bare metal with a single command. Deploy, manage, and scale your infrastructure with ease — without the steep learning curve of Docker, Kubernetes, and Terraform. Perfect for solo developers and small teams who want enterprise-grade infrastructure without the enterprise-grade complexity.
https://displace.tech/
Music Provided by Epidemic Sound
The post PHP Alive And Kicking: Episode 29 Elizabeth Barron appeared first on PHP Architect.
1 hr 17 min
April 29Community Corner: Storyblok with Daniel Mendoza

In this episode, Scott talks Storyblok with Daniel Mendoza and his talk on using AI to help developers learn new technology that he will be presenting at JStek 2026.
Links:
Our Discord – https://discord.gg/aMTxunVx
Buy our shirts – https://store.phparch.com/products/community-corner-podcast-t-shirt
Daniel’s Links:
LinkedIn – https://www.linkedin.com/in/daniel-mendoza-503396152/
Personal Site – https://danieljmendoza.com/
Scott’s Links:
Website – https://scott.keck-warren.com/
Bluesky – https://bsky.app/profile/scottkeckwarren.bsky.social
LinkedIn – https://www.linkedin.com/in/scott-keck-warren-91689810/
Mastodon – https://phpc.social/@scottkeckwarren
PHP Architect Social Media:
X: https://x.com/phparch
Mastodon: https://phparch.social/@phparch
Bluesky: https://bsky.app/profile/phparch.com
Discord: https://discord.phparch.com
Subscribe to our magazine: https://www.phparch.com/subscribe/
Partners
This podcast is made a little better thanks to our partners.
Displace
Infrastructure Management, Simplified
Automate Kubernetes deployments across any cloud provider or bare metal with a single command. Deploy, manage, and scale your infrastructure with ease.
https://displace.tech/
PHPScore
Put Your Technical Debt on Autopay with PHPScore
https://phpscore.com/
CodeRabit
CodeRabbit – Cut code review time & bugs in half instantly with CodeRabbit.
https://www.coderabbit.ai/
Music Provided by Epidemic Sound https://www.epidemicsound.com/
#phpc #php #communityCornerPodcast #podcast #phptek #jstek
The post Community Corner: Storyblok with Daniel Mendoza appeared first on PHP Architect.
22 min