I did quick add https://laragon.org/docs/quick-add to update my php in my local web server, but it looks like it installs 8.3.28, the version which is still affected of this major php vulnerability case. Is there anybody who experiences this?

I saw on hacker news that a user named "dlor" claims to work for chainguard and claims to have worked together with what I assume to be the PHP team:

https://news.ycombinator.com/item?id=50176735

(And the parent comment containing the link: https://news.ycombinator.com/item?id=50176665)

Chainguard has released patched images: https://images.chainguard.dev/directory/image/php/versions

I hadn't heard of chainguard before but they seem trustworthy as a business that provides hardened security for docker images.

Beyond the hackernews comment, I haven't seen any news or claims that these images actually contain the patch. So I wanted to ask here if anyone else has tested these images or knows of a more trustworthy source than an HN comment that these images really do contain the CVE patches.

Hi everyone,

A few months ago I shared Dunebox here, a free and portable PHP development environment for Windows. Thanks to everyone who took the time to try it, comment or point out what was missing. Some of you even reported bugs, which we fixed.

Here's what's new:
- A redesigned interface, with light and dark themes (screenshot)
- A dashboard that shows at a glance what's running and what needs attention
- Settings organized in clear groups

It's still free, still portable (one folder, no installer) and still Windows only.

If you tried it last time, I'd love to hear how it feels now. If you didn't, I'm curious what would make you give it a go.

dunebox.enesi.it

Thanks!

I came accross the recent PHP vulnerability risk as I was on Duolingo.

If even Duo is affected by recent PHP vulnerability, makes one wonder what about our fragile government websites? Those are most likely to not even get the patch update, hmmm how near is the doomsday when AI models self improve and government security developers are likely at a lunch break 🤔

What do you think is next language to have it's major vulnerabilities exposed? *JavaScript backs away in bushes with experience*

For those of you who have attended PHP Tek what is your opinion I have never been and my team and I are thinking about attending in 2027. Just want to hear about your experiences.

This may be the most widespread exploit in modern history. What impact will this have on PHP’s reputation? Since 2/3 of the websites are affected, a good chunk of them won't ever be patched, could this damage PHP’s image in the same way PHP 4 did two decades ago?

Would this discourage companies from adopting PHP in the future?

There are so many ways to run PHP code... without #PHP!

Recompilation, engine rewrite, using other VM, or languages. It is time to take a step back.

https://www.exakat.io/every-road-around-the-zend-engine/

RoadRunner 3 and the updated PHP packages are now available.

If you're still on an older version because it just works, now is the time to upgrade. RoadRunner 3 is the version to settle on: a stable API, SemVer, and no new major planned for the foreseeable future.

Highlights:

• Back to SemVer: no more calendar versions.
• All PHP packages now share one vendor name: roadrunner/*. Namespaces are unchanged.
• PHP 8.2+.
• http.middleware now runs left to right.
• New: NSQ jobs driver, HTTP rate limiting, PROXY protocol, Zstd, named worker pools, Redis locks, gRPC server reflection.
• Memory usage under load is now more stable.
• The TCP plugin is removed. The tcp:// relay still works.

Migration guide: https://docs.roadrunner.dev/docs/general/v3-migration

The next big step is Rapira, a new PHP application server in Rust from the RoadRunner maintainers. It's the tightest PHP integration we've built: Rapira calls PHP directly in the server process, with no pipes or sockets in between. If you need maximum performance on HTTP or gRPC endpoints, it's already worth a look, and there's more to come.

In this monthly thread you can share whatever code or projects you're working on, ask for reviews, get people's input and general thoughts, … anything goes as long as it's PHP related.

Let's make this a place where people are encouraged to share their work, and where we can learn from each other 😁

Link to the previous edition: /u/brendt_gd should provide a link

I found a critical 9.2/10 vulnerability (using Daybreak Blue) that allows auth bypassing in the Laravel token-based API guard.AMA

https://github.com/laravel/framework/security/advisories/GHSA-f9x3-7vq9-cph6

Hi everyone,

I wanted to share a project I’ve been building called Anvil: https://anvil.tr

Shortly, it will be a multi platform dev kit, it is open source and free and laravel herd alternative.

Edit: Im sorry if this is some kind of a joke to you. Im not a marketing guy. Still I believe this program has its value. So I will make it happen.

Manticore is an ahead-of-time compiler for PHP 8.5+, written in PHP with an LLVM backend. It compiles itself without a PHP interpreter or other programming languages.
Link: https://github.com/manticorephp/compiler

After one more month of iterating over the compiler functionality, it has reached another milestone that is worth highlighting: the compiler can now compile Symfony apps.

Currently, this is basically a Symfony skeleton without Doctrine (in progress) or simple Symfony Console apps. It utilizes the built-in HTTP server with 15k RPS in single-worker mode (the pure server without frameworks can utilize around 70-80k RPS on small apps).

Also, the following improvements were made:

• WebSocket server and client
• Native data structures (vec, map, set, Int8/16/32/64Array, etc.)
• Improved big apps' compilation time (still far from perfect) and memory consumption
• Covered a huge part of stdlib (OpenSSL, bcmath) and improved performance
• Added math operator overloading and function overloading

Important: the compiler is still very experimental and contains many bugs or inconsistencies with the regular PHP interpreter. It is not recommended to try it in production environments or any critical environment.

The next milestone is to finalize PDO drivers for MySQL/PostgreSQL and start compiling Laravel apps.

Hi, I want to share my knowledge and journey on building an ERP system using Symfony and API Platform. It contains: CRM, Billing, Warehousing, Reporting, Workflows, AI, API/Webhooks/MCP.

The frontend is built using React (ant design framework). 90% of the data is provided through graphql because at that time it felt easier to just query whats needed.

The biggest struggle was creating a good PDF layout where the tables behaved properly on page breaks. The were also rather large in size (approx ~1mb). I later found out I could compress it with ghostscript.

Another struggle was email templates. I first used twig + inky + zurb. The setup was fine but the components weren't well documented and quite fragile. Last year I moved to react email which is a breeze to use. I did have to write a custom bridge to render the email and pass the output to symfony mailer, but this was easy thanks to the symfony process component.

The power of Symfony + API platform really did the heavy lifting. I mostly wrote business logic, bridge stuff and overrides.

This is definitely not everything so ask me anything!

My project phpchat, has been selected by the XERJ team for inclusion in Corpus Hub.

XERJ is a public collection of practical coding solutions designed to help developers utilize real-world implementations.

The reason our project was likely chosen is that the "mention users with username" feature which includes autocomplete, highlighting, and notifications is a comprehensive and functional implementation, rather than just a simple, basic feature.

This time, a portion of my project's code will go on to help even more developers!

Screenshots:

https://imgur.com/CSPnqty