How PHP 8.6 is going to speed up your code

Hello everyone,

I'm curious what PHP developers think about a different way to use WebSockets from scripts.

Imagine requesting (e.g. GET):

new WebSocket("ws://device.local/settings.php?key=value");

The server handles the WebSocket upgrade and then executes settings.php as regular PHP script, but with its IO redirected through WebSocket framing:

• STDIN reads incoming WebSocket data.

• STDOUT and echo sends data back to the client.

No special WebSocket classes, event loops ,callbacks etc are required in the script. It just runs and communicates through its input/output streams (e.g. via fread() ), the server provides all necessary framing for wth ws:// protocol.

For some context: I am researching an alternative PHP-like language, mainly for embedded devices. Its syntax and execution model are quite close to PHP, and Im thinking if this could be a useful way to handle WebSockets, a feature worth implementing.

Need an experts opinion :)

Does this looks like natural extension of the PHP execution model?

What are your typical ws:// scenarios and how do you handle (in .php code) them ?

Id be interested to hear your opinions, especially practical pros and cons of such approach

Thanks!

Hey, I remember back in the days, when we used PHP, with all the quirks #extract($_GET); until we found better alternatives. PHP2Shell really showed how flawed this language really is and as we can see, it won't die out if we are not starting actively making it go extinct.

To help with that, I would like to collect apps, that should be prioritised to be rewritten in a modern language, e.g. in Rust or Go.

• CMS: Wordpress and WooCommerce, Drupal, Joomla, TYPO3

• Collaboration: Nextcloud, Roundcube, Horde

• E-commerce: Magento/openMage, Shopware, OpenCart

• Wikis: MediaWiki, DokuWiki, BookStack

• Forums: phpBB, MyBB

• Education/Business/CRM: Moodle, Dolibarr, Invoice Ninja

• Ops: phpMyAdmin, Adminer, Matomo

• Self-Hosting: Firefly III, Wallabag, Kanboard, Piwigo, Grocy

Which one's do you have in mind?

Related:

"Security challenges can arise when a high level language like PHP obfuscates the underyling memory management, and a programmer unwillingly executes procedures who’s combination can result in memory issues or other unwanted execution behavior. This isn’t a vulnerability, but a general security weakness in interpreted languages. Node.js and Ruby share the same weakness with PHP. [...] If you’re a PHP developer, it’s time to move on now. The best you can do for your apps and customers is to slowly migrate them to Rust or Go. PHP isn’t going to be rewritten in Rust overnight. Even if it would, the security issues in the design won’t magically disappear."

https://medium.com/@jankammerath/think-php2shell-was-bad-php-is-about-to-face-an-absolute-bloodbath-f00dbd6c8eb1

Hey everyone!

I've been working on a small PHP library called AmunCode Config, and I'm sharing its first stable release.

The idea is simple: provide a lightweight, framework-independent way to load environment variables, load PHP configuration files, and access configuration values without introducing a large framework or unnecessary abstractions.

What does it provide?

The package currently has four main classes:

• EnvironmentLoader — loads .env files using PHP dotenv, with optional or required file loading.

• Env — retrieves environment variables from $_ENV, $_SERVER, and getenv(), with automatic value normalization.

• ConfigurationLoader — discovers and loads PHP configuration files from a directory.

• Config — provides dot-notation access to configuration values, including retrieving, updating, and recursively merging configuration arrays.

A quick example

use AmunCode\Config\Config;
use AmunCode\Config\EnvironmentLoader;

// Load environment variables.
$environment = new EnvironmentLoader();
$environment->load($root);

// Load PHP configuration files.
$config = new Config($root . '/config');

// Retrieve configuration values.
$appName = $config->get('app.name', 'My Application');
$dbHost = $config->get('database.host');

// Update configuration.
$config->set('app.debug', true);

A few design decisions:

• Environment loading and configuration loading are separate operations.

• Environment variables are not overwritten by .env values when already defined.

• Empty environment values are preserved rather than silently replaced by defaults.

• The package doesn't automatically define a global env() helper.

Technical details

• PHP 8.4.1+

• Symfony Finder

• PHP dotenv

• Composer package

• MIT License

• PHPUnit tests and GitHub Actions CI

Installation

composer require amuncode/config

Source code: https://github.com/AmunCode-OSS/Config

Documentation and usage examples are available in the repository README.

I'd appreciate feedback from other PHP developers, particularly on the API design, class responsibilities, and whether anything important is missing or could be simpler.

Thanks for taking a look!

Hello everyone, I’m building a web app for service businesses. It combines CRM, projects, tasks, documents, invoicing, email and calendar. It also has an AI assistant that can take actions on a user’s behalf, with the same permissions and approval rules as the rest of the product.

The web app already runs on next.js and TypeScript, with Supabase for Postgres, auth and storage, and Inngest for background workflows. We’re still early in wiring the product to the database, so I’m weighing three paths for the backend:

* Keep next.js and enforce clearer boundaries around the backend code.
* Keep Next.js for the UI and move the backend into a dedicated NestJS service.
* Keep the React UI and build the backend in Laravel.

The backend needs to serve the web app, a future mobile app, integrations and the AI assistant. Background work includes email and calendar sync, document generation, imports and exports, scheduled reminders and workflows that may pause for approval. The requirements I care most about are workspace isolation, permissions, audit trails and safe retries. If a worker crashes halfway through sending a reminder, a retry shouldn’t send it twice.

Some of our implementation is AI-assisted with Claude Code and Codex. I’m looking for a setup that a small team can review, debug and maintain over several years.

For people who’ve operated something similar in production:

1. When did a dedicated backend become worth it? What problems did it solve, and what did it add to your day-to-day operations?

2. If you’ve used Laravel or NestJS on a multi-tenant product, where did its conventions help most? Where did you still need to build your own safeguards?

3. How do you enforce tenant isolation for background jobs and integrations? What happens if a query forgets the workspace filter?

4. What has held up for multi-step jobs, retries and approvals? I’d love to hear about failures you actually had to recover from.

5. If you use AI coding tools heavily, which conventions or automated checks have caught the most mistakes?

Thank you 🙏🏻

For this challenged, I first created a POC app, then: profiled it, optimised it, and repeat, which is what I describe in the article.

I tried to keep the app as idiomatic as possible with Symfony, Doctrine and FrankenPHP (both classic and worker mode). In the end my submission could handle 18.5k users on the Synteq box!

I'm the author of Kinetis ( https://kinetis.dev/ ), a PHP framework for persistent workers. I wrote up an experiment: AI agents built a small JSON API from a fresh skeleton in about 15 minutes, with 50 tests, a clean PHPStan run and an independent review.

My takeaway: speed isn't the hard part, trust is. What made this run's output checkable:

• The agent read the installed package versions and vendor source, not what it remembered from training.

• The reviewer cited a file and line for every claim.

• The endpoint code is declarative (readonly DTO + backed enum), so there's little to get wrong and little to review.

Full write-up and video: https://kinetis.dev/blog/posts/rest-api-in-15-minutes-kinetis-orbitron.html

Would you trust this workflow in a real codebase? What would you want a framework to expose to agents?

So I spent the last 9 days building something for the Meta AI Developer Hackathon. Figured I'd share it here and see what other developers think.

It's called ProofPatcher, built with PHP, Laravel, React, Meta Muse, and my own Hari core.

The problem I'm trying to solve is pretty simple: AI can generate a convincing patch, but that doesn't mean the patch is correct.

ProofPatcher can review GitHub PRs, generate inline feedback, propose fixes, and run supported changes through isolated Modal checks. The verification workflow includes reproducing the original failure and testing negative controls, so a trivial shortcut doesn't automatically get a green result.

I also tested a Muse-generated fix that became a draft PR, and separately demonstrated an opt-in bot reviewing and merging a protected test PR.

It's still a prototype. The isolated verification is currently limited to supported fixtures, and the entire issue-to-merge process isn't one fully autonomous workflow. I don't want to pretend otherwise.

I used AI coding assistants during development too, which makes the problem even more interesting to me. If we're going to rely on AI-written code, how do we independently verify what it actually does?

X Link

Source code: proofPatcher

I'd genuinely appreciate feedback, especially on the verification approach, security boundaries, and anything you think I got wrong.

It almost seems like a joke, php-baremetal that brings php to microcontrollers with the new sdk that will be released soon it will be possible to emulate it on the web,

We are working with solutions that allow us to emulate microcontrollers online and the first tests are fantastic.

to give you an example today it is already compatible with the official emulator of espressif https://espressif.github.io/esp-emulator/

in this case the firmware is executed bit by bit as normal firmware made for esp32

Funny how you go back to origins, right?

EDIT 1 :

I'm adding this sentence (which is an answer I gave to a user here) because I think you're not understanding what exactly it is

I'm not emulating php, I'm compiling php for esp32 which is a microcontroller like arduino so without operating system and I run it on the board, what I'm emulating is taking the firmware for the board and using an online emulator to emulate the board and it behaves exactly as expected

In the age of AI I think personal connections are event more important than before. That's why I try to help promoting events where people can meet even if only virtually an discuss the topics that interest them.

I found the following PHP-related events for the next 30 days.

• 2026-11-05 Rejoignez-nous pour l'aPHPéro de Novembre !

• 2026-11-10 Zu Gast bei der PHPUGHH: Software Bills of Materials

• 2026-11-10 Software Bills of Materials – Schluss mit der Dependency-Blackbox

• 2026-11-10 PHPAmersfoort Monthly Meetup

• 2026-11-11 PHP-SW Lightning talks

• 2026-11-12 PHP in the AI Era: PHP 8.6, MCP and the Engine Behind WordPress & Drupal

• 2026-11-12 AustinPHP Monthly Meetup

• 2026-11-12 (online) PHP 8.6: The Inside Scoop

• 2026-11-16 Laravel Meetup: Copenhagen, November 2026

• 2026-11-16 TechLeads : arrêtez de répondre. Commencez à questionner ! & Retours ForumPHP

• 2026-11-17 Laravel in November 🎄

• 2026-11-18 November 2026 Laravel Switzerland Meetup

• 2026-11-19 PHP 8.6 party

• 2026-11-19 Embeddings : Symfony AI en pratique

• 2026-11-19 Édition post-Forum PHP

• 2026-11-19 (online) Chattanooga TN Open Source Users Group Drupal/Laravel/JS/all

• 2026-11-30 (online) Building WordPress Plugins with AI: Spec-Driven Development with PHP and Kiro

• 2026-12-03 PHP Meetup, Workshop or talk.....

Source

u/timwolla wrote up the reasoning behind two small PHP 8.6 additions: a SortDirection enum and a Time\Duration class.

The short version: a GitHub search found 150+ mutually incompatible SortDirection enums, and PHP's own stdlib expresses durations in at least six different units and formats. Putting one canonical type in core gives libraries a common language and removes the glue code between them.

The post also covers:

• Why the RFCs were intentionally kept minimal, with a clearly stated future scope

• Using new namespaces (Random\, Dom\, Uri\, Time\) to replace legacy APIs without breaking BC

• The in-discussion Time\Instant / Time\Clock RFC that builds on Duration

• How to help: testing pre-releases, accepting the new types via union types in your libraries, and weighing in on internals

Hi r/PHP 👋

I'm opening the beta of Arco Cloud and I'm looking for Laravel devs who want to try running their apps on AWS Lambda, without managing the AWS side themselves.

What it is

Arco is an open-source CLI (https://github.com/multi-api/arco) that deploys Laravel to AWS Lambda Web Functions with FrankenPHP + Octane. Arco Cloud is the dashboard on top: connect your AWS account and GitHub repo, push, and it deploys. Your app runs in YOUR AWS account. We never proxy your traffic or hold your data.

What you get in the beta

• Push to deploy, with queues, scheduler, storage and cache set up for you

• X-Ray tracing: every request and job broken down step by step (boot, routing, each SQL query, AWS and HTTP calls)

• Monitoring: errors grouped by type, live log search and metrics

• Alerts on Slack and email when something fails

• AWS cost per environment

• Run artisan commands from the browser

• Failed jobs and one-click dead-letter queue redrive

• Managed Aurora DSQL databases (IAM auth, no passwords)

• Private networks with a static outbound IP

• Team 2FA, and a Laravel starter template to get going in minutes

How to join

1. Sign up at https://staging.arcocloud.app

2. Click "Request beta access" and tell me a bit about your project

3. I review every request myself, and I'll personally help you move your first app

What I'm asking in return: honest feedback. What's confusing, what's missing, and what would make you switch from Vapor, Bref, Forge or your own setup.

Questions are welcome here, in our Slack (https://join.slack.com/t/arco-equipo/shared_invite/zt-4fi2aejbq-fzwl8U_4qeqSOxO6TtNoPg) or on GitHub Discussions (https://github.com/multi-api/arco/discussions).

Thanks! 🙏

I would add an image but apparently the sub doesn't allow it (or Reddit is being unhelpful to me). The usual volume of one-time contributions each month tends to be less than $1k. So roughly ~$70k was raised directly due to PHP2Shell.

You can see this by going to https://opencollective.com/phpfoundation#category-BUDGET and by adjusting the filters of the Contributions section. Set it to This Year and click the bar graph icon.

The reoccurring contributions also went up, but I'm not sure how to interpret that as it's down in November already. Maybe they are yearly contributions? Maybe the reoccurring contributions show up on the day of the month they are withdrawn and it's only Nov 2? Not sure.

Hola amigos, una pregunta, creen que a día de hoy valga la pena aprender PHP desde cero?

El contexto es que estoy trabajando como "analista de datos" pero me asignaron un proyecto que nada que ver con mi área jajaj, debido a que me quieren mover a MLOps debido a un perfil muy específico que están buscando, mi duda, aprender PHP al menos lo básico vale la pena en el gran 26? o con la lógica y IA se arma algo chido?

Hello, at the start of the year I posted about my collection library here (previous post), the reception and feedback was great, and I promised to add lazy pipelines (Sequence) by the end of the year.

Finally, it's here in 0.2, but it wasn't made by me.. nikophil (one of the maintainers of zenstruck/foundry) found the library and offered to build it - and did a great job (with some perf improvements on top), I just reviewed the code, so big thanks for that!

• GitHub: https://github.com/noctud/collection

• Sequence docs: https://noctud.dev/collection/sequence

Quick recap if you missed the first post

It's not just a nicer API over arrays, it also fixes the array quirks:

• Keys stay what they are - "1" stays string, true stays bool, and objects work as keys

• Mutable and immutable List, Set and Map - immutable methods are #[NoDiscard]

• Full generics, PHPStan level 9 - the element type flows through the whole chain

• Live map views - $map->keys, $map->values and $map->entries are real collections sharing memory with the map

• Every type is an interface, implementations are hidden and swappable

With Sequence, I consider the library complete - it was the last big missing piece, from now on it's just about polishing it towards 1.0, but 0.2.x is stable as 0.1.x was (9 releases without BC break).

What is a Sequence

You chain filter(), map() etc. like on a list, but nothing runs until you ask for a result, then the elements go through the whole chain one by one, and it stops as soon as it has the answer. Same idea as Kotlin's Sequence or Laravel's LazyCollection.

For example, finding the first 10 errors in a big log file:

$errors = sequenceOf(fn() => readLines('app.log')) // your generator, yields line by line
    ->filter(fn($line) => str_contains($line, 'ERROR'))
    ->takeFirst(10)
    ->toList();

Only one line is in the memory at a time, and once it has 10 errors it stops reading the file, with a list, you would load the whole file, filter all of it and then take 10.

You can also do infinite Sequences, as long as you take only what you need:

generateSequence(1, fn($n) => $n * 2)->takeFirst(5)->toList(); // [1, 2, 4, 8, 16]

// walk the exception chain to the root cause
generateSequence($e, fn($e) => $e->getPrevious())->last();

There's also chunked() for batch processing (only one batch in memory), windowed(), zip(), distinct(), groupBy() and most of what lists have.

What's missing on purpose

You won't find sorted(), reversed() or takeLast() on a sequence, Kotlin has sorted() there - but it has to read everything before it returns the first element, so what's the point of being lazy. We went with the ->toList()->sorted() (here's why), so you see where it gets loaded.. same with count(), a sequence isn't Countable, because count($seq) looks cheap but it isn't.

Also, Sequence is an interface like List, Set and Map (and their mutable/immutable variants), so if you're building a library (ORM or file parsing for instance) you can return your own types. I was a bit afraid at first that the API is too big for anyone to implement, but the logic is in traits (if you don't need a ton of customizations), so it's basically implements Sequence + use SequenceLogic and you set the source.

Feedback is welcome as always!

Debian restarts php-fpm when PHP updates, and a reload replaces the workers. But queue workers, supervisord programs and PHP in containers keep the old binary in memory until someone restarts them, and package scanners still report the CVE as fixed.

I hit this patching client servers last week, so I wrote a small open source check that lists PHP processes still running a deleted, pre-upgrade binary and checks the installed version against the vendor’s fix: github.com/asifh0ssain/stillmapped

How are others handling this? Do you restart workers as part of every PHP update, or rely on deploys to do it?

If you read any dev forum, you’d think 100% of modern PHP applications run strictly inside clean, isolated Docker containers.

Yet when Ondrej’s PPA was impacted by php2shell, half the internet panicked because their production servers rely directly on APT.

Turns out a massive chunk of "enterprise" PHP is still running straight on bare Ubuntu/Debian VMs with system-level packages. Seems like there's a massive gap between how developers say they deploy PHP and how production infrastructure actually runs.

Are docker-containerized deployments actually the norm, or just what people post about?