36
Channel to sync with /r/PHP /r/Laravel /r/Symfony. Powered by awesome @r_channels and @reddit2telegram
The PHP Foundation raised ~$71k in one-time donations in October
I would add an image but apparently the sub doesn't allow it (or Reddit is being unhelpful to me). The usual volume of one-time contributions each month tends to be less than $1k. So roughly \~$70k was raised directly due to PHP2Shell.
You can see this by going to https://opencollective.com/phpfoundation#category-BUDGET and by adjusting the filters of the Contributions section. Set it to This Year and click the bar graph icon.
The reoccurring contributions also went up, but I'm not sure how to interpret that as it's down in November already. Maybe they are yearly contributions? Maybe the reoccurring contributions show up on the day of the month they are withdrawn and it's only Nov 2? Not sure.
https://redd.it/1xmc1iq
@r_php
DodoCD – Self-hosted CI/CD for PHP sites on shared hosting
I built an open-source CI/CD tool specifically for PHP shared hosting – DodoCD
I've always found it interesting that most modern CI/CD solutions assume you're deploying to VPSs, containers or cloud infrastructure.
But plenty of PHP applications are still hosted on traditional shared hosting.
I wanted to build something that brings a more modern deployment workflow to those environments.
So I built DodoCD.
It works by receiving ZIP packages from your CI pipeline (for example, GitHub Actions) and deploying them directly to your website.
It also includes a dashboard for:
* Viewing deployment history and logs
* Managing releases and rollbacks
* Managing multiple websites
* Managing deployment tokens
* Running SQL migrations
It's self-hosted and targets Apache/LiteSpeed hosting with PHP 8.1+.
Would love to hear feedback, especially from people who work with shared hosting.
GitHub: [https://github.com/YohanSandun/dodocd](https://github.com/YohanSandun/dodocd)
Disclaimer: I'm the creator of this project.
https://redd.it/1xlne4v
@r_php
r4ck: the server search engine built for agents
https://r4ck.dev
https://redd.it/1xlsplc
@r_php
SymfonyCon Warsaw 2026: Works on my machine. The agent said so.
https://symfony.com/blog/symfonycon-warsaw-2026-works-on-my-machine-the-agent-said-so?utm_source=Symfony%20Blog%20Feed&utm_medium=feed
https://redd.it/1xlz966
@r_php
New SymfonyCasts Course: Symfony Security - Going Further
https://symfony.com/blog/new-symfonycasts-course-symfony-security-going-further?utm_source=Symfony%20Blog%20Feed&utm_medium=feed
https://redd.it/1xlu2tn
@r_php
New in Symfony 8.2: Validated and Compiled Expressions
https://symfony.com/blog/new-in-symfony-8-2-validated-and-compiled-expressions?utm_source=Symfony%20Blog%20Feed&utm_medium=feed
https://redd.it/1xlu2tk
@r_php
Weekly help thread
Hey there!
This subreddit isn't meant for help threads, though there's one exception to the rule: in this thread you can ask anything you want PHP related, someone will probably be able to help you out!
https://redd.it/1xlqf9p
@r_php
FilaRank 3.1: the Filament SEO plugin's audit now runs on the queue instead of in your panel request
Small release for my Filament SEO plugin. The headline change is one I should have made earlier: the technical audit crawled up to 500 pages synchronously inside a Livewire action. 3.1 moves it to queued jobs, and a filarank:audit command with an optional nightly schedule. 'queue' => false restores inline behaviour if you don't run a worker.
Also in this release:
Models implementing `HasHreflang` get their maps audited.
Organization/WebSite JSON-LD nodes get stable u/ids; Article publisher references the Organization instead of duplicating it
Invalid custom JSON-LD is now a form validation error instead of being silently dropped at render time
SEO Overview uses aggregate queries instead of loading every scored row into memory
No migrations, no new dependencies
demo at filarank.com if you want to click around. Happy to answer questions about the package :)
https://redd.it/1xlg5mm
@r_php
Found a native OpenLiteSpeed port for Windows, and it's surprisingly fast
https://github.com/NeuralFoundry/openlitespeed-windows
https://redd.it/1xld1t6
@r_php
Weekly /r/Laravel Help Thread
Ask your Laravel help questions here. To improve your chances of getting an answer from the community, here are some tips:
What steps have you taken so far?
What have you tried from the documentation?
Did you provide any error messages you are getting?
Are you able to provide instructions to replicate the issue?
Did you provide a code example?
Please don't post a screenshot of your code. Use the code block in the Reddit text editor and ensure it's formatted correctly.
For more immediate support, you can ask in the official Laravel Discord.
Thanks and welcome to the r/Laravel community!
https://redd.it/1xl9rw2
@r_php
The php2shell drama showed us where our priorities really are.
Nothing highlights PHP's core demographic quite like Ondrej getting a full year of funding in a week for legacy builds while the PHP Foundation barely gets a nod. We'll pay anything to keep PHP 5.6 on life support, but won't throw a dime at the heroes building the core language. Priorities, I guess!
https://redd.it/1xl60dx
@r_php
SymfonyCon Vienna 2024
https://redd.it/1xl1w9d
@r_php
A Week of Symfony #1035 (October 26 – November 1, 2026)
https://symfony.com/blog/a-week-of-symfony-1035-october-26-november-1-2026?utm_source=Symfony%20Blog%20Feed&utm_medium=feed
https://redd.it/1xl053s
@r_php
Released Commentify 4.4
Commentify 4.4 is out, with over 18k installs, MIT, Laravel Livewire comments for any Eloquent model. Tailwind or Bootstrap, nested replies, markdown, likes, reports, guests, optional Filament admin. PHP 8.3+, Laravel 12 or 13, Livewire 4.
What changed:
* Filament: a modal used to reuse the first record's comments component. The Livewire thread is now keyed to the record and the thread name, so the modal shows the record you opened and two threads on one model do not collide. CommentsEntry::make() drops that thread on an edit or relation manager form.
* Notifications: with the flag on, a reply notifies the parent author. A top-level comment notifies the commentable's user when that relation exists. The notification is queued and waits until the transaction commits. The mail button is included only when the comment URL is on your app.url host, so a request referer cannot send the recipient off your app.
* Minimum PHP is now 8.3.
Install guide:
[https://docs.commentify.pro/installation](https://docs.commentify.pro/installation)
https://redd.it/1xkrlor
@r_php
Everything new in PHP 8.6, from a diff of php-src
https://nunomaduro.com/posts/everything-new-in-php-8-6
https://redd.it/1xkaogc
@r_php
How to Install PHP on Ubuntu 26.04 (Resolute Raccoon) with packages.sury.org
Working with PHP on Ubuntu 26.04 took an interesting turn, I wrote an article about it
https://phillipmwaniki.medium.com/how-to-install-php-on-ubuntu-26-04-resolute-raccoon-with-packages-sury-org-1c75e0cdae23
https://redd.it/1xlsu6e
@r_php
Psalm 7
https://github.com/vimeo/psalm/releases/tag/7.0.0
https://redd.it/1xm39ff
@r_php
Tyhp: a typed superset of the PHP language that compiles to readable PHP (first public beta)
Hi all. This is my first post here (my first post on reddit at all, actually), so go easy on me.
For the last few years I've been working on a project called Tyhp. Using AI has really pushed it forward over the last year or so. It's a typed superset of the PHP language. You write `.tyhp` files, the compiler type-checks them, and it outputs ordinary, readable PHP that you deploy the same way you already do. The closest comparison is TypeScript and JavaScript.
I started it because I really like TypeScript and PHP, and I always wondered why nobody had built a superset language for PHP that adds the kind of typed features I was used to in TypeScript.
What it adds on top of PHP:
* Types are required or inferred, and non-nullable unless you say otherwise
* Generics, checked at compile time
* Structs, which are typed shapes that compile down to plain arrays
* async/await built on Fibers
* A few smaller things like extension methods, operator overloads, and `using` for cleanup
A small example:
<?tyhp
namespace App;
type User = struct {
int $id;
string $name;
?string $email;
};
function findUser(array<User> $users, int $id): ?User {
foreach ($users as $user) {
if ($user->id === $id) {
return $user;
}
}
return null;
}
function emailOf(User $user): string {
return $user->email ?? '(none)';
}
The output looks like this:
function findUser(array $users, int $id): ?array
{
foreach ($users as $user) {
if ($user['id'] === $id) {
return $user;
}
}
return null;
}
function emailOf(array $user): string
{
return $user['email'] ?? '(none)';
}
The struct turns into an array and the Tyhp-only types are erased. Some features (structs, async, generics) rely on a small Composer runtime package, `tyhp/core`, plus a couple of others when you use them.
You can mix `.php` and `.tyhp` files in one project, and the `.php` files pass through untouched. Composer packages work as usual. To type-check calls into them, it generates `.tyhpdef` declaration files, similar to `.d.ts` files in TypeScript.
Some things to know up front:
* It's a beta, so syntax may still change and there will be bugs. Please report anything you run into on the [GitHub issue tracker](https://github.com/tyhpproject/tyhp/issues).
* The compiler is written in C# (.NET 9). Your servers only need PHP. The standalone binaries don't need .NET installed, and `composer require --dev tyhp/compiler` downloads the binary for you.
* A few PHP features are restricted in `.tyhp` files so the checker can do its job. For example, `eval()` is off by default and dynamic properties are only allowed on `stdClass`.
* There's a language server with VS Code and PhpStorm plugins. Xdebug works through a proxy that uses the generated source maps.
Docs: [https://tyhplang.com](https://tyhplang.com)
Source: [https://github.com/tyhpproject/tyhp](https://github.com/tyhpproject/tyhp)
Examples: [https://github.com/tyhpproject/tyhp-examples](https://github.com/tyhpproject/tyhp-examples)
Mostly I'd like to hear what you think. What would make you try something like this, and what would stop you? I'm happy to answer questions.
https://redd.it/1xm0r96
@r_php
When is AI generated PHP Code considered Slop?
I started using an AI Coding Agent for my PHP Projects. It's really usefull, makes iterations faster, and with the right rules the code stays organized and humanly comprehendible. I think many (web)Devs use it.
Yet, when ai assisted coding is mentioned, it seems one automatically gets branded as Slop Generator.
I mean, there should be a middle ground, where we can agree on that ai usage is good, and when php code is considered slop or has ai-smell.
https://redd.it/1xlxycu
@r_php
Thoughts on back porting security patches
https://stitcher.io/blog/backwards-beneficial
https://redd.it/1xltk3q
@r_php
PHP2Shell, then a kernel TCP RCE a week later: is serverless now the sane default for PHP apps, or am I fooling myself?
Hi,
October was a rough month if you run PHP in production:
* **Oct 21, PHP2Shell (CVE-2026-109618 / -109619, CVSS 9.2):** unauthenticated RCE in PHP itself, affecting FPM, mod\_php, FrankenPHP, LiteSpeed and php-cgi. Details and a tool leaked before the release, and several sites pulled themselves offline until the patch dropped.
* **Oct 15/24, CVE-2026-98432 (CVSS 9.8 from the kernel CNA, 8.1 from the distros):** a use-after-free in `tcp_v4_syn_recv_sock()` that has been in the kernel since 4.4. It’s reachable over the network with no auth. Debian, SUSE and Oracle shipped fixes, but as of last week Ubuntu, RHEL and Amazon Linux still hadn’t. If you’re on an Ubuntu VPS, you couldn’t patch even if you wanted to. When the fix does land, you also need a reboot.
Add Copy Fail earlier this year, and the claim that an AI model built a working exploit for the TCP bug in under an hour. The gap between disclosure and exploitation keeps shrinking.
I run a small agency, and most of our Laravel apps run serverless: Vapor on AWS Lambda, and in Europe Scaleway Serverless Containers. A few are still classic Forge-managed VPSes. The difference between those two groups this month was big:
* **Kernel bug:** nothing to do on serverless. On Lambda that’s AWS’s problem, and on Scaleway it’s Scaleway’s. Traffic comes in through API Gateway or the platform’s load balancer, not a raw TCP socket on “my” box. On the VPSes, we’re waiting on Ubuntu and then planning a reboot window.
* **PHP2Shell:** serverless did **not** make this go away. PHP is still PHP. But the fix was “rebuild image / redeploy, verify the version.” There was no SSHing into servers, no hoping `apt` had the package yet, and no checking that FPM actually reloaded. One gotcha: Vapor didn’t auto-redeploy as first announced, so you had to trigger it yourself. On the container side, we waited for patched FrankenPHP images, rebuilt and redeployed.
It isn’t just AWS. As far as I can tell, the same split applies to most serverless or managed-container options for PHP:
* **AWS Lambda** via Vapor or Bref
* **Scaleway Serverless Containers** (EU, which matters for some of our clients)
* **Google Cloud Run**
* **Azure Container Apps**
* **Laravel Cloud**, plus things like DigitalOcean App Platform and [Fly.io](http://Fly.io) (where you still ship a container, but don’t own the host kernel)
On all of them, the host and kernel are the provider’s job. PHP and your image are yours, but patching them is a rebuild and deploy.
My takeaway: serverless doesn’t make PHP more secure. It shrinks the part of the stack *you* are responsible for. It also turns patching into a deploy, which you already know how to do, rather than an ops task you do a few times a year under pressure.
But I’m aware of the counterarguments: cold starts, vendor lock-in, cost at scale, platform limits, and “you just moved trust to AWS, Google or Scaleway.” So I’m curious how others see it:
1. If you run PHP on your own servers, how did you handle these two? Do you have unattended-upgrades and kernel live-patching (Livepatch, kpatch), or was it a manual scramble?
2. If you’re on Cloud Run, Container Apps, Scaleway, Fly or Laravel Cloud: how fast did you get a patched PHP image out, and did the platform do anything for you?
3. Has anyone moved *away* from serverless PHP? What pushed you back?
4. For mod\_php users: did PHP2Shell finally push you to FPM or FrankenPHP?
I get the feeling most PHP apps out there still run on (virtual) servers, and serverless is still a niche. Is that true? What are you running on right now, and if it’s a VPS, is that a deliberate choice or just what you’ve always done?
https://redd.it/1xltdxm
@r_php
Weekly Ask Anything Thread
Feel free to ask any questions you think may not warrant a post. Asking for help here is also fine.
https://redd.it/1xlnk4e
@r_php
Filament Command Palette 2.1: page-scoped commands, nested menus, chords, optional Scout
I maintain filament-command-palette, a ⌘K palette for Filament panels. 2.1 is the release I actually wanted for daily admin work, so here is what changed.
\- Page and resource commands
Implement HasPaletteCommands. Those commands show in a Current page group and stay out of the static cache. The action closure can take the current record, loaded through the resource query.
\- Nested commands
CommandItem::children() opens a submenu. Escape pops one level. Depth cap is 8. The client only receives hasChildren. The child list is built on the server.
\- Chords
\->chord('g c') runs the same authorized command path. Ignored while typing in inputs or Filament forms.
Everything else in this release
• mountAction('create') authorizes, then asks the host page to mount the Filament action
• ->scoutIntegration() is opt-in. Scout returns keys. Filament still applies tenancy, policies, titles, and URLs
• Tenant switching is a submenu
• Cache keys hash role and permission names. ->cacheSignature() covers custom auth
• ->action(Invokable::class) for commands that have to survive config:cache
• php artisan command-palette:install registers the plugin on discovered panel providers
https://github.com/usamamuneerchaudhary/filament-command-palette
Happy to answer any questions :)
https://redd.it/1xlgcai
@r_php
Spectra 2.6.0 is out: AI cost tracking for Laravel can now pull current prices from the providers’ pricing pages
https://redd.it/1xlb129
@r_php
Two PHP memory-corruption bugs, now patched, and why turning either into a shell is the hard part
Over the last few weeks I dug into two memory-corruption bugs in PHP's request startup, both now patched in 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, and wrote up the whole thing: how they work, how far I could push them, and how long it took to get from a crash to a shell.
The short version of the bugs: a request-startup out-of-memory condition used to longjmp out mid-operation and leave the engine's globals pointing at freed or half-initialized memory. A second bug decodes a session before the request is fully reset, reusing a dangling unserialize context from a prior request. Both hand you a single write primitive, and the write lands attacker bytes on a forged structure whose destructor pointer is the address of a C function. Freeing it runs the command.
The interesting part is how much work comes after you have the bug. Every offset is pinned to one compiled binary, so a public proof-of-concept is a crash on someone else's build, not a shell. On php-fpm all four requests have to hit the same worker, which I expected to be the wall, until I found that stock nginx hands connections to workers in a rotation you can walk. None of that shows up in the headline when a CVE drops, and it is the difference between "memory corruption" and "remote code execution on your server."
It is a long read with diagrams of each chain. The patched releases are the control throughout, so the takeaway is boring and correct: upgrade. Happy to answer questions here about the engine internals or the exploitation work.
https://ilia.ws/blog/php2shell-two-ways-php-corrupts-its-own-memory
https://redd.it/1xl7cwq
@r_php
I built a PHP version manager in Go to solve the "Chicken-and-Egg" problem
Most PHP version managers are written in PHP (which is a paradox) or are too bloated for simple needs. I wanted something fast, lightweight, and capable of handling custom security patches and Zig compiler support to fix build failures on modern OSs.
I've detailed the technical challenges of static vs. dynamic linking in PHP and why this tool is necessary for professional workflows. Feedback welcome! https://supanadit.web.id/solving-the-chicken-and-egg-problem-of-php-versioning/
https://redd.it/1xl50xt
@r_php
The Advantage of Fixing All PHP Warnings
https://www.exakat.io/the-advantage-of-fixing-all-php-warnings/
https://redd.it/1xl11pd
@r_php
PHP's Hidden Memory Bug: How a Failed Upload Left Stale Pointers That Could Expose Secrets or Enable Code Execution
/r/brodmann/comments/1xkwtay/phps_hidden_memory_bug_how_a_failed_upload_left/
https://redd.it/1xkx3v6
@r_php
FilaRank 3.1: the Filament SEO plugin's audit now runs on the queue instead of in your panel request
Small release for my Filament SEO plugin. The headline change is one I should have made earlier: the technical audit crawled up to 500 pages synchronously inside a Livewire action. 3.1 moves it to queued jobs, and a filarank:audit command with an optional nightly schedule. 'queue' => false restores inline behaviour if you don't run a worker.
Also in this release:
Models implementing `HasHreflang` get their maps audited.
Organization/WebSite JSON-LD nodes get stable u/ids; Article publisher references the Organization instead of duplicating it
Invalid custom JSON-LD is now a form validation error instead of being silently dropped at render time
SEO Overview uses aggregate queries instead of loading every scored row into memory
No migrations, no new dependencies
demo at filarank.com if you want to click around. Happy to answer questions about the package :)
https://redd.it/1xke51v
@r_php
PHP vulnerability caused major data leak for Moldova's Government 750k
According to Moldova's e-government agency, the hackers stole extremely sensitive details on 750,000 citizens, which is roughly a third of the country's total population of 2.35 million. This included data such as:
full names
dates and place of birth
details on family members
insurance status
family doctor registration
social security details
pension details
disability details
driver's license data
photos
car and business ownership
financial details, such as bank accounts, debt, and MPay history
https://redd.it/1xjlomf
@r_php