| Curated news all about PHP. Here's the latest edition |
|
|
August 13th 2026 |
|
Hi everyone,
If it's PHP news, you want, then you've come to the right place. In this week's newsletter we have articles on what's new in PHP 8.6, Architecting Secure Webhooks in Laravel, and Hidden Gems in the PHP Source Code. In Podcasts we have new episodes from Laravel News and this week they chat about Laracon US, Pest 5, and Heimdall, Ian and Aaron from Mostly Technical discuss Aaron's first week as VP of Marketing & Community at Laravel, while Syntax's topic of choice is Cloudflare Wallets. Finally in our Reading section, we have articles on Multi-Tenant Architecture Patterns in Laravel, Preventing cognitive debt, and True Reified Generics and Runtime DocBlock Enforcement in Pure PHP.
We have all that and more, so we do hope you enjoy this week's newsletter. If you have an article, tutorial or podcast that you would like to be featured in our newsletter, feel free to reach out to us at articles@phpweekly.com.
All the best,
Adrian
|
Please help us by clicking to our sponsors:
Give Your Unused Startup a Second Chance
List your unfinished SaaS, app, or project for free. Sell it, find a co-founder, or let someone else bring it to life. No fees, no hassle - just new opportunities!
|
Articles
Hidden Gems in the PHP Source Code
Here's a collection of interesting comments, easter eggs, and developer confessions found in the PHP source code. Some are deliberate easter eggs. Most are developers being honest: venting about compilers, leaving notes for their future selves, annotating hacks they hope someone eventually cleans up.
The Laravel 13 Features That Matter in Real Projects
This post focuses on the features you will actually reach for on real client projects — not an exhaustive tour.
Architecting Secure Webhooks in Laravel
The architectural challenge with webhooks is that they require you to open an unauthenticated POST endpoint to the public internet.
Two gotchas when your Laravel app shells out to a CLI
If a web request shells out to a slow CLI (docker, kubectl, rsync…), move it to a queued job — PHP-FPM/nginx will kill it at ~30s anyway.
The Most Common Test Smells in PHP (And How to Fix Them)
Your test suite passes. CI is green. Everyone merges their pull requests with confidence. Then a seemingly harmless refactor breaks production. If that sounds familiar, the problem isn't always a lack of tests. Sometimes it's the quality of those tests.
What's new in PHP 8.6
PHP 8.6 will be released on November 19, 2026. It includes partial function application, a new polling API, function parameter doc comments, a bunch of deprecations, and more.
Session Security in PHP — What Most Developers Get Wrong
The session ID is the key to your user’s account. Here is every way attackers steal it and how to stop them.
|
Tutorials and Talks
Build a JSON-RPC 2.0 API in Symfony in 15 minutes: from composer require to OpenAPI
In this article we will build a working JSON-RPC 2.0 API on Symfony: a task tracker with DTO validation, batch requests and generated OpenAPI documentation. There is surprisingly little code to write: methods are declared with attributes, validation is derived from property types, and Swagger is generated by a console command.
Letting a Stranger's URL Into Your Server Without Building an SSRF Vector
This guide walks through the approach I used to ship exactly that kind of feature, a visitor-facing tool where anyone can type a URL into a chat interface and get a technical report back, and the specific bypasses my first implementation let through before I found them.
How to Protect Sensitive Data in Laravel AI Prompts
When you pipe user input into an AI prompt, you are crossing a security boundary. The string your Laravel controller hands to AI::text()->prompt() is no longer just data — it becomes an instruction the model will follow. This article covers the practical defences every Laravel developer needs before shipping AI features to production.
Magento 2 Product Relations Performance: Fixing Upsells, Crosssells & Related Products at Scale
This guide breaks down how Magento 2 loads product relations, where the performance bottlenecks hide, and what you can do to keep your product pages fast even when every product has dozens of relations.
PHP Properties vs Attributes
If you’re learning Laravel, you may have noticed something unusual in newer Laravel models. |
News and Announcements
Teaching AI Agents CakePHP: Introducing Ignis
AI coding assistants are impressive. They write controllers, invent migrations, and generate tests with confidence. Then you open the pull request and notice problems. The associations use the wrong strategy. The queue job does not match CakePHP Queue 2.x. The “helper” the agent invented already exists in your plugin. The model was not bad at coding. It was coding without real knowledge of your application.
Image Dominant Color and HEIC Support in Laravel 13.24
Laravel 13.24 extends the framework's image API with dominant color detection and HEIC input and output, adds a modelKeys() method to the Eloquent query builder, introduces an array_keys validation rule, and fixes wildcard validation that could stall a request for over a minute on large arrays.
Symfony 8.1.4 & Symfony 7.4.16 released
Read the Symfony upgrade guide to learn more about upgrading Symfony and use the SymfonyInsight upgrade reports to detect the code you will need to change in your project.
August 3–9, 2026 - A Week of Symfony #1023
This week, Symfony 7.4.16 and 8.1.4 maintenance versions were released, alongside Symfony UX 3.4.0 and Symfony Polyfill 1.41.0. In addition, we highlighted Twig 4.0's new macro system and first-class sandbox. Finally, we announced that SymfonyLive Germany 2027 will take place in Cologne.
This Week In PHP Internals | Aug 05, 2026
PHP's 35-ballot deprecation vote enters its final week with list() deadlocked at 21-21, a second RFC author pulls his own vote over the process rules, and PHP 8.6 officially gets a Duration class. Complete coverage of the php-internals mailing list, July 29 - August 4, 2026.
|
Podcasts and Vlogs
Laravel News: Laracon US, Pest 5, and Heimdall
Jake and Michael discuss all the latest Laravel releases, tutorials, and happenings in the community.
The Stack Overflow: Your tokenmaxxing is not valuemaxxing
Ryan is joined by Coder’s Rob Whiteley to chat about why tokenmaxxing isn’t proving real value and just triggering Goodhart’s Law, how release speed and PR merges can help you measure agentic outcomes with or without a human-in-the-loop, and what the democratization of skills means for junior developers and the talent pipeline.
Software Engineering Radio: SE Radio 732: Jason Gorman on The Effective Use of AI For Software Development
Jason Gorman, a software development expert and founder of Codemanship, joins host Giovanni Asproni to explore how best to use AI in software development. They start by considering how established technical practices — test-driven development, modularization, continuous integration, and continuous reviews — become more important, not less, when working with AI assistance. These practices help address several key limitations of LLMs, including keeping context windows as small as possible.
Shoptalk Show: Front-End Complexity, AI Co-Authorship, and New CSS Navigation Patterns
We tackle a listener question about why junior front-end devs are expected to know so much beyond HTML and CSS, then get into Dave's real-world fix swapping old WebKit line-clamp hacks for the new CSS line-clamp property and the subtle bugs that kind of truncation work can cause.
WP Builds: 479 – How Clonable automates and personalises multisite translation for WordPress
The conversation focused on Niels Arts and his work on Clonable, a SaaS solution for managing multilingual websites. One concept discussed was how Clonable allows site owners to create separate versions of their websites in different languages, keeping them synchronised while permitting specific local changes.
PHP Architect: The PHP Podcast 2026.08.06
A sick kitten steals the show, Sara loses a fight with her smart lights, PHP 8.6 beta is almost here, and the crew argues about roadmaps, deprecations, and why you shouldn’t be a meat proxy.
Mostly Technical: 144: First Week as VP
Ian and Aaron discuss Aaron's first week as VP of Marketing & Community at Laravel, why he's writing manifestos in Notion, Ian's huge week with AI coding, and an update on Nachogate.
Syntax: Cloudflare Wallets
Cloudflare is rolling out crypto wallets with claimable handles as identity, and a real React compiler finally landed for regular hooks-based code. Plus: OpenAI's pricing war, Vue Vapor benchmarks, GitHub's new npm malware scanning, and an active supply chain attack hitting 868 packages.
|
|
Why I Choose Laravel for Every Serious Web Project in 2026 (After 3 Years of Real Experience)
After building business websites, custom web applications, and SEO-friendly platforms with Laravel for the past 3 years, here’s why it remains my first choice in 2026.
Laravel API Security in Depth: Sanctum Tokens, Granular Rate Limiting, and Multi-Version Routing
You've built the endpoints, wired up the controllers, and the happy path works. Then someone hammers your API with 10,000 requests in a minute, a client ships a breaking change to mobile users on v1, and a rogue token gives third-party access to everything it shouldn't. This is where most "RESTful API" tutorials stop — and where real API design begins.
Multi-Tenant Architecture Patterns in Laravel: Choosing the Right Database Strategy
Every Laravel SaaS product hits the same fork in the road once it has more than one paying customer: how do you keep Tenant A's data from ever touching Tenant B's, while still shipping features at a reasonable pace? The answer isn't "add a tenant_id column and move on" — that works until it doesn't, usually right when a query is missed and one customer sees another customer's invoices in a support ticket.
Prevent cognitive debt by manually retyping LLM-generated code
Despite what I said in April, I'm still using coding assistants on my personal projects. Using them to one-shot entire features leaves me unsatisfied and disoriented, but I do enjoy using them to fast-forward through the boring parts of my projects.
TypePHP: True Reified Generics and Runtime DocBlock Enforcement in Pure PHP
A transparent, load-time AST aspect weaver that enforces generics, typed arrays, array shapes, callables, and generators without custom syntax or C-extensions.
|
Interesting Projects, Tools and Libraries
mmeyer2k/dcrypt
A petite library of encryption functionality for PHP.
diff/diff
Small standalone library for representing differences between data structures, computing such differences, and applying them as patches.
dave-liddament/php-language-extensions
Attributes for extending the PHP language, using static analysis to enforce new language constructs.
jgrossi/corcel
Use WordPress backend with Laravel or any PHP framework.
utopia-php/storage
A simple Storage library to manage application storage.
mediawiki/phan-taint-check-plugin
A Phan plugin to do security checking.
cyrildewit/eloquent-viewable
A minimalistic analytics package for Laravel with seamless view tracking for Eloquent models.
lanin/laravel-api-debugger
Easily debug your JSON API.
spatie/laravel-slack-slash-command
Make a Laravel app respond to a slash command from Slack.
contributte/redis
Redis client integration into Nette framework.
|
Jobs
------
Do you have a position that you would like to fill? PHP Weekly is ideal for targeting developers and the cost is only $75/week for an advert. Please let me know if you are interested by emailing me at articles@phpweekly.com |
Please help us by clicking to our sponsor:
 Protect your PHP Code
Why not try SourceGuardian 17. Click here to download a 14 Day Trial copy. Protect your code using Windows, Linux or Mac and run everywhere with our free Loaders. |
So, how did you like this issue?
|
|
|
|
|
|
