php[podcast] episodes from php[architect]

The site for PHP professionals, Magazine, Training, Books, Conferences

Episodes

  1. 1d ago

    The PHP Podcast 2026.10.22

    PHP Podcast – October 22, 2026 Hosts: Holly, Sara, Joe – Special Guest Daniel Scherzer PHP ships an emergency security release a day early, Daniel Scherzer pushes the commits at 6:30am on four hours of sleep, and governments across Europe start pulling servers offline. Oh, and a 12-pound dog nearly killed Holly. The PHP2Shell Security Release Special guest Daniel Scherzer — release manager for PHP 8.5 and 8.6 and a recent addition to the PHP ecosystem security team — walked the crew through the week’s big story: two critical CVEs that could lead to remote code execution. The team coordinated a synchronized release across PHP 8.2.35, 8.3.36, 8.4.27, and 8.5.12, with additional source backports provided for 7.4, 8.0, and 8.1 given how severe the vulnerabilities were. Daniel described the stress of it all, including waking up at 1am with a headache before a 5am alarm and a release process planned for 1300 UTC. In the end he volunteered to push every change himself, running three commands to push a whole bunch of commits across three repositories in a single atomic operation — four tags and seven branches at 1335 UTC, just before public disclosure. He also drew a clear line around the hats he wears. As a release manager he had early access to the fix, but he deliberately did not patch his own PHP-powered website ahead of time, explaining that the community trusted him to help release PHP, not because he was important enough to get early access for personal use. Governments in Europe were turning off public-facing sites and the NSA published guidance, leaving Daniel marveling at how he ended up with a front-row seat to something heads of government were paying attention to. A Two-Year-Old Bug and the AI Angle The vulnerability wasn’t new — it was originally discovered back in 2024 during the security audit funded through the PHP Foundation via the German government’s Sovereign Tech grant. The bug reportedly traces back through the PHP 5 series and possibly even PHP 4. What changed in 2026 was that someone (with AI tooling assistance) figured out how to turn a theoretical vulnerability into a workable exploit. Daniel pushed back on the framing that AI simply “found” the bug, emphasizing the two years in between where it was known but there weren’t enough maintainer hours or infrastructure to address it. At the time it was essentially a theoretical bug with no consistently provable exploit path. He cautioned that AI-discovered vulnerabilities shouldn’t be assumed correct without a human reviewing them, noting he hadn’t yet seen a clean proof-of-concept that didn’t also rely on some other underlying server vulnerability. The group discussed the rate of security reports skyrocketing as LLMs become common, with Sara describing the bandwidth problem the volunteer security team faces: triaging what’s likely to be exploited, confirming fixes are actually complete, and avoiding publishing an incomplete fix that tips off bad actors. Amazon claimed to have seen exploitation attempts beforehand, but the release manager chat showed no indication the bug was ever exploited in the wild before the release. Fund the Volunteers Who Hold Up the Internet A recurring theme was that PHP is fundamentally a volunteer-driven effort. The packagers for Ubuntu, Debian, and Red Hat — Remy and Andres — were both on vacation and stopped their plans to package PHP a day early. The Docker library maintainers are volunteers too, as are many members of the Foundation security team who are still not paid contractors. The crew highlighted a Mastodon post from Nils Alderman arguing that if the governments shutting down servers, the hosting companies, and the enterprises terrified by this vulnerability each gave even $50,000 a year to the PHP Foundation, things could look very different. Daniel echoed this: had there been infinite money and maintainer hours, every theoretical vulnerability might get fixed as a hardening measure. Joe shared how PHP Architect Consulting had its first client patched roughly 30 minutes after the fix went live — thanks to a tip from Marco Pavetta about forking the Docker PHP library repo and building your own base image before the mirrors saturated. He also recounted his own role helping Derick Rethans keep php.net patched before the announcement so the site wouldn’t fall over under load, including one odd bug where the patched version broke Apache directory listing on downloads.php.net. Life as a Release Manager With three release managers now on the team — Daniel, Joe, and Matteo Beccati — the conversation turned to what the role actually involves. Joe explained he wanted to learn more about the process, especially how to make judgment calls on backwards-compatibility breaks, and that lots of discussion happens behind the scenes before and during a release. Daniel noted he’d volunteered to be 8.5’s release manager for this exact week over a year ago, and that the Zoom coordination call was his idea. They dug into an ABI change in the security release that added new fields to the executor globals. The group debated whether that counts as an ABI break — the consensus being it technically is one, but a safe one as long as you’re not mixing newer extensions depending on those fields with older versions in the same branch. Sara and Holly stressed that extensions should never be wholesale copying global blocks in the first place, especially given how differently that memory behaves in threaded versus non-threaded builds. Daniel shared his origin story: just over two years contributing to PHP, starting with a typo fix to a test name after creating a professional GitHub account under Daniel E. Scherzer. Holly and Sara warned him there’s no escaping — Sara sent her first patch 24 years ago and is still here. The bit about “settling for Joe” ran throughout the whole episode. Rust, C, and the Rewrite Temptation Daniel raised the question of rewriting PHP in Rust, pointing out the vulnerability was fundamentally tied to C’s longjmp, which doesn’t exist in Rust. Sara countered that you don’t need a longjmp approach at all — the same behavior could be achieved with C++ exceptions or a Rust mechanism, but it would be a fundamentally different runtime approach. Holly, half-joking, said she’s one sponsor away from pulling a “bun” and throwing hundreds of thousands of AI agents at a hard rewrite of the PHP engine, predicting this is the first of many memory-safety bugs AI agents will surface in the C codebase. Daniel tempered the hype, noting AIs hallucinate and that this being the first of 100,000 reports doesn’t mean there are 100,000 real memory issues. The segment wrapped with Daniel’s recent work building PHP extensions in Rust (he gave a workshop on it at Longhorn), digging into the C macros for globals and how ZTS thread-support mode changes everything. The repeated advice: learn it, experiment on your own fork, but don’t mess with it until you actually understand it — and never hit git push to the public source. Links from the show: PHP Tek 2027 — April 27–29 in Chicago, early bird tickets available PHP Tek CFP — closes end of October 2026 Scherzer.dev — Daniel’s site, blog, timeline write-up, and hire info PHP Foundation — donate to support PHP security work https://phpc.social/@naderman/117485091076355564 Today’s PHP Security Release, and How We’re Strengthening PHP Security Host: Joe Ferguson Mastodon: @joepferguson@phpc.social PHPArch.me: @svpernova09 Sara Golemon Mastodon: @pollita@phpc.social Holly Schilling Mastodon: @TheCodeLorax@tech.lgbt Streams: Youtube Channel Twitch Connect & Hire PHP Architect Website Twitter/X Mastodon Hire PHP Developers Looking to hire PHP developers? Email support@phparch.com – Joe and the team are available for consulting, infrastructure work, Ansible playbooks, and code review. Partner This podcast is made a little better thanks to our partners OurCVEs   Your security posture, on autopilot with OurCVEs     CodeRabbit   Cut code review time & bugs in half instantly with CodeRabbit.   PHP Architect Consulting   PHP Architect provides long-term technical partnerships for organizations that need senior-level PHP expertise that you can depend on. Your PHP codebase deserves a partner, not a contractor. Learn more.   Music Provided by Epidemic Sound https://www.epidemicsound.com/ Join Us Live Next Week Youtube Channel Got feedback? Join us on Discord at discord.php.com The post The PHP Podcast 2026.10.22 appeared first on PHP Architect.

  2. 2d ago

    Community Corner Podcast: elePHPants with Damien Seguy

    In this episode, Scott talks with Damien Seguy about the history of the elePHPant, from Vincent Pontier’s logo doodle to 6,054 plush toys in Damien’s home, how the community trades them through the Community Postal Service, and what it takes to create your own. Chapters: 00:00 Intro 01:52 How the PHP logo became an elephant 03:53 Turning the logo into a plush toy 05:29 elePHPants for user groups, companies and conferences 07:56 Trading and the Community Postal Service 10:25 The chocolate factory handoff 15:55 How to create your own elePHPant 19:17 Colors, nails and accessories 24:33 Scratchy: elePHPants for small user groups 27:39 Exakat and the PHP onboarding book Links: Our Discord – https://discord.gg/aMTxunVx Buy our shirts – https://store.phparch.com/products/community-corner-podcast-t-shirt Mentioned in this episode: Exakat static analysis engine – https://www.exakat.io/ PHP onboarding book (feedback welcome) – https://thephpbook.readthedocs.io/en/latest Damien’s Links: Bluesky – https://bsky.app/profile/dseguy.bsky.social Mastodon – https://phpc.social/@dseguy GitHub – https://github.com/dseguy Scott’s Links: Website – https://scott.keck-warren.com/ Bluesky – https://bsky.app/profile/scottkeckwarren.bsky.social LinkedIn – https://www.linkedin.com/in/scott-keck-warren-91689810/ Mastodon – https://phpc.social/@scottkeckwarren PHP Architect Social Media: X: https://x.com/phparch Mastodon: https://phparch.social/@phparch Bluesky: https://bsky.app/profile/phparch.com Discord: https://discord.phparch.com Subscribe to our magazine: https://www.phparch.com/subscribe/ Partners This podcast is made a little better thanks to our partners. OurCVEs Your security posture, on autopilot with OurCVEs   CodeRabbit   Cut code review time & bugs in half instantly with CodeRabbit.     PHP Architect Consulting   Your PHP codebase deserves a partner, not a contractor PHP Architect provides long-term technical partnerships for organizations that need senior-level PHP expertise that you can depend on https://www.phparch.com/consulting/ Music provided by Epidemic Sound https://www.epidemicsound.com/ The post Community Corner Podcast: elePHPants with Damien Seguy appeared first on PHP Architect.

  3. Oct 15

    The PHP Podcast 2026.10.15

    PHP Podcast – October 15, 2026 Hosts: Joe Ferguson & Holly Schilling Longhorn PHP kicks off, agentic commerce gets scary, bots keep scanning, and a Cold War satellite schematic proves software is harder than hardware. Swag, Longhorn PHP, and “Am I Even a PHP Developer?” Joe opened by confessing he found a JavaScript bug in the swag store cart while ordering socks and a hoodie — the curse of being a developer who can only ever see the bugs. Holly joked that Sara got bumped from the show for refusing to wear swag, while Eric apparently bought one of everything in the store, including a Peanuts-style team picture card from PHP Tech. The conversation turned to Longhorn PHP 2026, which kicked off with a tutorial day and runs through the main talk day on Friday. Holly is presenting remotely after travel plans fell through, giving a talk on her pet peeve: websites that get “packaged up” and shipped as apps instead of being built as real native applications. That led into a heartfelt riff on imposter syndrome. Holly admitted she’s spent years insisting she’s “not really a PHP developer” despite submitting RFCs, speaking at conferences, and having an elephpant named after her. Joe shared his own years at a Python startup where he felt like a fraud for only writing PHP nights and weekends. The takeaway: showing up in community spaces — Discord, social media, GitHub, conferences — is all it takes to belong. Agentic Commerce and Single-Use Card Security Joe highlighted a Community Corner episode with Scott Keck-Warren and Paul Conroy on agentic commerce — the slightly terrifying idea of your Claude agent going out shopping on your behalf. Holly was especially wary of trusting Gemini for shopping advice given Google’s long history of steering how people search and buy. Much of the underlying tech, they noted, lives in Stripe and resembles Apple Pay-style single-use card numbers: time-limited, amount-limited tokens that protect the real source card. Holly drew on her experience at a buy-now-pay-later company (now branded FlexPay) doing one-time code generation, where even 15-minute-lived card numbers required full PCI compliance, certificate pinning, HMAC, encryption at rest, and constant audits across every layer from mobile SDK to backend. Bots, Scrapers, and Cloudflare to the Rescue A Discord listener (ducknizzle) asked what everyone uses to kill bot and scanner traffic on public sites. Joe’s pessimistic answer: block ranges, sometimes entire countries, and ultimately just put it behind Cloudflare and let specialists deal with it — the same way you’d pay someone to host email rather than running it yourself. Holly praised Cloudflare Pages for static content, calling it free and “it just works” with zero bandwidth worries, though WordPress makes things more complicated. Joe talked about his work-in-progress effort to standardize robots.txt across php.net properties, while acknowledging it only helps the well-behaved crawlers — malicious scrapers and AI training bots will simply ignore it. Holly estimated AI scrapers now outnumber legitimate bots roughly 10 to 1, and both lamented how the internet has lost some of its earlier friendliness. How the PHP Security Team Handles Your Reports Joe showcased a PHP Foundation blog post describing how the security team triages reports, sharing insight from his new role as a release manager. Release managers get advance heads-up on security releases, which follow extra processes to handle disclosures responsibly. He explained that every report is read, triaged, and prioritized — someone in Discord recently got confirmation their advisory was “in the backlog.” The sobering reality is that the greater PHP security team is only one or two humans, reflecting the open-source nature of the project. The team can now issue its own CVEs rather than waiting on GitHub, so fixes and packager updates can ship as fast as possible. Joe noted serious, wild remote-code-execution-level vulnerabilities remain rare, especially this early in the 8.6 cycle, which just branched from master. New PHP News Site, Design, and php.net’s Redesign Joe demoed a new PHP ecosystem news site from Eric Barnes (Laravel News) and Matt Stauffer (Titan) in collaboration with the PHP Foundation — a modern aggregator reminiscent of the old Planet PHP days, complete with RFC coverage, a newsletter, topic sections, and a slick automatic dark mode toggle. Holly, admitting she has no eye for design herself, loved how well it was executed. That sparked a running theme of developer respect for design as a discipline neither host feels competent in. Joe mentioned a php.net redesign in progress — mock-ups are available in the PHPC Discord’s PHP Foundation Ambassador Marketing subgroup, though it’s still a work in progress and not yet mobile friendly. Both admitted feeling like outsiders in design meetings the way non-developers feel in dev meetings. Joe shared Anthropic’s guidance to tell Claude what you *don’t* want for front-end work, to which he replied that as a developer, he often doesn’t even know what he doesn’t want. A Satellite Schematic vs. a Million Lines of Code Holly launched into a favorite tangent, inspired by Apple releasing its home hub device years after the hardware was ready and pundits asking why the software took so long. Working on her own project with 16 encryption keys across five servers, she had to draw diagrams just to keep the key exchanges straight. She then described a treasured artifact: a 3-by-9-foot schematic of an entire FSC-78 Bravo-mod satellite terminal from her Army SATCOM days at Fort Detrich — the whole Cold War-grade, anti-jamming system fitting on roughly 65 letter-sized pages. Contrast that with Margaret Hamilton’s famous photo beside the Apollo code printouts: around a million lines, a scale that’s routine in modern projects. Her point: software complexity dwarfs even elaborate hardware, and developers rarely give themselves credit for it — leaky abstractions, uncaught exceptions, and endless edge cases don’t plague hardware the way they plague code. The discussion wrapped with fault tolerance stories: Joe discovered a three-node Elasticsearch staging cluster where failover had never been enabled (and only one node was taking all the traffic), and Holly recalled a satellite timing setup with redundant cesium sources where the only part that kept failing monthly was the single non-redundant box joining them together. Fault tolerance, they agreed, is important. Links from the show: PHP Tech 2027 — Chicago, April 27–29, tickets & CFP open Join us in Discord PHP Arch Swag Store PHP Foundation — How the Security Team Handles Your Reports Community Corner Podcast: Agentic Commerce with Paul Conroy 2027 State of Open Source Survey (Perforce / OpenLogic / Zend) PHP Architect Consulting Host: Joe Ferguson Mastodon: @joepferguson@phpc.social PHPArch.me: @svpernova09 Sara Golemon Mastodon: @pollita@phpc.social Holly Schilling Mastodon: @TheCodeLorax@tech.lgbt Streams: Youtube Channel Twitch Connect & Hire PHP Architect Website Twitter/X Mastodon Hire PHP Developers Looking to hire PHP developers? Email support@phparch.com – Joe and the team are available for consulting, infrastructure work, Ansible playbooks, and code review. Partner This podcast is made a little better thanks to our partners OurCVEs   Your security posture, on autopilot with OurCVEs     CodeRabbit   Cut code review time & bugs in half instantly with CodeRabbit.   PHP Architect Consulting   Your PHP codebase deserves a partner, not a contractor. PHP Architect provides long-term technical partnerships for organizations that need senior-level PHP expertise that you can depend on. Learn more.   Music Provided by Epidemic Sound https://www.epidemicsound.com/ Join Us Live Next Week Youtube Channel Got feedback? Join us on Discord at discord.phparch.com The post The PHP Podcast 2026.10.15 appeared first on PHP Architect.

  4. Oct 15

    Community Corner Podcast: Agentic Commerce with Paul Conroy

    In this episode, Scott talks with Paul Conroy about agentic commerce: how AI agents buy things on our behalf, how Stripe’s shared payment tokens keep them on a budget, and how the Machine Payments Protocol finally puts HTTP 402 Payment Required to work in your API middleware. Links: Our Discord – https://discord.gg/aMTxunVx Buy our shirts – https://store.phparch.com/products/community-corner-podcast-t-shirt Mentioned in this episode: Charging AI Agents Per Request: A Practical Guide to the Machine Payments Protocol – https://conroyp.com/articles/practical-guide-machine-payments-protocol Agentic Commerce Beyond The Checkout: Building with Machine Payments (Paul’s talk) – https://conroyp.com/speaking/agentic-commerce-beyond-the-checkout-building-with-machine-payments PayForGoals.com, the MPP demo – https://payforgoals.com PayForGoals.com source code – https://github.com/square1-io/www.payforgoals.com laravel-mpp package – https://github.com/square1-io/laravel-mpp Stripe Machine Payments Protocol quickstart – https://docs.stripe.com/payments/machine/mpp/quickstart Paul’s Links: Website – https://conroyp.com Company: Square1 – https://square1.io X / Twitter – https://x.com/conroyp Bluesky – https://bsky.app/profile/conroyp.bsky.social LinkedIn – https://www.linkedin.com/in/paulconroy2/ GitHub – https://github.com/conroyp Scott’s Links: Website – https://scott.keck-warren.com/ Bluesky – https://bsky.app/profile/scottkeckwarren.bsky.social LinkedIn – https://www.linkedin.com/in/scott-keck-warren-91689810/ Mastodon – https://phpc.social/@scottkeckwarren PHP Architect Social Media: X: https://x.com/phparch Mastodon: https://phparch.social/@phparch Bluesky: https://bsky.app/profile/phparch.com Discord: https://discord.phparch.com Subscribe to our magazine: https://www.phparch.com/subscribe/ Partners This podcast is made a little better thanks to our partners. OurCVEs Your security posture, on autopilot with OurCVEs   CodeRabbit   Cut code review time & bugs in half instantly with CodeRabbit.     PHP Architect Consulting   Your PHP codebase deserves a partner, not a contractor PHP Architect provides long-term technical partnerships for organizations that need senior-level PHP expertise that you can depend on https://www.phparch.com/consulting/ Music provided by Epidemic Sound https://www.epidemicsound.com/ The post Community Corner Podcast: Agentic Commerce with Paul Conroy appeared first on PHP Architect.

  5. Oct 8

    PHP Foundation Community Hour Podcast 2026.10.08

    PHP Foundation Community Hour – October 8, 2026 Hosts: Elizabeth Barron & James Titcumb James tells the story of how he fell into open source, breaks down what Pie actually does, celebrates the 1.5 release, and shares real advice for anyone nervous about making their first contribution. How James Got Into Open Source James traced his open source journey back many years to a set of Zend Framework 1 helper classes he found useful enough to publish, back when he wasn’t even sure GitHub existed yet. From there he built a little tool to deploy code from Git over SSH at a previous employer, replacing a hand-upload process that he knew had to be modernized. Things really took off when he joined Roave, where contributing was actively encouraged and he was surrounded by prolific maintainers like Marco working on Doctrine, alongside in-house libraries such as Security Advisories and Better Reflection. Having a supportive employer early on made all the difference, letting him do the work during the day instead of squeezing it into nights and weekends. Elizabeth reflected that this is a common on-ramp into open source: scratch your own itch, put it out there, and hope it helps someone with the same problem. She emphasized how much employer support, team mentorship, and a genuine culture of open source help newcomers find their footing. What Pie Is and Why It Exists James explained that Pie came about because the infrastructure around PECL and PEAR is simply aging, with very few people who know the code base well enough to maintain it. The PHP Foundation approached him to overhaul that tooling, applying the hard-won lessons of Composer — which he agrees is arguably the best package manager for any language. Under the hood, Pie is really a very fancy wrapper around four commands — phpize, configure, make, and make install — plus a lot of dependency management and making sure you get the right package for your specific PHP install, something PECL never really did. Thanks to the Packagist team setting up an extensions area, Pie plugs into Composer’s source code to get that dependency resolution for free. A key distinction is that you aren’t installing extensions for a project the way you do with Composer packages — you’re installing them for a particular PHP install. Pie manages this in a dedicated Pie home directory, keeping each of your many PHP versions and their extensions sorted out. James’s bigger goal has evolved from simply replacing PECL to making installing an extension as frictionless as installing a PHP package. Democratizing Extensions and the Windows Challenge Moving off PECL’s centralized repository and onto Packagist means literally anyone can now submit an extension, the same way they publish PHP packages. James noted that when problems come up there are usually three kinds of fixes: improving something in Pi, writing better documentation, or working with an extension author who hasn’t configured their composer.json correctly. Because extensions have unique needs, the Composer team added new Pi-specific options to specify configure flags, supported platforms, and architectures — concepts Composer never had since it only ever dealt with pure PHP code. A Windows-only library extension is useless on macOS or Linux, and a systemd-dependent one is useless on Windows, so that categorization matters. The most common friction point James sees is Windows extensions. Unlike PECL, which auto-compiled DLLs from uploaded source, the Pie ecosystem requires authors to build the DLL themselves — handled through a GitHub Action called PHP Windows Builder, which Shivam worked on. For security reasons Pie deliberately can’t just download and run arbitrary binaries on people’s systems. The 1.5 Release Elizabeth congratulated James on shipping 1.5, a significant release that pulled together several large, closely-related requests. A lot of it grew from working with the author of the mlocati Docker PHP extension installer, mapping out everything Pie does on a whiteboard to see where changes could unlock multiple features at once. The big internal change was fixing how Pie handles locking, bringing it much closer to how Composer manages its own lock file. That one improvement enabled installing multiple extensions at once, making a reinstall of an already-installed extension a no-op, installing reproducibly from a lock file, and the long-requested Pie upgrade command that bumps all your Pie extensions in one go. The other massive chunk of work was the attestation library. It started as a bare-bones OpenSSL-based verification of GitHub attestation certificates — written with help from Tim Düsterhus so people could verify Pi’s authenticity without needing the gh CLI. For 1.5, James ran it against the Sigstore conformance test suite and filled in a huge number of gaps, bringing it close to full conformance on the verification side. That opens the door to the Composer team’s stated interest in authenticating PHP packages down the line. Advice for New Contributors Asked what he’d tell his past self, James kept it simple: just get involved, and always assume good intent. If a maintainer doesn’t respond within a day they’re probably just busy — not ignoring you — and lengthy back-and-forth on a pull request usually reflects a maintainer trying to keep the project maintainable, not nitpicking. He encouraged everyone to open a discussion before sending a PR so effort doesn’t get duplicated — a lesson learned after early contributions collided with work he already had in progress. To help with that, he adds a “maintainer investigating” label to issues he’s actively working on, and leans on issue and PR templates to steer people in the right direction. Elizabeth added that newer coders can find it intimidating to put their work out publicly on GitHub forever, and that both sides benefit from a little grace and a shared social contract. James closed by stressing that the single most helpful contribution is feedback — report even the small things you worked around, because eliminating that friction saves the next developer the same headache, as happened with a recent PCRE2 compile fix on macOS. Links from the show: Pie(php/pie) — GitHub repository, issues & discussions PHP Windows Builder GitHub Action Packagist Extensions Composer attestation library Introduction to PIE Host: Elizabeth Barron Mastodon: @elizabeth@fosstodon.org LinkedIn: elizabethn James Titcumb Mastodon: @asgrim@phpc.social Streams: Youtube Channel Twitch Connect & Hire PHP Architect Website Twitter/X Mastodon Hire PHP Developers Looking to hire PHP developers? Email support@phparch.com – Joe and the team are available for consulting, infrastructure work, Ansible playbooks, and code review.   Music Provided by Epidemic Sound https://www.epidemicsound.com/ Join Us Live Next Week Youtube Channel Got feedback? Join us on Discord at discord.phparch.com The post PHP Foundation Community Hour Podcast 2026.10.08 appeared first on PHP Architect.

  6. Oct 7

    Community Corner Podcast: This Week in PHP Internals with Len Woodward

    In this episode, Scott talks Len Woodward about This Week in PHP Internals and the state of the PHP Internals world. Links: Our Discord – https://discord.gg/aMTxunVx Buy our shirts – https://store.phparch.com/products/community-corner-podcast-t-shirt Len’s Links: X / Twitter: @ProjektGopher — https://x.com/ProjektGopher Bluesky: @projektgopher.com — https://bsky.app/profile/projektgopher.com Mastodon: @ProjektGopher@phpc.social — https://phpc.social/@ProjektGopher Threads: @projektgopher — https://www.threads.com/@projektgopher Instagram: @projektgopher — https://www.instagram.com/projektgopher/ LinkedIn: https://www.linkedin.com/in/projektgopher/ Pinkary: @ProjektGopher — https://pinkary.com/@ProjektGopher Reddit: @ProjektGopher — https://www.reddit.com/user/ProjektGopher/ Dev.to: @projektgopher — https://dev.to/projektgopher YouTube: @ArtisanBuild — https://www.youtube.com/@ArtisanBuild Show: This Week in PHP Internals — https://www.youtube.com/@ArtisanBuild Company: Artisan Build — https://artisan.build Scott’s Links: Website – https://scott.keck-warren.com/ Bluesky – https://bsky.app/profile/scottkeckwarren.bsky.social LinkedIn – https://www.linkedin.com/in/scott-keck-warren-91689810/ Mastodon – https://phpc.social/@scottkeckwarren PHP Architect Social Media: X: https://x.com/phparch Mastodon: https://phparch.social/@phparch Bluesky: https://bsky.app/profile/phparch.com Discord: https://discord.phparch.com Subscribe to our magazine: https://www.phparch.com/subscribe/ Partners This podcast is made a little better thanks to our partners. OurCVEs Your security posture, on autopilot with OurCVEs   CodeRabbit   Cut code review time & bugs in half instantly with CodeRabbit.     PHP Architect Consulting   Your PHP codebase deserves a partner, not a contractor PHP Architect provides long-term technical partnerships for organizations that need senior-level PHP expertise that you can depend on https://www.phparch.com/consulting/ Music provided by Epidemic Sound https://www.epidemicsound.com/ #phpc #php #communityCornerPodcast #podcast #phptek The post Community Corner Podcast: This Week in PHP Internals with Len Woodward appeared first on PHP Architect.

  7. Oct 1

    The PHP Podcast 2026.10.01

    PHP Podcast – October 1, 2026 Hosts: Joe Ferguson, Sara Golemon & Holly Schilling It’s John’s birthday, so naturally he skipped. The PHP Foundation is hiring, 8.6 picks up a surprise RC, and the crew goes deep on ABI promises, deprecation pile-ups, generics, and a childhood firefighter who’s still “a hit.” John’s Birthday and the PHP Foundation’s Hiring Call The episode kicks off with Joe, Sara, and Holly holding down the fort while Eric and John are out — John, as it happens, because it’s his birthday. The crew gleefully encourages everyone in Discord to ping John and wish him a happy birthday (and harass him appropriately), noting that John and Eric were the ones who scheduled the show for the first of the month in the first place. From the celebratory ribbing, Joe pivots to real news: the PHP Foundation has opened its 2027 contractor applications. He walks through what they’re actually looking for — contributors who can read and write C, not just PHP, with experience writing extensions, participating on the internals mailing list, and contributing to open source. The work centers on filling gaps around security, reviewing pull requests, and keeping the language healthy. Holly jokes she’d be the first person fired from the Foundation, and Sara dryly notes that someone has to be first. It’s a warm, self-deprecating opening that sets the tone for a technically dense but very loose episode. PHP 8.6: The Mistag, the Extra RC, and the Release Schedule Joe explains that it has been an unusually slow PHP news week, with most contributors heads-down on 8.6. He admits the team completely forgot to toot the recent release versions on Mastodon — which was notable because one of them was a security release, so listeners should update their PHP versions if they haven’t already. The bigger story is a tagging bug. When branching 8.6 off master into its own branch at the RC1 milestone, the automation (a Docker-based release toolchain descended from scripts Sara once maintained and Mateo later upgraded) mistagged something. The fix was simply bumping to RC2, which means 8.6 now gets five RCs instead of the planned four, since RC1 and RC2 landed in the same week. Barring any game-breaking bugs, RC5 lands November 5th and general release is targeted for November 19th — conveniently dodging US Thanksgiving week. Joe shares how much he’s learned stepping into the release manager role alongside Mateo, especially around ABI compatibility and backwards-incompatibility decisions. Sara confirms that PHP’s long-standing promise lives in the minor version number: as long as that middle number stays fixed, APIs can be added but never removed or changed from, say, a macro to a function pointer. Feature Freezes, Late Deprecations, and the Branch Means Branch Debate The conversation turns to process frustration. Sara makes her position clear: once a version branches, it’s a feature freeze — and feature freeze means feature freeze. She recounts how she drifted away from release management partly because every cycle brought the same surprise, with people acting shocked that time had passed linearly and that a feature freeze was arriving on schedule. Joe observes that most of 8.6’s deprecations landed in the beta stage, which felt late to him. With the alphas largely empty of the substance that defines the release, he questions what incentive anyone has to test an alpha that lacks the deprecations and features that matter. He wishes he’d pushed harder to land those changes earlier. Holly asks the obvious question: why are deprecations so late when the conversation about the next version’s deprecations should already be happening now? Sara offers a theory tied to habits of past release managers doing deprecations in May and June, plus the recurring tendency to dump fifty deprecation votes all at once. Joe confirms this round was among the largest deprecation batches since PHP 7, which Sara attributes partly to people wanting to start the two-phase removal clock as a new major version looms. Generics, Arrays, and What Makes a Major Version The hosts debate what would justify PHP 9. Sara argues PHP doesn’t use SemVer, so majors have historically been reserved for big conceptual shifts — annotations/attributes in 8, the engine rewrite in 7, object reference changes in 5, the Zend Engine in 4 — not just features. The current pipeline, in her view, lacks something substantial enough to warrant a nine. Generics come up as the candidate. Joe thinks generics could eventually bump the version, though not until well after 8.7 ships. Sara wants generics for two reasons: they’re genuinely useful, and they’d finally get people to stop asking for them. Holly draws a firm line: generics should never be retrofitted onto the base array type, which is too strongly optimized to touch. That spirals into a rich aside on arrays. Holly recounts seeing inexplicable ten-percent performance swings just from recompiling identical code. Sara reveals the awkward truth that “array” isn’t really one type but several hiding behind a shared facade, and that for associative data a plain-old-data class with named properties will be faster than array keys. The group also floats value types, structs, and copy-on-write semantics as worthwhile future directions. Voice to Vectors: Eric Mann’s Searchable Audio Archive Joe highlights a short, practical blog post from frequent contributor Eric Mann titled “From Voice to Vectors: Building a Searchable Audio Archive.” The value proposition resonates with anyone at a large company drowning in recorded meetings stashed in S3 — finding the one meeting you missed while on vacation is painful. The post demonstrates using a handful of PHP extensions to transcribe recordings into text, run them through an LLM for inference, and load the results into a search engine so meetings, company history, and the decisions made in them become genuinely searchable. Joe calls it an awesome use case for the workflow. Sara immediately riffs on applying it to her own hundreds of gigabytes of raw GoPro footage, using FFmpeg to strip the audio first — mostly so she can read transcripts and figure out which clips are safe to delete without watching hours of video (while carefully preserving the gold, like old footage of her niece and nephew). Vanilla PHP vs. Framework Identity, and a Trip Down Assembly Lane A Reddit thread asking whether to learn PHP from scratch or jump straight to a framework prompts a thoughtful segment. Joe favors learning vanilla PHP first — it’s how he learned — but recognizes not everyone learns that way, drawing parallels to the Rails era where developers identified as Rails devs more than Ruby devs, and to WordPress developers who wrote PHP without realizing it. Sara pushes back gently on the idea that framework identity is new, citing years of Zend Framework devs and others, while agreeing it’s intensifying as ecosystems grow stronger. Both conclude it’s perfectly fine to specialize down to a framework if that fits your business — Joe notes PHP Architect standardizes on Laravel while still maintaining plenty of non-Laravel client code, some predating Laravel entirely. He reminisces about CakePHP being his first framework before Laravel 4 won out on an eleven-year-old hackerspace RFID member-management app that cheerfully ignores SemVer. The show closes on a nostalgic low-level tangent sparked by a comment about learning pure languages first. Sara recounts learning x86 assembly in high school from a book that included the bytecode, writing her own video driver in Turbo Pascal to enable a 320×200 256-color mode via inline assembly. She and Holly trade register trivia — AX, BX, CX, DX, the accumulator, the X/E/R prefixes for 16/32/64-bit, and the AH/AL byte split — before wrapping with Jurassic Park quotes and calling it an episode. Links from the show: PHP Tek 2027 CFP — Submissions close at the end of the month PHP Tek 2027 — Early bird tickets (April 27–29, Chicago) PHP Architect Store — Socks, shirts, and swag PHP Foundation 2027 Contractor Applications Eric Mann: From Voice to Vectors — Building a Searchable Audio Archive Host: Joe Ferguson Mastodon: @joepferguson@phpc.social PHPArch.me: @svpernova09 Sara Golemon Mastodon: @pollita@phpc.social Holly Schilling Mastodon: @TheCodeLorax@tech.lgbt Streams: Youtube Channel Twitch Connect & Hire PHP Architect Website Twitter/X Mastodon Hire PHP Developers Looking to hire PHP developers? Email support@phparch.com – Joe and the team are available for consulting, infrastructure work, Ansible playbooks, and code review. Partner This podcast is made a little better thanks to our partners OurCVEs   Your security posture, on autopilot with OurCVEs     CodeRabbit   Cut code review time & bugs in half instantly with CodeRabbit.   PHP Architect Consulting Your PHP codebase deserves a partner, not a contractor. PHP Architect provides long-term technical partnerships for organizations that need senior-level PHP expertise that you can depend on. https://www.phparch.com/consulting/   Music Provided by Epidemic Sound https://www.epidemicsound.com/ Join Us Live Next Week Youtube Channel Got feedback? Join us on Discord at discord.phparch.com The post The PHP Podcast 2026.10.01 appeared first on PHP Architect.

  8. Sep 30

    Community Corner Podcast: Pop PHP with Nick Sagona

    In this episode, Scott talks to Nick Sagona about Pop PHP, a PHP framework that removes the “magic” so your code is easier to understand and maintain. Links: Our Discord – https://discord.gg/aMTxunVx Buy our shirts – https://store.phparch.com/products/community-corner-podcast-t-shirt Nick’s Links: X – https://x.com/popphpframework https://www.popphp.org/ Scott’s Links: Website – https://scott.keck-warren.com/ Bluesky – https://bsky.app/profile/scottkeckwarren.bsky.social LinkedIn – https://www.linkedin.com/in/scott-keck-warren-91689810/ Mastodon – https://phpc.social/@scottkeckwarren PHP Architect Social Media: X: https://x.com/phparch Mastodon: https://phparch.social/@phparch Bluesky: https://bsky.app/profile/phparch.com Discord: https://discord.phparch.com Subscribe to our magazine: https://www.phparch.com/subscribe/ Partners This podcast is made a little better thanks to our partners. OurCVEs Your security posture, on autopilot with OurCVEs   CodeRabbit   Cut code review time & bugs in half instantly with CodeRabbit.     PHP Architect Consulting   Your PHP codebase deserves a partner, not a contractor PHP Architect provides long-term technical partnerships for organizations that need senior-level PHP expertise that you can depend on https://www.phparch.com/consulting/ Music provided by Epidemic Sound https://www.epidemicsound.com/ #phpc #php #communityCornerPodcast #podcast #phptek The post Community Corner Podcast: Pop PHP with Nick Sagona appeared first on PHP Architect.

  9. Sep 24

    The PHP Podcast 2026.09.24

    PHP Podcast – September 24, 2026 Hosts: Joe Ferguson, Sara Golemon & Holly Schilling Ian Littman joins the crew to talk PHP community and conferences. Longhorn PHP is three weeks out with a brand new format, the industry keeps shifting under everyone’s feet, and RAM prices remain a personal insult. The hallway track survives it all. Longhorn PHP, Three Weeks Out and Doing Things Differently Ian kicked things off with a rundown of this year’s Longhorn PHP, which lands just three weeks after recording at the Aloft Austin Midtown — the same venue the conference has called home since 2021. Thursday is the workshop and tutorial day, this year built around a full-day session on refactoring and cleaning up code, followed by a free-and-open-to-the-public Merge PHP style meetup that evening. Friday is the main conference day, opening with a keynote from Elizabeth Barron of the PHP Foundation and closing with Eric Mann. In between there are three tracks and fifteen non-keynote talks, plus open spaces later in the day for the topics that didn’t quite make the cut but still deserve a room full of experts to hash them out. The biggest change: instead of the previous Thursday/Friday/Saturday layout, Longhorn is running as a weekday event. The main conference day is still available as a virtual ticket for anyone who can’t make it to Austin, streamed both live and after the fact — though the tutorial day stays in-person because three-hour hybrid workshops are notoriously hard to get right. Streaming, Latency, and PHPC.tv The conversation drifted into how the show and conferences actually reach people. Most listeners consume the podcast as audio weeks or months later, but it also goes out to YouTube, Twitch, and PHPC.tv — a PeerTube instance run by Anne Fellina for the community, where you can watch back catalogs of Merge PHP events and other PHP content without handing your data to Google. Ian explained how Longhorn and PHP Tech run their streams through MUX rather than YouTube or Twitch, because MUX lets them toggle low-latency streaming. With the venue fully hardwired at gigabit, they can drop latency from thirty seconds down to five or ten, getting remote attendees closer to real time. Joe reminisced about broadcast TV and AM radio football feeds being perfectly in sync back in the day — something modern streaming has, ironically, made worse. Sara recalled Sean Coates hauling a satellite dish onto a hotel roof back in 2008 just to get a workable stream out of a venue with dial-up-grade internet. The good news is that serving a gigabit of packets no longer requires heroics, and venue connectivity has steadily improved year over year. A Shifting Industry and the Job Market The crew dug into the state of tech hiring, riffing on an article claiming nearly 29% of open tech positions had been listed for more than 90 days — the so-called “ghost jobs.” They weighed both sides: some listings really are phantom postings, while others reflect companies that post one description to fish for hundreds of thousands of applicants. Joe noted that straight-up “PHP developer” roles have largely vanished, replaced by “back-end,” “full stack,” “cloud,” and “forward deployed engineer” titles. Ian pointed out that on smaller teams, full stack is effectively mandatory now, and the real value a developer brings is increasingly about communication — pushing back on vague requirements that even a stack of servers couldn’t guess at. This naturally spilled into a shared loathing of GraphQL, an aside about SOAP and XPath, and a genuinely grim note on RAM prices. With Samsung doubling a portion of production and rumors of Intel getting back into memory (and maybe even reviving Optane), there was cautious, sarcastic hope that prices might eventually come back down to earth. The Business of Running a Conference Ian got candid about the economics of Longhorn. He walked through the conference’s lineage — replacing Lone Star PHP after its seven-year run, launching in 2018 alongside a wave of regional PHP conferences, weathering COVID by rolling deposits forward with a cooperative venue, and navigating scheduling collisions with Laracon and a local application security conference. The hard numbers were sobering. Attendance dropped roughly 30% going into 2025, landing around 110 in-person attendees in a room built for 150 to 250 — enough to feel empty. The reliable last-minute booking surge that used to push the event from red to black largely failed to materialize, leaving the buffer demolished. Ian is happy to subsidize sponsorship gaps from his own pocket when the room is full, but a downturn in actual attendees is a different signal entirely. That’s why this year scales back to two days: running a two-day event pencils out to about two-thirds the cost of three, Saturday flights are cheaper for a continental US crowd, and the better-attended days make for fuller rooms — which are simply more fun to speak to. Ticket and sponsorship prices even came down slightly rather than climbing with inflation. Why the Human Component Still Matters Ian closed on the thing conferences do that nothing else can: getting people in a room to cut through the noise and share how to build things better. As software output per person grows by leaps and bounds, the value of humans who know what questions to ask — and who can turn a mistake into a shared cautionary tale — has never been higher. Open spaces, borrowed shamelessly from DevOps Days, are his admission that the best conversations won’t always happen from the podium. Sara made the emotional case plainly: her greatest fear is that in three years we lose the human component of problem solving and sharing our love of it. The hallway track, she insisted, is where it’s always at — you can’t replicate that over Zoom or a YouTube “like and subscribe,” and you certainly can’t get the photo of you stabbing your friend in a Viking helmet five years later. To lean into that, the schedule intentionally keeps AI to a single tutorial and single talk — everything else is chosen for shelf life, including a PHP 8.6 talk from a release manager (the release lands about a month after the conference) and Elizabeth’s PHP Foundation session. The rest, Ian figures, will show up organically in the hallway track anyway. Links from the show: Longhorn PHP — Grab an in-person or virtual ticket Longhorn PHP Looking back, and looking forward PHP Tech CFP — Open until the end of October PHP Architect Swag Store — Yes, they have socks Join the PHP Architect Discord Host: Joe Ferguson Mastodon: @joepferguson@phpc.social PHPArch.me: @svpernova09 Sara Golemon Mastodon: @pollita@phpc.social Holly Schilling Mastodon: @TheCodeLorax@tech.lgbt Streams: Youtube Channel Twitch Connect & Hire PHP Architect Website Twitter/X Mastodon Hire PHP Developers Looking to hire PHP developers? Email support@phparch.com – Joe and the team are available for consulting, infrastructure work, Ansible playbooks, and code review. Partner This podcast is made a little better thanks to our partners OurCVEs   Your security posture, on autopilot with OurCVEs     CodeRabbit   Cut code review time & bugs in half instantly with CodeRabbit.   PHP Architect Consulting   Your PHP codebase deserves a partner, not a contractor. PHP Architect provides long-term technical partnerships for organizations that need senior-level PHP expertise that you can depend on.   Music Provided by Epidemic Sound https://www.epidemicsound.com/ Join Us Live Next Week Youtube Channel Got feedback? Join us on Discord at discord.phparch.com The post The PHP Podcast 2026.09.24 appeared first on PHP Architect.

  10. Sep 17

    The PHP Podcast 2026.09.17

    PHP Podcast – September 17, 2026 Hosts: Joe Ferguson, Sara Golemon & John Congdon The September issue shipped 13 days early, a blue elephant named Eric raised eyebrows, PHP 8.6 is racing GTA 6 to a November launch, and a CDN bug taught us all a lesson about cache keys. Also: a lot of World of Warcraft. The September Issue Ships Early (and the Blue Elephant Situation) The September issue of PHP Architect went live on the day of recording, roughly 13 days ahead of the usual schedule. Joe credited a flood of feature articles from the community, columnists turning work in early, and editor Jackie’s first pass for keeping the whole company-wide review process ahead of the game. If you’d like to write for the magazine, they pay real cash in American denominations — just head to phparch.com. Attention quickly turned to the cover, which featured a distinctly blue elephant that the crew agreed had strong “Eric” energy. It came out that this was Jackie’s first attempt at managing the AI-generated cover art, which sparked plenty of teasing about who exactly the human-in-the-loop was. The team also teased upcoming pet shirts and cat socks for the swag store. PHP Foundation Community Hour Launches Joe highlighted the brand-new PHP Foundation Community Hour, a podcast produced by PHP Architect and recorded live on the same network as this show. It has its own dedicated RSS feed alongside the usual channels — find it under the podcasts section on the website. The first episode featured Elizabeth Barron interviewing Matt Stauffer about his blog post on contributing to PHP. Sara praised Matt as a great addition to the Foundation Board, and the crew noted his deep experience getting people to contribute to open source projects, plus his well-known Laravel: Up & Running book. The next episode lands next month with another guest on the theme of contributing to PHP. The PHP Documentary and 8.6 vs. GTA 6 Sara shared that she finally recorded her interview for the upcoming PHP documentary — filmmaker Jeremy came right to her apartment in Lisbon to shoot it. She’s since seen an hour-long cut and teased that it covers a bit of PHP history, the people involved, and the good and bad choices made along the way. Release timing is still fuzzy, somewhere between one and three months out. On the release side, Holly noted developer beta 3 is out with the RC approaching, at which point she’ll start pushing her RFCs out for discussion and voting. Joe revealed the general release date: Thursday, November 19th, PHP 8.6.0 — the very same day a small indie title called Grand Theft Auto 6 arrives. The last of the 8.6 deprecations only just merged, so even beta 3 didn’t have everything yet. The CDN Bug That Cached the Wrong Homepage Joe walked through a genuinely wild bug on php.net’s new CDN. Bot traffic throwing URL-encoded sequences like %2F, %5C, and %3F caused the CDN to normalize those junk paths down to a single forward slash — and then use that as the cache key, overwriting the homepage cache with 301s, 302s, and 404s. The effect was localized to whichever CDN nodes the bot swarm happened to hit, which made it maddening to reproduce. Sara pointed out the CDN was actually doing something reasonable in normalizing the path; the real bug was serving a different page than the one you’d get requesting the root. Joe praised the provider’s support team, who confirmed the issue, escalated it to engineering, and validated his mitigation of disabling caching for those status codes. The conversation broadened into how AI crawlers and more sophisticated, high-unique-IP bot traffic are surfacing long-dormant bugs — and the uncomfortable centralization that comes from everyone hiding behind the same few CDN providers. Foldables, Front-End, and the WoW Detour Holly kicked off a discussion about Apple’s new foldable device and what it means for front-end design. Her core gripe: mobile screens already lose vertical space to status bars, nav bars, ad bars, and tab bars, so a wider aspect ratio can make things worse. She praised Apple for moving native app navigation off to the side to reclaim vertical space, but noted that does nothing for web pages — which she argues most responsive designs still don’t handle well, especially on 16:9 Android tablets. Joe weighed in from a consumer angle, worrying about hinge durability on $2,000 foldables and whether they’ll last the three-to-four years he now expects from a phone. Somewhere in between, the show detoured hard into gaming — WoW Classic “Forever,” the November 4th launch, tank builds, and even the naming of shadow priests — before circling back to remind everyone you can, in fact, write MMOs in PHP. Links from the show: PHP Architect — September issue now live PHP Tech 2027 — Early bird tickets (April 27–29, 2027, Chicago) PHP Tech 2027 CFP — Open until October 31 First PHP Community Hour Podcast Join the live show on Discord Host: Joe Ferguson Mastodon: @joepferguson@phpc.social PHPArch.me: @svpernova09 Sara Golemon Mastodon: @pollita@phpc.social Holly Schilling Mastodon: @TheCodeLorax@tech.lgbt Streams: Youtube Channel Twitch Connect & Hire PHP Architect Website Twitter/X Mastodon Hire PHP Developers Looking to hire PHP developers? Email support@phparch.com – Joe and the team are available for consulting, infrastructure work, Ansible playbooks, and code review. Partner This podcast is made a little better thanks to our partners OurCVEs Your security posture, on autopilot with OurCVEs   CodeRabbit   Cut code review time & bugs in half instantly with CodeRabbit.   PHP Architect Consulting   Your PHP codebase deserves a partner, not a contractor PHP Architect provides long-term technical partnerships for organizations that need senior-level PHP expertise that you can depend on. https://www.phparch.com/consulting/   Music Provided by Epidemic Sound https://www.epidemicsound.com/ Join Us Live Next Week Youtube Channel Got feedback? Join us on Discord at discord.phparch.com The post The PHP Podcast 2026.09.17 appeared first on PHP Architect.

About

The site for PHP professionals, Magazine, Training, Books, Conferences

More From PHP Architect

You Might Also Like