Volker Dusch on the PHP RCE Vulnerabilities and Disclosure
Volker Dusch of the PHP Foundation explains how the two critical PHP RCE vulnerabilities were found, fixed, and disclosed, plus the leak and the broken embargo.
Writing on software design, company building, and the aerospace industry.
All of my long-form thoughts on programming, leadership, product design, and more, collected in chronological order.
Decide with Jev: Turn AI Answers into Decisions with PHP Rules
Jev can answer three questions about a draft, but the model should not decide what happens next. In episode 3 of Decide with Jev, we write a small PHP class that turns those answers into one label. When the answers are unclear, the draft goes to a person.
Laravel Read Replicas: Prevent Stale Reads After a Write
Laravel's PreventStaleDatabaseReads middleware keeps a user's reads on the write database after they save, so read replica lag doesn't show them old data.
PHP Security Releases Fix Two Critical RCE Vulnerabilities
PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35 fix two critical vulnerabilities that allow unauthenticated remote code execution. Here's who's at risk and how to update.
Reset Sticky Database Connections Between Laravel Queue Jobs
Laravel 13.36 adds Worker::$flushStickyConnections so queue jobs go back to your read replicas after an earlier job writes to the database.
Skuul: Open-Source School Management Built on Laravel
Skuul 3.0 is an open-source school management app on Laravel 13 and Livewire 4, with per-campus roles, gradebooks, a family portal, and fee tracking.
Screenshot: Capture Images and PDFs with PHP and Laravel
Screenshot captures HTML, Blade views, and web pages as PNG, JPEG, or PDF files with Chrome, then saves them locally or to Laravel filesystem disks.
Prevent Stale Database Reads in Laravel 13.38
Laravel 13.38 adds PreventStaleDatabaseReads middleware and DB::usingWritePdo() so users see their own writes when you read from database replicas.
Critical PHP Security Release Coming Tomorrow (October 21)
The PHP security team will ship a release on October 21, 2026 at 14:00 UTC that fixes two critical vulnerabilities, both rated CVSS 9.2. Plan your upgrade now.
Critical Token Guard Auth Bypass Fixed in Laravel 13.29 and 12.68
A critical auth bypass in Laravel's token API guard let attackers log in as other users on MySQL and MariaDB. Update to 12.68.0 or 13.29.0.