Critical PHP Security Release Coming Tomorrow (October 21)
The PHP security team will ship a release on October 21, 2026 at 14:00 UTC that fixes two critical vulnerabilities, both rated CVSS 9.2. Plan your upgrade now.
Writing on software design, company building, and the aerospace industry.
All of my long-form thoughts on programming, leadership, product design, and more, collected in chronological order.
Critical Token Guard Auth Bypass Fixed in Laravel 13.29 and 12.68
A critical auth bypass in Laravel's token API guard let attackers log in as other users on MySQL and MariaDB. Update to 12.68.0 or 13.29.0.
Run Large PlanetScale Queries in Laravel With DB::olap()
Laravel's new DB::olap() method runs PlanetScale and Vitess queries in OLAP mode to get past the 100,000 row limit, then switches the connection back.
Fluent Rule Builders for All Laravel Validation Rules
Laravel 13.36 adds Rule:: methods for required_with, accepted_if, url, uuid, distinct, and the other string-only validation rules, with IDE autocompletion.
Laravel URL AI Transformer: Extract Structured Data From URLs
Spatie's Laravel URL AI Transformer fetches web pages, runs them through Laravel AI agents, and stores JSON-LD, summaries, or schema-validated data.
Rule Builders for Every Validation Rule in Laravel 13.36
Laravel 13.36 adds Rule:: builders for the remaining validation rules, DB::olap() for PlanetScale, and an option to reset sticky connections between queue jobs.
PHP News: A New Site for PHP Releases, RFCs, and Packages
PHP News is a new site from Eric Barnes and Matt Stauffer covering PHP core, RFCs, releases, packages, and events, plus a free weekly PHP newsletter.
Pause Polling in Background Tabs in Inertia.js v3.9
Inertia.js v3.9 adds a background option to pause polling in hidden tabs, a navigate event type for history restores, and fixes for back navigation.
Look What You Helped Me Build
Puzzle Party isn't a game. It's a place to play the games you're already playing --- Wordle, Connections, Strands, crosswords, and other daily
BashBox: A Sandboxed Bash Interpreter for AI Agents in PHP
BashBox runs AI-generated bash scripts in pure PHP, with a virtual filesystem, execution limits, and opt-in network access. No exec or proc_open calls.