Sécurité de l'interpréteur PHP, rapports de faille, Ecosystem Security Team... Dans l'interview du jour, @alexdaubois.bsky.social parle de son rôle à la PHP Foundation et pourquoi l'humain reste indispensable face aux rapports de sécurité. Lisez-la, venez l'écouter au Forum PHP 2026. buff.ly/B4qXBU9

If you’re using Vulcain, update now! New security release is here 🔐

Kévin Dunglas@dunglas.dev · 2mo ago

🔒 Vulcain 1.4.2 is out, a security release. Fixes 3 vulnerabilities in Preload/Fields directive handling: • High: quadratic response rebuild (DoS) • Medium: unbounded JSON-pointer recursion • Low: HTTP/2 push-counter race Upgrade: github.com/dunglas/vulc...

Une immense fierté pour notre coopérative : en complément de ses fonctions de CTO chez nous, @alexdaubois.bsky.social a rejoint @thephpf.bsky.social en tant que développeur contractuel spécialisé en sécurité. Découvrez notre communiqué : les-tilleuls.coop/blog/securit...

Sécurité PHP : Alexandre Daubois rejoint la PHP Foundation pour renforcer le cœur du langage | Les-Tilleuls.coop

Face à l'afflux de rapports de sécurité IA, notre CTO Alexandre Daubois rejoint la PHP Foundation pour renforcer l'équipe de core dev.

les-tilleuls.coop

To further prioritize the handling of security reports for the PHP language, we are thrilled to add @alexdaubois.bsky.social as a part-time addition to our team of contractors. Alex brings a wealth of experience. Welcome, Alex! thephp.foundation/blog/2026/0...

Welcoming Alexandre Daubois to The PHP Foundation

Alexandre Daubois joins The PHP Foundation as a part-time security contractor.

thephp.foundation

Un autre événement à ne pas manquer cet automne : nous serons les 8 et 9 octobre prochains au #ForumPHP en tant que sponsor Argent ! Retrouvez-nous sur notre stand ainsi que sur scène avec les interventions de @soyuka.me, @alexdaubois.bsky.social et @dunglas.dev. Vous y serez ?

Très heureux d'annoncer ma participation au #ForumPHP 2026 🇫🇷🐘 Je serai présent début octobre a l’évènement de @afup.org pour vous montrer ce qui se passe au sein de l'Ecosystem Security Team de @thephpf.bsky.social que j'ai eu la chance de rejoindre day one 💜 👉 event.afup.org/forum-php-20...

@dunglas.dev and I just published a preprint on exposing Hypermedia APIs to LLM agents via a Dynamic Gateway Architecture Thanks @p20n.w3c.social.ap.brid.gy for depositing this work hal.science/hal-05630480

OPcache doesn't just cache opcodes. It runs a real compiler optimizer on them. SSA form, dead code elimination, type inference. Yes, in #PHP 👇

ZTS (Zend Thread Safety): the #PHP layer most devs never see. In ZTS mode, every global becomes thread-local. Each thread gets its own executor, compiler, module globals. Full isolation. FPM doesn't need it: direct C globals, fastest path. FrankenPHP does: it runs PHP inside Go threads. 🧵

Generators vs Fibers in #PHP: both suspend execution, totally different mechanism. Generator: saves ONE execute_data frame. Yield pauses it, ->next() resumes. One level deep. Fiber: saves the ENTIRE call stack. Generator, stackless coroutine. Fiber, stackful coroutine.

#PHP has inline caches and almost nobody knows 👀 $obj->name: first access does a hash lookup. But the engine stores the result offset in a "cache slot" embedded in the opcode. Next time, same class? Direct read. No lookup. Works for methods, constants, type checks too.

Traits in #PHP aren't delegated. They're literally memcpy'd into the class. The engine copies each zend_function entry into the consuming class's function_table. "insteadof" picks the winner. "as" creates an alias to the same oparray. After resolution? The trait is gone. Zero runtime cost.

Let's have a look at this #PHP RFC: Friends, by Daniel Scherzer. A class could grant select OTHER classes access to its private and protected members, without making anything public. Let's see what's actually on the table. 🧵

#PHP type juggling auth bypass: if ($input == $hash) with a hash starting "0e" + digits: PHP reads it as 0 (scientific notation). MD5("240610708") = "0e462097..." = 0. MD5("QNKCDZO") = "0e830400..." = 0. 0 == 0: auth bypassed. Fix: === or hash_equals(). Never == for security.

Moins d'une semaine avant notre API Platform Meetup à Lyon ! Au programme : 🎙️Alexandre Noziere avec "Marier API Platform et un ORM non-Doctrine : le bridge Propel de Thelia 3" 🎙️ @alexdaubois.bsky.social avec le sujet "FrankenPHP: Le Serveur PHP Sous Stéroïdes" www.meetup.com/fr-fr/api-pl...

API Platform Meetup @Lyon, jeu. 4 juin 2026, 19:00 | Meetup

Rejoignez-nous pour une soirée exclusive dédiée à **API Platform**. En compagnie de nos experts, venez découvrir les dernières avancées de l'écosystème et la façon dont il

meetup.com

Timing attacks: === stops at first different byte. Attacker measures response time to guess secrets char by char. hash_equals() compares ALL bytes. Constant time. Go: crypto/subtle.ConstantTimeCompare() Comparing secrets with ===? You leak info through time.

Retrouvez-nous ce soir dans nos locaux de Lyon pour l'Apéro Web mensuel ! Au programme : échanges passionnants et des talks par @alexdaubois.bsky.social et Alexis Guerre. On a hâte de vous accueillir ! Inscriptions ici : www.meetup.com/fr-FR/apero-...

Apéro Web Lyon - Mai 2026, jeu. 28 mai 2026, 19:00 | Meetup

📢 Fin **mai,** nous aborderons la cybersécurité sur 2 sujets, chaleureusement accueillis par **Les-Tilleuls.coop** ! L'événement est toujours **gratuit, sur place ou sur

meetup.com

PHP compiles your code in 2 passes. And honestly, most devs never look past "it just runs". Here's what really happens between your file and the VM 👇

$GLOBALS used to introduce aliasing complexity in the engine. Because it could reference local variables, Zend had to handle indirect entries (IS_INDIRECT) in certain array access paths. #PHP 8.1 restricted $GLOBALS writes, removing that edge case and simplifying hot paths.

#PHP fibers don't use threads: they use stack swapping. Fiber::suspend() saves the current C stack and VM state, then jumps back to the parent. Fiber::resume() restores everything and continues exactly where you left off. Revolt and Amp are built entirely on this primitive.

#Golang's scheduler has a magic number: 61. Every 61 goroutine schedules, the runtime checks the global queue instead of the local one. Why 61? It's prime, so it never aligns with any other periodic check. If it were 64, you'd get pathological starvation patterns, and 61 breaks every harmonic.

One underrated attack vector is your lockfile. 🔐 composer.lock, package-lock.json, go.sum... They all pin versions, but the upstream registry can still ship a malicious 1.2.3 if a maintainer's account gets compromised. 🧵

unserialize() in #PHP isn't just "unsafe with user input." It's a remote code execution primitive. Here's the full attack chain 👇

Here we go for the third talk of the week! This time at home, in Lyon, France 🇫🇷 for the @afup.org Day. Jetlag's going to hit hard but it's an event you can't miss. We'll talk about #JsonPath in #PHP!

Thank you so much for having me #PHPTek @phparch.com! First talk in the USA for me, and I'm getting back in September in San Francisco 🇺🇸 Had a blast to talk about #FrankenPHP, cybersecurity and meeting people from @thephpf.bsky.social and the ecosystem 🐘💜

A huge thank you to @fabien.potencier.org @nicolasgrekas.bsky.social @alexdaubois.bsky.social @jderusse.bsky.social @javiereguiluz.bsky.social and all the #Symfony Core Team involved in triaging the security reports, fixing the bugs, reviewing the PRs and releasing the patched versions.

Fabien Potencier@fabien.potencier.org · 4mo ago

During the last few weeks, the #Symfony core team has been hard at work fixing a long list of vulnerabilities for both #Symfony and #Twig. Today, we're publishing that work in the biggest security patch releases ever. Bare with us and wish us luck 🍀

During the last few weeks, the #Symfony core team has been hard at work fixing a long list of vulnerabilities for both #Symfony and #Twig. Today, we're publishing that work in the biggest security patch releases ever. Bare with us and wish us luck 🍀

#PHP attributes look like decorators... end of the resemblance 😄 Attributes are pure metadata, stored in the class definition. They do *nothing* on their own. A framework must call ReflectionClass::getAttributes() and instantiate them to make anything happen. 🧵

Named arguments in #PHP 8.0+ are resolved at compile time. Not runtime. The compiler maps argument names to parameter positions in the function signature. The opcodes use positional slots. $name → position #2 → SEND_VAL to slot #2. One exception... 🧵

It's been quite some time since I visited the US! 🇺🇸 Finishing up details for my talks at @phptek (phptek.io). Let's talk about #FrankenPHP and #cybersecurity! See you tomorrow 🥳