Guide pour se protéger de l’arsenal techno-sécuritaire utilisé par l’État et sa police ! À partager massivement : onestla.tech/publications...

L'appel

Appel des travailleuses et travailleurs du numérique pour une autre réforme des retraites

onestla.tech

Depuis plus de 15 ans, nous concevons des architectures robustes et open source. Aujourd'hui, nous lançons @tilia.coop, notre nouvelle structure dédiée à l'IA sur mesure ! Découvrez notre démarche sur notre blog, et suivez Tilia sur les réseaux ! les-tilleuls.coop/blog/decouvr...

Les-Tilleuls.coop annonce le lancement de Tilia, son offre d’accompagnement sur mesure en intelligence artificielle | Les-Tilleuls.coop

Découvrez Tilia, propulsée par Les-Tilleuls.coop. Profitez de 15 ans d'expertise web pour intégrer l'IA sur mesure dans vos outils.

les-tilleuls.coop

Talks by @dunglas.dev, @soyuka.me, and Marion Hurteau given at the #APIPlatformCon 2026 are now available on YouTube: www.youtube.com/playlist?lis...

🐘 FrankenPHP 1.13 is out! Caddy 2.11.7 (Slowloris protection, url_pattern matcher, RFC 10036 Incremental header), Mercure 1.0 built in, and config reloads validated before they go live. 5 security fixes, 2 rated high. Please upgrade.

My pair programming partner of the past 13 years passed away today. 😢 Godspeed, my dear George.

🥳 Laravel 13 will have native support for Mercure!! 🪽🤝 github.com/laravel/fram...

[13.x] Add a Mercure broadcast driver by dunglas · Pull Request #61474 · laravel/framework

As discussed with @taylorotwell and the team, here the PR introducing support for the upcoming 1.0 version of the Mercure real-time protocol for Broadcast. Companion PR for Echo: laravel/echo#549 M...

github.com

The hype is real! I’m so excited to see such an incredible mix of communities coming together next week in my hometown: maintainers of Laravel, Symfony, Caddy, PHP core, and of course API Platform will be there! api-platform.com/con/2026/

Pour démarrer la semaine, lisez l'interview de @dunglas.dev : il nous parle notamment de la genèse mouvementée de FrankenPHP et tease Mercure 1.0, fruit de 5 ans de travail, qui sera sorti à l'heure où Kévin donnera son talk et animera son atelier au Forum PHP 2026 ! buff.ly/26Zgz6w

Marx, Keynes, and A.I. www.unpopularfront.news/p/marx-keyne...

Marx, Keynes, and A.I.

Coercive Competition and the Future of Work

unpopularfront.news

🚀 Mercure 1.0 alpha is here! The biggest release in the project’s history brings: 🎯 New matcher system built on top of the WHATWG URL Pattern ⚙️ Revamped authorization mechanism using OAuth 2.0 Rich Authorization Requests 🛠️ Brand-new UI debugger and dev playground 🔒 Security hardening

This happened because the API was flawed from the start. It will keep happening unless you secure your codebase. Fix your endpoints now, or contact @les-tilleuls.coop and we'll do it for you! www.abc.net.au/news/2026-08...

How a simple request for AI to book a gym class exposed a major threat

When Andrew asked his AI personal assistant to book him a spot in a gym class, he had no idea he would accidentally initiate an autonomous cyber attack.

abc.net.au

Tried GitHub's new syntactic sugar for parallel action steps on FrankenPHP's CI. Gains were minimal for our use case, and it currently breaks actionlint (unsupported parallel keyword). Shelved for now: github.com/php/frankenp...

ci: run independent steps in parallel by dunglas · Pull Request #2597 · php/frankenphp

GitHub Actions added native parallel steps: https://github.blog/changelog/2026-06-25-actions-steps-can-now-be-run-in-parallel/ Grouped independent steps that were previously run sequentially for no...

github.com

If you want to test-drive Drupal 11 on #FrankenPHP - you can use this repo to quickly spin it up ⚡ github.com/dunglas/fran... @dunglas.dev @marko.bluesky.druid.fi

GitHub - dunglas/frankenphp-drupal: Drupal on FrankenPHP

Drupal on FrankenPHP. Contribute to dunglas/frankenphp-drupal development by creating an account on GitHub.

github.com

This is an absolute disgrace. We urgently need a system capable of preventing such ecocide. AI could benefit humanity, but not under capitalism. This system will kill us all. www.nytimes.com/2026/08/08/c...

New Amazon Data Center Is Set to Have the Most Polluting Power Plant in the U.S.

The tech giant is investing in the natural-gas-burning power plant as part of a huge data center in Texas, even as it pledges to honor climate commitments.

nytimes.com

FrankenPHP 1.12.7 fixes a bug where output written after fastcgi_finish_request() got silently dropped in classic mode, and killed the rest of the script execution right there. If you use that pattern for background cleanup, go upgrade. github.com/php/frankenp...

Release v1.12.7 · php/frankenphp

FrankenPHP 1.12.7 fixes a bug where output written after fastcgi_finish_request()/frankenphp_finish_request() was silently discarded in classic (non-worker) mode: with the default ignore_user_abort...

github.com

"The AI Compass: 15 questions. Where do you actually land on AI?" bambamramfan.github.io/ai-compass/

Ignore the propaganda in that Qwen ad for a second. The core question for the Left remains valid: boycotting AI is a dead end. AI and robotics give us the tools to build the work-free, post-scarcity utopia envisioned by Lafargue and Bookchin.

"Face à l'IA, le refus moral et le boycott constituent une défaite stratégique. Sortir du purisme pour contester le contrôle politique et social de cette technologie est un impératif." blogs.mediapart.fr/paul-bartali...

Face à l'IA, dépasser l'impuissance

Face à l'IA, le refus moral et le boycott constituent une défaite stratégique. Sortir du purisme pour contester le contrôle politique et social de cette technologie est un impératif.

blogs.mediapart.fr

Just improved Caddy performance by fixing header casing on the hot path! 🚀 When using Go's net/http, make sure to use canonical HTTP header casing (e.g. Content-Type instead of content-type). Non-canonical keys trigger string formatting and allocations on every lookup. github.com/caddyserver/...

caddyhttp: use canonical header key casing to avoid re-canonicalization by dunglas · Pull Request #7911 · caddyserver/caddy

Summary http.Header.Get/Set re-canonicalize the passed key and allocate a new string whenever it isn't already in canonical MIME header form. Three call sites in the codebase were passing non-c...

github.com

Carré Bompard sur l'IA ! www.youtube.com/watch?v=wTTY...

L'HOMME DE L'OMBRE DE MÉLENCHON : MANUEL BOMPARD RÉVÈLE LA STRATÉGIE DE LFI

Aujourd'hui dans "Ils font Marseille", nous recevons Manuel Bompard, député de la 4e circonscription des Bouches-du-Rhône et coordinateur national de La France Insoumise. De son parcours atypique…

youtube.com

Isolate deprecated code in dedicated files behind dedicated build tags. Years later you delete ~1,700 lines in one PR, zero issues. Thanks, past-me. github.com/dunglas/merc...

FrankenPHP 1.12.5 is a security release. Upgrade if you run the official Docker images or the session extension as a shared module. Fixed: the default Docker welcome page ran phpinfo() (env vars, php.ini, system paths, all exposed). Now a static page with nothing to leak.

🔒 Vulcain 1.4.2 is out, a security release. Fixes 3 vulnerabilities in Preload/Fields directive handling: • High: quadratic response rebuild (DoS) • Medium: unbounded JSON-pointer recursion • Low: HTTP/2 push-counter race Upgrade: github.com/dunglas/vulc...

Release v1.4.2 · dunglas/vulcain

Security release fixing three vulnerabilities in request-directive handling, all reported by Alexandre Daubois (Les-Tilleuls.coop). Users on 1.4.1 and earlier should upgrade. 🔒 Security Fixes High...

github.com

We are incredibly proud to have @laravel.com support as a Gold sponsor for #APIPlatformCon 2026! The community is gathering in full force, and with Jeremy Nikolic's upcoming talk on the schedule, the energy in Lille is going to be unmatched. Join them now: api-platform.com/con/2026/

The countdown to #APIPlatformCon is on! Incredible speakers, deep-tech talks, and a surprise announcement during my opening keynote. If you are building real-time apps or exploring AI integrations, you need to be in the room. Secure your spot before tickets sell out: 👉 api-platform.com/con/2026/

Introducing prompt-mac: Turn a fresh Mac into an agent-first dev powerhouse with one command 🚄 github.com/dunglas/prom...

GitHub - dunglas/prompt-mac: one-shot, AI-first macOS setup for Apple Silicon

one-shot, AI-first macOS setup for Apple Silicon. Contribute to dunglas/prompt-mac development by creating an account on GitHub.

github.com

📢 #APIPlatformCon speaker reveal! Meet Yohan Giarelli who will demonstrate next September a fun "proof of concept" project: using a tech stack of PHP, Symfony, and Mercure to remotely unlock parcel lockers from a PWA. Don't miss out: api-platform.com/con/2026/tic...

@dunglas.dev and I just published a preprint on exposing Hypermedia APIs to LLM agents via a Dynamic Gateway Architecture Thanks @p20n.w3c.social.ap.brid.gy for depositing this work hal.science/hal-05630480

Let's face it: coding agents work pretty well these days, and Claude Code is the leader. That's why I recently patched Symfony Docker to support it out of the box.

🔒 API Platform CVE-2026-49858: JSON:API & HAL normalizers cached components across users on long-running runtimes (FrankenPHP, RoadRunner, Swoole). Patched in 4.1.29 / 4.2.25 / 4.3.8 — upgrade now. github.com/api-platform...

Cross-user attribute leak in JSON:API and HAL item normalizers due to missing isCacheKeySafe gate

### Impact `#[ApiProperty(security: ...)]` is evaluated per request to decide whether a property is exposed. The `componentsCache` arrays in `ApiPlatform\JsonApi\Serializer\ItemNormalizer` and `Ap...

github.com