Set session.upload_progress.enabled=0 till next PHP release to block an unlikely RCE vector (CVE-2026-115560). Already recommended for CVE-2026-109619 Wed, keep disabled. Only apps with non-default serialize_handler switching it to "php" at runtime can be affected. #php #phpc

See also the information advisory on PHP website by the PHP security team: php.net/archive/2026.p…

If all the govs shutting down servers for a PHP update, all the hosters & enterprises terrified by the vuln, gave $100k, or just $50k a year to the PHP Foundation, things could look very differently. Go, make your employer sponsor *today* thephp.foundation/sponsor/ #php#phpp#phpcePHPF

We have posted more information about today's security releases, including the sequence of events that led to the discovery, how the PHP security team is improving their processes, and what we need from you to continue this critical work. #php #security thephp.foundation/blog/2026/10/2…

The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.

PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.

If you rely on the volunteer maintained rpms.remirepo.net we urge you to move to distro packages or building from source now, so you can immediately apply updates. The repo will not have updates today.

Follow up: Remi managed to still pull this off, and is signing rpms right now!

To increase PHP representation in open source research, we encourage you to take the 2027 State of Open Source Survey. Perforce, in collaboration with the Open Source Initiative and the Eclipse Foundation, have released the survey and you can take it here: research.net/r/ZXLCRSF

Here's a reminder that our application window for contractors for 2027 closes October 20, 2026! Read more about what we're looking for in our original announcement: thephp.foundation/blog/2026/09/3…

#php

In our latest blog post, @alexdaubois shares how the PHP Security Team operates, how your security reports are triaged, and how you can do your part to help PHP be more secure. thephp.foundation/blog/2026/10/1…

#phpc #security

In our newest blog post, Sebastian Bergmann explores the potential security risks that occur if PHP tools don't consider coding agents in addition to human readers of output. Read more: thephp.foundation/blog/2026/10/0…

#php #phpunit #phpsecurity #security

PIE 1.5 has been released, with new installation and upgrading features to make your life easier. 💙🥧 thephp.foundation/blog/2026/10/0…

#php #pie #pecl

Packagist turns 15 years old and has served more than 200 billion package installs 🎉

A look back at how Composer and Packagist started, 15 years of milestones, 2026 AI growth and what comes next.

blog.packagist.com/15-years-of-pa…

#php #phpc #composerphp

Applications for The PHP Foundation contractors for 2027 are now open! We are looking for help in certain areas but we are open to your ideas as well. Application period ends on October 20, 2026. Apply now! thephp.foundation/blog/2026/09/3…

#phpc #php

We meant to tag @BunnyCDN yesterday and mistakenly tagged the wrong account. Apologies for the confusion. We 💙 you @BunnyCDN!

🐰 Welcome to our Silver Sponsor, @bunnynet! So much of the web bunny.net delivers and secures runs on PHP. We are grateful for their support in keeping PHP strong for the millions of apps built on it. 💙🚀
thephp.foundation/blog/2026/09/2…

Community events are the lifeblood of the PHP ecosystem and how we build trust in an ever-changing world. We are very happy to announce the launch of the Community Events Coalition SIG to help keep these crucial pieces of our community thriving. thephp.foundation/blog/2026/09/2…
#php #phpc

On today's blog, guest author Weilin Du takes a deep dive into PHP floats and the core extensions that can wrangle them. Read more: thephp.foundation/blog/2026/09/1…

#php #phpfloats #phptutorials

If you missed our first PHP Foundation Community Hour, the kind folks at @phparch have already edited and posted the recording! 🤯🧡

Join @ElizabethN and @mattstauffer as they chat about the different ways to contribute to PHP. Listen here: thephpf.simplecast.com/episodes/php-f…

We didn't see enough interest from the community to sustain a formal group, and launching and sustaining a SIG carries real administrative overhead.

So instead, we're pointing interested folks to the Foundation channel on the PHPC Discord. If PQC readiness in PHP is on your mind, this is the place to come talk about it. We'd genuinely like to hear where you think the priorities are.

Strategy Document: thephp.foundation/blog/2026/06/1…
PHPC Discord: discord.phpc.social (find us in the-php-foundation channel)

#php #phpc #pqc #cryptography