Volker Dusch’s Post

The PHP Foundation just announced a dedicated Ecosystem Security Team - and the timing couldn't be better. AI tools are accelerating vulnerability discovery in open source. That's good news for security researchers. It's also good news for bad actors. PHP, powering a huge chunk of the modern web, is an obvious target. The Foundation's response: a funded "Ecosystem AI Security Engineer in Residence" role, focused on triaging reports, coordinating responsible disclosure, and helping maintainers. This is the kind of initiative the PHP ecosystem has needed for a while. If you're running a PHP product in production, this matters to you - and if you maintain open source PHP packages, Volker is actively looking for collaborators. 👉 https://lnkd.in/dqNZrnsp

Every time you debug complex PHP applications — especially those spread across microservices or modern frameworks — you wish you had better tracing out of the box. Datadog's dd-trace-php tackles this head-on by bringing full APM and distributed tracing into PHP with a native extension. It’s not just another library; under the hood, it compiles with Rust's cargo, ensuring minimal overhead and high fidelity tracing. What’s impressive is the breadth of compatibility: supporting a wide range of PHP versions and frameworks means it fits real-world PHP apps without forcing radical rewrites. The tracer also embraces OpenTracing standards, which makes it easier to integrate with complex, polyglot systems. But this power comes with some setup tradeoffs — you need to manage native extension builds and dependencies like cargo. In production, this means you can finally get detailed insights into PHP request flows and performance bottlenecks with little runtime cost. It’s worth understanding even if you don’t adopt it wholesale — the approach to native extension tracing and OpenTracing compliance reveals what mature PHP observability looks like. How do you currently handle tracing in your PHP apps? Has native extension tracing crossed your radar yet?

The average Laravel app pulls 80 to 120 Composer packages. Over 400 PHP vulnerabilities were disclosed in 2025 alone. composer audit checks your composer.lock against the PHP Security Advisories Database and tells you exactly which packages have known CVEs, what versions are affected, and what to upgrade to. It takes 5 seconds to run. The real power is adding it to your CI/CD pipeline. One line in your GitHub Actions config blocks deploys with vulnerable dependencies. The article covers targeted update strategies, handling breaking version constraints, and JSON output for automation. https://lnkd.in/evFXkEmH #PHP #Laravel #SupplyChainSecurity #DevSecOps

Have big hopes for what the ecosystem security initiative at The PHP Foundation can accomplish by bringing the entire PHP ecosystem together to collaborate on better security posture in open-source projects, better tooling for analyzing the security of PHP projects, but also tooling to automatically verify the veracity of vulnerability reports. It was an honor to help put this together at the PHP Foundation and secure funding from Alpha-Omega / The Linux Foundation for Volker Dusch to head this group for the first 6 months. We'll certainly do our best with Packagist Conductors from the Composer & Packagist side to support this endeavor and already got to experience a little bit of a preview of the rapid response aspect of this new role with our GitHub Actions incident last week. Good luck, Volker! #php #phpc #supplychainsecurity

GLPI is a rare example of a PHP app that handles the full complexity of ITIL-aligned IT service management — modular, self-hosted, and battle-tested. Managing Service Asset, Incident, Change, Knowledge, and even DCIM in one platform is no small feat, especially in PHP. GLPI does this by leaning heavily on a plugin architecture that keeps core stable while letting users extend features without breaking everything. Under the hood, it’s a web of complex asset relationships managed via MariaDB/MySQL with careful database normalization and indexing strategies. This ensures performance doesn’t tank even when tracking thousands of assets and incidents. The codebase enforces PHP 8.2+ and specific extensions like bcmath, curl, gd, and openssl — a strict but pragmatic baseline that balances modern PHP features with real-world deployability. What stands out is their pragmatic approach to modularity and dependency management. Instead of a monolith, GLPI’s plugins isolate features, making upgrades and customization less risky. For anyone building large-scale PHP apps that need to juggle complexity without turning into a maintenance nightmare, GLPI offers lessons worth studying. How do you balance extensibility with stability in your PHP projects, especially when the feature set grows rapidly?

Default PHP configurations crash around 50 concurrent users. Properly tuned settings routinely handle 200+ users on the same hardware. This guide covers memory limits, OPcache optimization, and security hardening that can reduce response times by 40-60%. Essential reading for anyone running high-traffic PHP applications on VPS hosting. #PHP #VPSHosting #WebPerformance #ServerOptimization Learn More: https://lnkd.in/g4tNmCdv

Thanks Laravel News for highlighting this. Alpha-Omega is glad to support The PHP Foundation in launching their new Ecosystem Security Team! PHP powers a massive portion of the modern web, and empowering maintainers with better security tooling and triage support is a critical mission. Great to have Volker Dusch leading the charge! 👇🛡️ 

You probably use the standard Markdown libraries. But you probably never heard of the native mdparser extension. This extension by Ilia Alshanetsky is a hidden gem for PHP developers. It brings the speed of the official C library directly into your code. 1. Why this extension is unknown It is a specialized tool for high-performance needs. - Most developers rely on pure PHP libraries by default. - It requires a manual installation of the native library. - It stays under the radar of the general community. 2. The performance advantage Native extensions are much faster than traditional PHP code. - It parses complex GitHub Flavored Markdown instantly. - It uses significantly less memory for large files. - It provides the same rendering quality as GitHub. 3. The best way to implement it You do not have to choose between speed and stability. - You can detect if the extension is active on your system. - You can use PHP-FFI as a reliable backup when it is missing. - This creates a tool that is both fast and universal. Using this extension is the secret to building extremely fast static site generators. I have a dedicated post about PHP-FFI in another post if you want to learn more. For more information: https://lnkd.in/e344UrJ4 Had you ever heard of mdparser before today? Please share your thoughts on native extensions in the comments.

Most PHP teams don't know this, but Packagist versions aren't immutable. The registry mirrors Git tags. Tags can be force-pushed. Which means someone can replace what's behind a version number without changing the version number, and your composer install happily pulls the new code. That's exactly what happened on April 30. Attackers force-pushed a malicious commit behind the existing intercom/intercom-php@5.0.2 tag. 20.7M lifetime installs, official Intercom client. The compromise didn't need any of that to fail. The payload registered itself as a Composer plugin and ran on post-install. No imports needed. Stole GitHub tokens, npm tokens, SSH keys, Docker creds, Kubernetes config, Vault tokens, .env files, and actively queried AWS Secrets Manager, Azure Key Vault and GCP Secret Manager directly. Then used the stolen npm tokens to republish other packages with the same install hook. Same pattern as Axios on npm in March. Different ecosystem, same blind spot: developers and CI pulling directly from public registries with no policy layer in between. The 2025 stat that keeps mattering: 99% of malicious npm packages get caught within 72 hours. We don't have the Packagist equivalent yet, but the principle holds. A 3-day cooldown would have blocked this one too. Curious what PHP teams are actually doing about Packagist specifically. The npm side gets a lot of airtime, this side gets almost none. https://lnkd.in/eArTim3J

Things Go Programming Language Does That PHP Developers Wish They Had PHP has powered the web for decades. From small personal blogs to massive enterprise platforms, PHP earned its place by being practical, beginner-friendly, and incredibly productive. But then many PHP developers discover Go (or Golang), and something interesting happens: Go doesn’t try to be wondrous. It doesn’t try to be clever. Instead, it focuses on simplicity, performance, concurrency, and developer efficiency. This article isn’t about replacing PHP. It’s about exploring why Go feels refreshing for backend developers — especially those coming from the PHP ecosystem. If you’re researching Golang for PHP developers, comparing PHP vs Go, or trying to learn Go after PHP, this guide is for you. Read article: https://lnkd.in/dHz5fUbV