The Dev Dispatch

PHP · Releases

Laravel 13.38 tightens consistency across app data

Laravel 13.38.0 adds a session-based two-second fallback to the write connection after a database write and introduces DB::usingWritePdo() for relationship queries that need fresh data. The release accepts floats in Rule::unique() conditions and releases earlier chunks during lazy iteration. Scheduled-job lock cleanup and further Eloquent, SQLite, routing, and queue fixes complete the update.

Medium · Laravel · Oct 22, 2026 curated by Heiko

→ continued: summary & source

PHP · Security

Report attributes two critical PHP flaws to AI research

An October Medium report attributes two alleged critical PHP vulnerabilities, CVE-2026–109618 and CVE-2026–109619, to research involving Wiz and OpenAI’s GPT-5.6 Sol. It claims a 9.2 severity score, unauthenticated remot…

Medium · PHP · Oct 22, 2026 curated by Giselle

PHP · Security

OpenAI’s Codex skills check whether a site exposes a risky PHP version

OpenAI has released a checker for Codex that tests whether a website publicly reveals a PHP version within the affected range. The phpcheck-url skill works from a URL, and phpcheck-server validates the local installation…

Xataka · Oct 21, 2026 curated by Sönke

PHP · Ecosystem

frameworks, tooling & runtime all articles →

PHP · Security

Wazuh rules watch for post-exploitation after critical PHP flaws

PHP’s emergency fixes on October 21, 2026 address CVE-2026-109618 and CVE-2026-109619, two unauthenticated remote-code-execution flaws rated CVSS 9.2. A community Wazuh deployment uses process samplin…

Medium · PHP · Oct 21, 2026 curated by Georg

PHP · RFC Watch

PHP pattern matching debate turns on keys and ints

Kevin Lopez has raised two semantic issues in the draft PHP Pattern Matching RFC. Array patterns should distinguish a missing key from an explicit null and use array_key_exists(). Integer patterns and…

PHP Internals ([RFC]/[VOTE]) · Oct 22, 2026 curated by Sönke

PHP · Security

PHP crisis shows how AI accelerates attacks on known flaws

OpenAI, Google and other AI labs are using frontier models to locate PHP vulnerabilities, build exploits and check proposed fixes. The current crisis involves structural flaws that may enable unauthen…

Xataka · Oct 22, 2026 curated by Sönke

KAI · The Editorial

long-form pieces by Kai — opinion, pushback welcome all articles →

The Editorial

PHP2Shell proves your interpreter belongs in the repo, not the host panel

The PHP2Shell fixes shipped on October 21, and plenty of teams still can't say which PHP binary answered their last request. Kai argues that the interpreter is your most important dependency and deserves the same treatment as composer.lock: declared, reviewable, provable. He also takes on the managed-hosting and distro…

An editorial by Kai · Nov 4, 2026

AI · The Model Desk

models, agents & local inference all articles →

AI · Security

ConnectWise breach exposed thousands of customer environments

Microsoft says China-aligned hackers used stolen ConnectWise cloud-backup credentials to target about 2,250 organizations. AI agents running the open-source ARTEX framework generated nearly 3,000 logi…

TechCrunch (AI) · Oct 22, 2026 curated by Sönke

AI · Releases

Mistral AI opens public preview for 1.05T-parameter Large 4

Mistral AI opened a public preview of Mistral Large 4 on October 6, 2026. The open-weight multimodal model uses a granular Mixture-of-Experts design with 52 billion active parameters, 1.05 trillion in…

Hacker News (AI, ≥100 P.) · Oct 21, 2026 curated by Sönke

AI · Releases

Anthropic links company stake to new benefit fund

Anthropic plans to place part of its shares in the new Anthropic Public Benefit Fund. The fund has a structure that increases its stake as the company expands. Anthropic published the announcement on …

Anthropic News (Sitemap-Diff) · Oct 20, 2026 curated by Sönke

DEV · Briefs

beyond the elephpant, kept short all articles →

DEV · Security

GitLab ships patches for CVSS-10 remote-code flaw

GitLab has released patches for CE and EE branches 19.5, 19.4, 19.3, 19.2, 19.1, 19.0 and 18.11. The updates fix 12 vulnerabilities, including CVE-2026-110264, …

heise Developer · Oct 22, 2026 curated by Georg

DEV · Security

Node.js v26.12.1 ships with a security focus

The Node.js project has published version v26.12.1 in the 26.x line. The release is marked as a security update. The supplied notice gives no vulnerability iden…

Node.js Releases (dist) · Oct 21, 2026 curated by Sönke

DEV · Security

IT Security Engineer Southminster · Mayfair
Software Engineer Southminster · Sydney
Software Engineer Scrutautomation · Berlin

Laravel 13.38 tightens consistency across app data

Report attributes two critical PHP flaws to AI research

OpenAI’s Codex skills check whether a site exposes a risky PHP version

PHP · Ecosystem

Wazuh rules watch for post-exploitation after critical PHP flaws

PHP pattern matching debate turns on keys and ints

PHP crisis shows how AI accelerates attacks on known flaws

KAI · The Editorial

PHP2Shell proves your interpreter belongs in the repo, not the host panel

AI · The Model Desk

ConnectWise breach exposed thousands of customer environments

Mistral AI opens public preview for 1.05T-parameter Large 4

Anthropic links company stake to new benefit fund

DEV · Briefs

GitLab ships patches for CVSS-10 remote-code flaw

Node.js v26.12.1 ships with a security focus

Security updates land for Node.js 24 and 22 LTS

+ · The Back Pages

JOBS · PHP Jobs