--- title: Highlights | daily.dev description: daily.dev is the easiest way to stay updated on the latest programming news. Get the best content from the top tech publications on any topic you want. canonical: https://daily.dev/highlights/php twitter:card: summary_large_image twitter:site: @dailydotdev og:url: https://daily.dev/highlights/php og:site_name: daily.dev og:title: Highlights | daily.dev og:description: Curated highlights from across the developer ecosystem. Stay on top of the most important stories, releases, and discussions. og:type: website og:image: https://media.daily.dev/image/upload/s--VAY5ToZt--/f_auto/v1724209435/public/daily.dev%20-%20open%20graph --- Slim 4.15.3 patches route parameter constraint bypass vulnerability12h ago Laravel ships first-party language server for any LSP-compatible editor13h ago WordPress narrows vulnerability disclosure scope to high-impact privilege escalations17h ago 13 malicious Packagist themes deliver iOS spyware stealing crypto wallet seeds39h ago Laravel Scout adds semantic and hybrid vector search with pg\_vector and Turbopuffer40h ago Symfony 6.4, 7.4 and 8.1 ship coordinated security hardening releases56h ago PHP 8.6 RFC passes to allow default values on readonly properties59h ago GiveWP WordPress donation plugin gets max-severity RCE patch after prior breach5d ago Laravel starter kits switch to Vite+ unified toolchain, dropping ESLint and Prettier5d ago WordPress launches Core Security Initiative to handle AI-driven surge in vulnerability reports5d ago Critical RCE chain in Avada WordPress theme patched after agentic exploit discovery6d ago Swoole open-sources TypePHP, an ahead-of-time compiler that compiles PHP to native binaries7d ago Attackers exploit miniOrange WordPress plugin auth bypass to forge admin sessionsAug 24 PHP 8.6 hits soft feature freeze with partial application and clamp() locked inAug 22 PHP Foundation launches ecosystem security team backed by Alpha-Omega grantAug 21 Laracon US 2026 brings Laravel LSP, Pest 5, and major Laravel Cloud updatesAug 21 Critical Elementor Pro file upload flaw allows unauthenticated RCE on WordPress sitesAug 20 WordPress 7.1 ships with collaboration features, new blocks and expanded image format supportAug 20 Laravel 13.26 ships read-through filesystem driver, debounced listeners and Queue::forward()Aug 19 Laravel 13.26 ships lazy filesystem migration driver with a file resurrection bugAug 19 StopAndProtect campaign uses 2,000 hacked WordPress sites to hit 6,000+ victimsAug 18 NativePHP v4 compiles Blade components into native SwiftUI and Jetpack Compose viewsAug 17 Symfony releases official LSP server with Twig, YAML and DI-aware toolingAug 17 Laravel 13.25 adds global queue pausing and new artisan dev terminal UIAug 13 Mercure 1.0 alpha ships with IETF Internet-Draft protocol and OAuth 2.0 authorizationAug 11 BdThemes supply chain hack creates rogue WordPress admins across 100,000+ installsAug 10 Symfony 8.1.4 ships with 50+ bug fixes across core componentsAug 07 Twig 4.0 overhauls macro system with strict argument handling and breaking changesAug 06 WordPress 7.1 enters release candidate phaseAug 05 Laravel 13.24 patches SQL injection in PostgreSQL JSON path and quadratic wildcard validation bugAug 05 Advanced Custom Fields 6.8.7 patches multiple security vulnerabilitiesAug 04 Symfony UX 3.4.0 ships Bootstrap 5.3 kit and stable Translator componentAug 04 WordPress 7.1 adds unified public exposure flag for the Abilities APIAug 04 PHP 8.6 adds partial function application, Polling API and clamp() ahead of November releaseAug 04 WordPress 7.1 moves post list table row headers to title columnAug 03 PhpStorm 2026.2 ships Laravel tool window and GitHub Copilot agent integrationAug 03 WordPress 7.1 makes post editor unconditionally iframedAug 03 ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} ```