<p><strong>TLDR:</strong> Voting opened June 14–28 on the PHP Bound-Erased Generic Types RFC, with notable dissent from Rowan Tommins arguing native syntax should carry native enforcement. A 10-year-old authentication bypass in phpBB was patched in version 3.3.17, with no fix yet for the 4.x branch. A critical RCE patch bypass in PhpSpreadsheet (CVE-2026-45034, CVSS 9.8) is already public with a working proof-of-concept. On the Laravel side, the AI SDK gained MCP server support and Laravel 13.15.0 shipped typed translation accessors alongside two security fixes.</p>
<hr>
<h2>Bound-erased generics RFC goes to vote with real dissent</h2>
<p>Voting runs June 14–28 and requires a 2/3 majority. Two ballots are on the table: accept the RFC, and choose between +T/-T (Hack/Scala style) versus in T/out T (C#/Kotlin style) variance markers. Rowan Tommins voted No on philosophical grounds — his core objection is that PHP’s native type annotations are always enforced at runtime, and erased generics break that guarantee. Larry Garfield separately warned that a failed generics vote would be bad for PHP’s reputation and argued the community should target PHP 9.0 (2027) for fully enforced generics if this RFC fails. Rob Landers shared a working reified generics implementation built on the erased branch, showing only 1.3–1.5x overhead versus untyped code — roughly the same as manual type checks — and flagged a real footgun: generic exception catching silently fails under type erasure. <a href="https://app.daily.dev/feed-by-ids?id=OhyIrZlD8&amp;id=5OOKvnraY&amp;id=ErCxKIipU&amp;id=AFnrIernr&amp;id=02ZyyTQdb&amp;id=9QVm5MVUN" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>phpBB patches 10-year-old auth bypass in version 3.3.17</h2>
<p>Aikido Security found an unauthenticated authentication bypass in all phpBB 3.x versions through 3.3.16 and 4.x through 4.0.0-a2 that lets an attacker log in as any user, including administrators, with a single HTTP request. The flaw has been in the codebase since 2014. A patch shipped in 3.3.17 on June 6th, four days after responsible disclosure via HackerOne. No fix exists yet for the 4.x branch. RCE is not directly possible due to a separate Admin Control Panel password check, but successful exploitation enables account impersonation, private message access, and site defacement. Full technical details are being withheld to give administrators time to upgrade. <a href="https://app.daily.dev/feed-by-ids?id=khey5ws8C&amp;id=636hNEaei" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>PhpSpreadsheet RCE patch bypass, CVE-2026-45034, CVSS 9.8</h2>
<p>A bypass of the earlier CVE-2026-34084 patch has been disclosed in PhpSpreadsheet, affecting all 1.x versions through 1.30.4. The flaw exploits PHP’s parse_url() failing to detect phar:// stream wrappers when triple slashes are used (phar:///path), allowing attackers to trigger phar metadata deserialization via IOFactory::load() with a user-controlled filename. On PHP 7.x this achieves full RCE; on PHP 8.x it’s file read with potential RCE. A public proof-of-concept is already available. Upgrade to 1.30.5 immediately and replace any parse_url()-based wrapper detection with str_contains() checks. <a href="https://app.daily.dev/posts/00MI2ESOj" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>Laravel AI SDK adds MCP server support, 13.15.0 ships security fixes</h2>
<p>The laravel/mcp package adds a dedicated MCP client letting agents connect to any MCP server — local via STDIO or remote via HTTP — with bearer token or OAuth 2.1 authentication. MCP tools drop into an agent’s existing tools() method without changing the agent loop, and a faking layer lets you test MCP-powered agents without a live server. Laravel 13.15.0 separately ships typed translation accessors (trans()-&gt;string() and trans()-&gt;array()), JSON Schema fromArray() deserialization, and two security fixes: a date_equals validation bypass from loose null comparison and restricted route unserialization to reduce object injection risk. <a href="https://app.daily.dev/feed-by-ids?id=06L7gMDfj&amp;id=khWk8jndz" target="_blank" rel="noopener nofollow">Read more</a></p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>API Platform type confusion vulnerability fixed in 4.1.30, 4.2.26, 4.3.12:</strong> A CWE-843 type confusion flaw in AbstractItemNormalizer allows attackers to supply a relation IRI pointing to a wrong resource type, silently corrupting application invariants — the fix adds an is_a guard returning HTTP 400 for cross-type IRIs, and a workaround is to declare explicit PHP types on all writable relation properties. <a href="https://app.daily.dev/posts/05LV7siJ2" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><em><em>Nette 3.4 drops CSRF tokens in favor of Sec-Fetch-</em> headers, adds SSRF protection:</em>* Nette/Http 3.4 replaces token-based CSRF protection with browser-native Sec-Fetch-* headers (broadly supported since Safari 16.4) and introduces UrlValidator and IPAddress classes that block loopback, private ranges, and cloud metadata endpoints like 169.254.169.254, with getResolvedIPs() to close the DNS rebinding window. <a href="https://app.daily.dev/feed-by-ids?id=LL3elkLpP&amp;id=vyQJaZXXC" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Twig 4.0 overhauls the for loop with generator support and loop.changed():</strong> The headline change is that loop.last now works with any iterator including generators by reading one item ahead, and new helpers loop.previous, loop.next, loop.changed(), and loop.cycle() cover grouping and alternating class patterns — templates running deprecation-free on Twig 3 render identically on Twig 4. <a href="https://app.daily.dev/posts/aCOpbc2kB" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Symfony 8.1 ships Uuid47Transformer, FRANKENPHP_RESET_KERNEL, and null-safe array access in ExpressionLanguage:</strong> Notable additions include Uuid47Transformer to mask UUIDv7 timestamps behind UUIDv4-looking identifiers at API boundaries using SipHash-2-4, a FRANKENPHP_RESET_KERNEL env var for full per-request kernel isolation in FrankenPHP workers, and null-safe array access syntax (?.[…]) in ExpressionLanguage. <a href="https://app.daily.dev/posts/TLAtdeCzp" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Laravel starter kits now bundle Larastan at level 7 and Pest output by default:</strong> The CLI installer also gained toggles for auth options like passkeys and email verification before touching any code, and Herd’s boost installer added Zed and Kiro as AI editor options. <a href="https://app.daily.dev/posts/KhFGHg3kZ" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>


Laravel, WordPress, and PHP ecosystem updates.

PHP Digest

A roundup of PHP ecosystem news covering several major developments. Voting opened June 14–28 on the PHP Bound-Erased Generic Types RFC, with notable philosophical dissent from Rowan Tommins who argues erased generics break PHP's runtime enforcement guarantee. A 10-year-old authentication bypass in phpBB (all 3.x through 3.3.16) was patched in 3.3.17 after responsible disclosure, with no fix yet for the 4.x branch. A critical CVSS 9.8 RCE patch bypass in PhpSpreadsheet (CVE-2026-45034) is already public with a working proof-of-concept, exploiting PHP's parse_url() failing to detect phar:// triple-slash variants. Laravel 13.15.0 shipped typed translation accessors and two security fixes, while the Laravel AI SDK gained MCP server support. Also notable: API Platform type confusion fix, Nette 3.4 replacing CSRF tokens with Sec-Fetch-* headers, Twig 4.0 for-loop overhaul, and Symfony 8.1 additions.

Bound-erased generics vote opens, phpBB auth bypass patched after a decade