--- title: PHP 8.6 goes BSD, Laravel 13.25 gets a real terminal UI description: PHP quietly relicensed to a plain Modified BSD license this week, which matters more for governance than for code. Laravel 13.25 shipped global queue pausing... canonical: https://daily.dev/posts/php-8-6-goes-bsd-laravel-13-25-gets-a-real-terminal-ui-nmoiy6bee twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: PHP 8.6 goes BSD, Laravel 13.25 gets a real terminal UI | daily.dev og:description: PHP quietly relicensed to a plain Modified BSD license this week, which matters more for governance than for code. Laravel 13.25 shipped global queue pausing... og:url: https://daily.dev/posts/php-8-6-goes-bsd-laravel-13-25-gets-a-real-terminal-ui-nmoiy6bee og:image: https://api.daily.dev/og/posts/nMoIy6bEE.png og:image:alt: PHP 8.6 goes BSD, Laravel 13.25 gets a real terminal UI og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # PHP 8.6 goes BSD, Laravel 13.25 gets a real terminal UI **[PHP Digest](https://daily.dev/sources/php_digest)** · 4 min read · 18 upvotes · 0 comments ## Summary PHP quietly relicensed to a plain Modified BSD license this week, which matters more for governance than for code. Laravel 13.25 shipped global queue pausing and a proper multi-tab terminal for artisan dev, while WordPress 7.1 hit release candidate with responsive block styles landing August 19. On the security side, a BdThemes supply-chain hack created hidden rogue admins across several popular plugins, and a forensic writeup showed two separate attacker groups fighting over the same hacked WordPress site. Ecotone also posted eye-catching throughput numbers for high-volume messaging in PHP. ## Content **TLDR:** PHP quietly relicensed to a plain Modified BSD license this week, which matters more for governance than for code. Laravel 13.25 shipped global queue pausing and a proper multi-tab terminal for artisan dev, while WordPress 7.1 hit release candidate with responsive block styles landing August 19. On the security side, a BdThemes supply-chain hack created hidden rogue admins across several popular plugins, and a forensic writeup showed two separate attacker groups fighting over the same hacked WordPress site. Ecotone also posted eye-catching throughput numbers for high-volume messaging in PHP. --- ## PHP moves to Modified BSD license starting with PHP 8.6 PHP dropped the vendor-specific PHP License 3.01 in favor of a plain Modified BSD license, and Zend simplified the Zend Engine License alongside it. The interesting part isn't the license text, it's the argument that governance facts like this, plus a shrinking Foundation sponsor base and only about 140 active RFC voters, are what actually drive framework adoption decisions, not feature checklists. [Read more](https://daily.dev/posts/A7Lpt41ye) ## Laravel 13.25 adds global queue pausing and rebuilds artisan dev's terminal UI queue:pause --all and queue:resume --all stop every worker across every connection from picking up new jobs, while letting in-flight jobs finish, exactly what you want mid-deploy. Separately, artisan dev dropped concurrently for a new first-party package called @laravel/multiplex, giving each process (dev server, queue worker, Pail, Vite) its own tab instead of one interleaved log stream. Crashed processes now auto-restart by default, a behavior change from before, and multiplex requires macOS/Linux plus Node 22.13+, so Windows stays on concurrently for now. [Read more](https://daily.dev/posts/zBWNbUM3X) ## BdThemes supply-chain hack creates hidden rogue WordPress admins Attackers poisoned a remote JSON feed used by BdThemes' Biggop Library to deliver admin dashboard banners, exploiting an XSS bug introduced back in March 2026 to hijack authenticated admin sessions and create rogue accounts hidden from the user list. A webshell (emer-run.php) was dropped for persistence. Affected plugins, including Element Pack with 100,000+ installs, were pulled from WordPress.org on August 8, but the underlying XSS is still unpatched. [Read more](https://daily.dev/posts/LFAhg18Ig) ## WordPress 7.1 enters final RC ahead of August 19 release RC3 shipped with 90+ fixes on top of RC1, and the branch cut is slipping slightly due to GitHub Actions work, meaning the two-committer sign-off policy on trunk stays in place a bit longer. The headline feature is responsive per-block styles for tablet and mobile, plus pseudo-state theming for buttons and nav links. Worth flagging for accessibility-conscious teams: the Media Library is switching its default to infinite scroll, a known regression for screen reader and keyboard users, though it can be disabled per-user or globally via a filter. [Read more](https://daily.dev/feed-by-ids?id=ZzifbsuBz&id=12YK19ghT) --- ## Also notable - **Ecotone hits 157,266 confirmed messages/sec to Kafka from one PHP process:** A single builder call, withHighThroughputPublishing(), enables batching and non-blocking confirmation with zero business-handler changes, and the outbox relay pattern drains 10,000 messages in 0.2s instead of 34.49s sent one at a time, though the feature is Enterprise-tier only. [Read more](https://daily.dev/posts/K7nDZyB7U) - **Ampache 8.0.0 requires PHP 8.5+, adds OIDC login and a Subsonic implementation audited against spec:** The release also strips the old popup web player, enables memory caching by default, and went through a PHPStan level 8 / Rector hardening pass across the codebase. [Read more](https://daily.dev/posts/HkYQkZtWU) - **BlackBox property-testing catches a PHP 8.5 URL parser memory leak fixed within days:** A non-encoded emoji after the 1010th character of a path string leaked internal memory in PHP's WHATWG URL parser; the bug was reported July 4th but had already been fixed by Ilija Tovilo on July 1st, shipping in PHP 8.5.8 on July 3rd. [Read more](https://daily.dev/posts/PCcqugB1h) - **exit() silently kills parallel PHPUnit workers with no diagnostic output:** Swapping exit() for throw new RuntimeException() lets Pest/ParaTest actually surface a stack trace instead of a bare WorkerCrashedException, and grep -rn 'exit(' app/ will find every landmine before you migrate to parallel test execution. [Read more](https://daily.dev/posts/ROQcSOq1V) - **Sulu MCP Bundle turns a Sulu 3.x CMS into an MCP server for AI assistants:** Version 1.0.0-RC1 requires Sulu 3.0.8+, PHP 8.2+, and Symfony 7.3+, and keeps publishing/deleting off by default while giving agents read/write access to pages, articles, media, and snippets under the connected user's own permissions. [Read more](https://daily.dev/posts/FawG094L8) ## Similar posts on daily.dev - [What We Know About Laravel 14](https://daily.dev/posts/what-we-know-about-laravel-14-zmvw8ali6) · Laravel News · 49 upvotes · 5 comments --- Tags: [#php](https://daily.dev/tags/php), [#wordpress](https://daily.dev/tags/wordpress), [#laravel](https://daily.dev/tags/laravel), [#appsec](https://daily.dev/tags/appsec), [#licensing](https://daily.dev/tags/licensing) [View this post on daily.dev](https://daily.dev/posts/php-8-6-goes-bsd-laravel-13-25-gets-a-real-terminal-ui-nmoiy6bee) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/php-8-6-goes-bsd-laravel-13-25-gets-a-real-terminal-ui-nmoiy6bee","headline":"PHP 8.6 goes BSD, Laravel 13.25 gets a real terminal UI","text":"PHP quietly relicensed to a plain Modified BSD license this week, which matters more for governance than for code. Laravel 13.25 shipped global queue pausing and a proper multi-tab terminal for artisan dev, while WordPress 7.1 hit release candidate with responsive block styles landing August 19. On the security side, a BdThemes supply-chain hack created hidden rogue admins across several popular plugins, and a forensic writeup showed two separate attacker groups fighting over the same hacked WordPress site. Ecotone also posted eye-catching throughput numbers for high-volume messaging in PHP.","url":"https://daily.dev/posts/php-8-6-goes-bsd-laravel-13-25-gets-a-real-terminal-ui-nmoiy6bee","datePublished":"2026-08-17T04:19:24.616Z","dateModified":"2026-09-13T21:16:44.615Z","author":{"@type":"Organization","name":"PHP Digest","logo":"https://media.daily.dev/image/upload/s--nXhH7T2u--/f_auto,q_auto/v1773839413/logos/php_digest?_a=BAMAMiiu0","url":"https://daily.dev/sources/php_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":18},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/php_digest","name":"PHP Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"PHP Digest","item":"https://daily.dev/sources/php_digest"},{"@type":"ListItem","position":3,"name":"PHP 8.6 goes BSD, Laravel 13.25 gets a real terminal UI"}]} ```