<p><strong>TLDR:</strong> PHP’s licensing story finally has a clean ending — PHP 9.0 ships under BSD-3-Clause, replacing the old dual-license setup that was never fully OSI-recognized. Symfony pushed three maintenance releases this week covering 6.4, 7.4, and 8.0. Laravel 13.7.0 landed with interruptible jobs and a handful of useful queue improvements. A WordPress redirect plugin with 70,000+ installs was pulled from the directory after a dormant backdoor was discovered in versions from 2020–2021.</p>
<hr>
<h2>PHP moves to BSD-3-Clause</h2>
<p>PHP 9.0 will ship under the 3-clause BSD license, dropping the dual PHP License v3.01 and Zend Engine License v2.0 arrangement that’s been in place for decades. The Zend Engine License was never OSI-recognized, which meant a significant chunk of PHP’s source was technically not open source by OSI standards. The change is permissive, GPL-compatible, and removes the advertising clauses and name-restriction ambiguity that caused friction for Linux distributors. Ben Ramsey spent years on this — tracking down original PHP Group members for written consent, getting Perforce to sign off, and running a six-month community discussion before a unanimous vote. No contributor or user rights changed.</p>
<h2>Symfony 6.4.37, 7.4.9, and 8.0.9</h2>
<p>All three active Symfony branches got maintenance releases this week. The 6.4 release fixes 37 bugs; 7.4 and 8.0 each clear over 50. Shared fixes across branches include circular reference resolution in DependencyInjection through factory builders, Dotenv variable corruption on repeated loads, and nullable intersection type autowiring. Messenger worker sleep behavior and deduplication issues also got attention. If you’re on any of these branches, routine upgrade.</p>
<h2>Laravel 13.7.0 ships interruptible jobs</h2>
<p>The new <code>Interruptible</code> interface lets queued jobs respond to worker signals like SIGTERM for graceful cleanup — something that’s been a gap for anyone running jobs that need to release locks or flush state before a worker shuts down. A companion <code>WorkerInterrupted</code> event gives you observability when signals arrive. The release also adds bulk JSON path assertions (<code>assertJsonPaths</code>/<code>assertJsonMissingPaths</code>), <code>SortDirection</code> enum support in collection sorting, and font preload support via a new <code>@fonts</code> Blade directive wired to Vite’s font manifest.</p>
<h2>WordPress redirect plugin pulled after backdoor discovery</h2>
<p>The Quick Page/Post Redirect plugin, active on over 70,000 sites, contained a dormant backdoor introduced through a rogue self-update mechanism pointing to a third-party domain. Versions 5.2.1 and 5.2.2 from 2020–2021 silently pushed a tampered 5.2.3 build with a passive backdoor targeting logged-out users for cloaked parasite SEO. The C2 subdomain no longer resolves, so the backdoor is currently inactive, but the update mechanism is still present on affected sites. <a href="http://WordPress.org" target="_blank" rel="noopener nofollow">WordPress.org</a> has pulled the plugin. If you’re running any version in that range, uninstall it now.</p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>PHP 8.5.6 RC3:</strong> Three release candidates were needed — first a CVE in the bundled uriparser library (CVE-2026-42371) forced an unplanned RC2, then a Windows-only dom extension regression from a bad lexbor upmerge required RC3. Stable expected next week.</li>
<li><strong>PHP pipe operator friction:</strong> A detailed post this week documents where PHP 8.5’s <code>|&gt;</code> operator runs into the array stdlib’s argument-order inconsistencies, arrow function parsing quirks, and by-reference function limitations. Collection libraries sidestep all of it via method chaining.</li>
<li><strong>Deployer v8:</strong> Official release after a long alpha/beta cycle. Named arguments replace the options array in <code>run()</code>, a new <code>quote()</code> helper uses ANSI-C quoting instead of <code>escapeshellarg()</code>, and the minimum PHP version is now 8.3. Symfony 6 support is dropped.</li>
<li><strong>Symfony 8.1 preview:</strong> The week’s Symfony digest covers upcoming 8.1 features including a new TUI component, a <code>#[RateLimit]</code> attribute for controllers, FrankenPHP kernel reset support, and autowiring env vars as closures.</li>
<li><strong>SymfonyInsight adds 11 rules:</strong> New checks cover command injection risks, insecure random functions, unsafe <code>extract</code>/<code>unserialize</code> usage, committed secrets detection, and license incompatibility scanning — bringing the total to 141 automated rules.</li>
<li><strong>Laravel Schema Sentinel:</strong> New package that builds a shadow database from your migration files and diffs it against your live database. Supports auto-generating corrective migrations and can block <code>php artisan migrate</code> if drift is detected. Compatible with Laravel 11–13.</li>
<li><strong>Laravel MCP Apps:</strong> The <code>laravel/mcp</code> package now supports returning interactive HTML interfaces rendered inline inside AI chat hosts like Claude and VS Code Copilot. Tools can serve sandboxed iframe UIs with bidirectional messaging and no separate auth layer.</li>
<li><strong>Laravel Cloud Pre-Check:</strong> Free static analysis tool from Laravel and Jason McCreary/Laravel Shift that scans your repo for deployment compatibility issues — PHP version, Octane config, hardcoded paths, system command calls — and delivers results as a pull request.</li>
<li><strong>Craft CMS 6:</strong> Migrating from Yii 2 to Laravel with a first-party <code>craftcms/yii2-adapter</code> bridge so most plugins work without changes. Core architecture unchanged. Craft 5 designated LTS through 2031. Stable release targeted Q4 2026.</li>
<li><strong>Hibla HTTP Client:</strong> PHP 8.4+ async HTTP client built on fibers with SSE support, concurrent requests via <code>Promise::all()</code>, exponential backoff, and a full interceptor pipeline. Currently in beta.</li>
<li><strong>PHPverse 2026:</strong> JetBrains hosting a free online PHP conference June 9, 11am–3:50pm UTC. Speakers include Jeffrey Way, Fabien Potencier, and Nils Adermann. Last year drew 55,000 developers.</li>
<li><strong>WordPress Presence API:</strong> Experimental feature plugin adding a “who’s online” layer to the admin — dashboard widget, avatar stacks in the admin bar, and an Editors column in the post list. Uses a dedicated DB table with 60-second TTL. May or may not land in WordPress 7.0.</li>
<li><strong>Turbine PHP server:</strong> Early-stage PHP application server written in Rust that embeds PHP via the embed SAPI, replacing the Nginx + PHP-FPM stack with a single binary. Not production-ready yet, but worth watching.</li>
<li><strong>WordPress RTC testing request:</strong> WordPress Core asked web hosts to test the Real Time Collaboration feature planned for 7.0 by May 4th, with results informing architectural decisions before release.</li>
</ul>


Laravel, WordPress, and PHP ecosystem updates.

PHP Digest

PHP 9.0 will ship under the BSD-3-Clause license, resolving decades of OSI-incompatibility from the old dual PHP/Zend Engine license arrangement. Symfony released maintenance updates for branches 6.4, 7.4, and 8.0, fixing dozens of bugs including circular reference and Dotenv issues. Laravel 13.7.0 introduces an Interruptible interface for graceful job shutdown on worker signals, bulk JSON path assertions, and a new Blade fonts directive. A WordPress redirect plugin with 70,000+ installs was removed from the directory after a dormant backdoor was found in 2020–2021 versions. Additional items include PHP 8.5.6 RC3 delays due to a CVE and regression, Deployer v8 release, Symfony 8.1 preview features, Laravel Schema Sentinel package, Craft CMS 6 migrating to Laravel, and PHPverse 2026 conference details.

PHP goes BSD, Symfony triples up on releases

<p>Who can explain this with apples?</p>
