--- title: The API Grand Prix — The Shattered Sigils and the... description: PHP-Kernel 1.0.0-RC-14 introduces a pure JSON queue payload format by replacing PHP's native serialize() with json_encode(), enabling polyglot consumers (e.g.,... canonical: https://daily.dev/posts/the-api-grand-prix-the-shattered-sigils-and-the-polyglot-uprising-yy8jubmhj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The API Grand Prix — The Shattered Sigils and the Polyglot Uprising | daily.dev og:description: PHP-Kernel 1.0.0-RC-14 introduces a pure JSON queue payload format by replacing PHP's native serialize() with json_encode(), enabling polyglot consumers (e.g.,... og:url: https://daily.dev/posts/the-api-grand-prix-the-shattered-sigils-and-the-polyglot-uprising-yy8jubmhj og:image: https://api.daily.dev/og/posts/yY8JuBmHJ.png og:image:alt: The API Grand Prix — The Shattered Sigils and the Polyglot Uprising og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The API Grand Prix — The Shattered Sigils and the Polyglot Uprising **[Medium](https://daily.dev/sources/medium_js)** · 9 min read · 0 upvotes · 0 comments ## Summary PHP-Kernel 1.0.0-RC-14 introduces a pure JSON queue payload format by replacing PHP's native serialize() with json_encode(), enabling polyglot consumers (e.g., Go microservices) to process queued jobs without PHP object knowledge. The post covers six core payload schemas (array callables, storable jobs, mailables, notifications, broadcast events, and handler wrappers), explains how switching to JSON eliminates PHP Object Injection risks and removes the need for regex guards, and provides a complete Go consumer implementation that routes jobs via a class@method registry key extracted from the storableCallable JSON structure. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does PHP-Kernel 1.0.0-RC-14 prevent PHP Object Injection in queued messages? It replaces serialize() with json_encode() for queue payloads under a strict security mode enabled by the FORBID_SERIALIZED_OBJECTS_IN_QUEUE flag. Because JSON cannot encode PHP objects, a malicious serialized string simply decodes into a harmless string or array, closing the Object Injection vector without needing regex scans for O: or C: markers. _Track breaking changes like this one when hardening queue security in daily.dev for PHP backend work._ ### What JSON structure does PHP-Kernel use so Go workers can process queued jobs without knowing PHP objects? Every queued job is serialized under a top-level storableCallable key containing a three-element array: the class name, the method name, and a map of primitive arguments. Go services unmarshal this into a generic struct, build a routing key like Class@method, and dispatch to registered handler functions using only primitive types (strings, floats, maps, slices). _Developers building polyglot PHP-Go pipelines can follow schema changes like this via daily.dev._ ### How can a PHP object be safely included in a JSON queue payload without breaking the strict no-object rule? Implement PHP's native JsonSerializable interface on the data class, defining a jsonSerialize() method that returns a plain associative array of primitives. When passed to dispatch(), PHP automatically reduces the object to that array representation before writing it to the queue, satisfying the FORBID_SERIALIZED_OBJECTS_IN_QUEUE constraint. _daily.dev helps developers keep up with PHP interface patterns like JsonSerializable for safe queue design._ ## Similar posts on daily.dev - [The API Grand Prix — The Silent Heralds and the Polyglot Bridge](https://daily.dev/posts/the-api-grand-prix-the-silent-heralds-and-the-polyglot-bridge-dpyf2qwmd) · Medium · 1 upvotes · 0 comments - [The API Grand Prix — The Dissolution of the Middle Guilds and the Direct Command](https://daily.dev/posts/the-api-grand-prix-the-dissolution-of-the-middle-guilds-and-the-direct-command-um3imajev) · Medium · 1 upvotes · 0 comments - [JSON Schema Deserialization in Laravel 13.14](https://daily.dev/posts/json-schema-deserialization-in-laravel-13-14-uq0wgfycz) · Laravel News · 22 upvotes · 2 comments --- Tags: [#architecture](https://daily.dev/tags/architecture), [#golang](https://daily.dev/tags/golang), [#php](https://daily.dev/tags/php) [View this post on daily.dev](https://daily.dev/posts/the-api-grand-prix-the-shattered-sigils-and-the-polyglot-uprising-yy8jubmhj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The API Grand Prix — The Shattered Sigils and the Polyglot Uprising","url":"https://daily.dev/posts/the-api-grand-prix-the-shattered-sigils-and-the-polyglot-uprising-yy8jubmhj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-api-grand-prix-the-shattered-sigils-and-the-polyglot-uprising-yy8jubmhj"},"datePublished":"2026-07-22T14:50:14.491Z","dateModified":"2026-09-14T08:41:15.685Z","description":"PHP-Kernel 1.0.0-RC-14 introduces a pure JSON queue payload format by replacing PHP's native serialize() with json_encode(), enabling polyglot consumers (e.g.,...","image":"https://media.daily.dev/image/upload/s--HRgLpUt6--/f_auto/v1722860399/public/Placeholder%2003","thumbnailUrl":"https://media.daily.dev/image/upload/s--HRgLpUt6--/f_auto/v1722860399/public/Placeholder%2003","isAccessibleForFree":true,"articleSection":"Medium","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Medium","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/medium","url":"https://daily.dev/sources/medium_js"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-api-grand-prix-the-shattered-sigils-and-the-polyglot-uprising-yy8jubmhj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"architecture,golang,php","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Medium","item":"https://daily.dev/sources/medium_js"},{"@type":"ListItem","position":3,"name":"The API Grand Prix — The Shattered Sigils and the Polyglot Uprising"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/the-api-grand-prix-the-shattered-sigils-and-the-polyglot-uprising-yy8jubmhj#faq","mainEntity":[{"@type":"Question","name":"How does PHP-Kernel 1.0.0-RC-14 prevent PHP Object Injection in queued messages?","acceptedAnswer":{"@type":"Answer","text":"It replaces serialize() with json_encode() for queue payloads under a strict security mode enabled by the FORBID_SERIALIZED_OBJECTS_IN_QUEUE flag. Because JSON cannot encode PHP objects, a malicious serialized string simply decodes into a harmless string or array, closing the Object Injection vector without needing regex scans for O: or C: markers. Track breaking changes like this one when hardening queue security in daily.dev for PHP backend work."}},{"@type":"Question","name":"What JSON structure does PHP-Kernel use so Go workers can process queued jobs without knowing PHP objects?","acceptedAnswer":{"@type":"Answer","text":"Every queued job is serialized under a top-level storableCallable key containing a three-element array: the class name, the method name, and a map of primitive arguments. Go services unmarshal this into a generic struct, build a routing key like Class@method, and dispatch to registered handler functions using only primitive types (strings, floats, maps, slices). Developers building polyglot PHP-Go pipelines can follow schema changes like this via daily.dev."}},{"@type":"Question","name":"How can a PHP object be safely included in a JSON queue payload without breaking the strict no-object rule?","acceptedAnswer":{"@type":"Answer","text":"Implement PHP's native JsonSerializable interface on the data class, defining a jsonSerialize() method that returns a plain associative array of primitives. When passed to dispatch(), PHP automatically reduces the object to that array representation before writing it to the queue, satisfying the FORBID_SERIALIZED_OBJECTS_IN_QUEUE constraint. daily.dev helps developers keep up with PHP interface patterns like JsonSerializable for safe queue design."}}]} ```