Best of PHP — July 2026

1. 1
   Article

   Laravel News·7w

   EnvKit: A Local Development Stack for Laravel on Windows and macOS

   EnvKit is a free desktop application (currently in beta) that bundles a full local PHP/Laravel development stack into a single control panel for Windows and macOS. It includes a choice of Nginx or Apache, PHP versions 7.4 through latest with per-project isolation, MySQL/MariaDB, PostgreSQL, MongoDB, Redis, Mailpit, Node.js dev servers, trusted HTTPS .test domains, and admin UIs. Laravel-specific extras include Reverb for WebSockets, cron management, and live dump/query/job inspection. A built-in MCP server lets AI editor assistants read stack state and run diagnostics. EnvKit is positioned as a free alternative to Laravel Herd and Laragon/XAMPP, though it runs on Electron and is still in beta at v0.31.0-beta.39.

   94

   13
2. 2
   Article

   Laravel News·6w

   Laravel Quota: Usage Budgets for Calendar Periods

   Laravel Quota is a package for tracking and enforcing cumulative usage budgets across calendar periods (daily, monthly, etc.), distinct from Laravel's built-in RateLimiter which handles burst throttling. It offers a fluent API, a HasQuotas Eloquent trait, route middleware that only charges on successful responses, atomic consumption via locks, and both cache and database storage backends. Supports PHP 8.2+ and Laravel 11–13.

   39

   2
3. 3
   Article

   PHP·8w

   PHP: PHP 8.4.23 Release Announcement

   The PHP development team has released PHP 8.4.23, a security release for the PHP 8.4 branch. All PHP 8.4 users are encouraged to upgrade immediately. Source downloads and Windows binaries are available on the official PHP downloads page, with the full list of changes in the ChangeLog.

   33

   14
4. 4
   Article

   Laravel News·5w

   Laravel Time Machine: A Request Lifecycle Profiler

   Laravel Time Machine is a new open-source performance profiler for Laravel applications that records every stage of the HTTP request lifecycle — from bootstrap through termination — with millisecond-level timings. It provides a Gantt-style timeline dashboard at /time-machine, captures SQL queries with bindings and execution times, flags slow requests (>500ms) and slow queries (>50ms), and stores profiles as flat JSON files without requiring database migrations. Custom instrumentation is available via a TimeMachine facade for marking points, measuring code blocks, and creating manual spans. Compared to Telescope and Debugbar, it occupies a middle ground: browsable request history like Telescope but focused solely on lifecycle timing, stored in flat files rather than a database.

   32

   7
5. 5
   Article

   stitcher.io·7w

   Getting started with PHP

   A PHP developer with over ten years of experience is building a free introductory course for modern PHP, citing a gap in quality onboarding resources for newcomers. An 8-chapter crash course is already available, covering installation, syntax, Composer, QA tools, and deployments, with more in-depth topics planned. The author is seeking feedback from PHP experts to improve the course and help grow the PHP community.

   31

   5
6. 6
   Article

   Laravel News·7w

   HTTP Query Method Support in Laravel 13.19

   Laravel 13.19.0 introduces several new features: an Http::query() client method for sending HTTP QUERY verb requests with body parameters, plus matching query() and queryJson() testing helpers. A new reduceInto() collection method allows mutating an accumulator in place without returning a value each iteration. The Str::counted() helper pluralizes a word and prepends the count in one call. Queue improvements include bulk SQS dispatching via SendMessageBatch API for fewer API calls, and the queue fake can now inspect reserved jobs for better test assertions. Minor fixes cover soft-delete assertions, mail config, and component attribute merging.

   28

   4
7. 7
   Article

   FREEK.DEV·6w

   Supercharge your PHP apps with Go-powered PHP extensions

   A conference session covering how to build PHP extensions using Go and FrankenPHP, then integrate them into Laravel and Symfony as native-feeling features. An in-memory LRU cache serves as the practical example, providing a tour of PHP internals and framework flexibility.

   28

   1
8. 8
   Article

   Collections·6w

   Laravel 13.20 adds first-party image processing and other new features

   Laravel 13.20 introduces a first-party Image facade that wraps Intervention Image v4 with a fluent, Laravel-native API for upload-process-store workflows. The facade handles driver configuration, filename generation, and storage, supporting GD and Imagick drivers with an immutable API. Other additions include a #[WithoutMiddleware] attribute for controller methods, a dedicated Redis session prefix to avoid key collisions, quiet bulk increment/decrement methods for Eloquent models, enum support for the WithoutOverlapping queue middleware, and minor fixes like collision-free migration timestamps.

   23

   3
9. 9
   Article

   Laravel News·6w

   Enforce Per-Action Waiting Periods in Laravel with Cooldown

   Laravel Cooldown is a package that enforces per-action, per-owner waiting periods in Laravel applications. Unlike the built-in RateLimiter which counts requests within a window, Cooldown tracks whether a specific named action for a specific owner is still within its waiting period. Key features include a fluent API for setting/checking/clearing cooldowns, an Eloquent HasCooldowns trait, route middleware, atomic locking via block() to prevent race conditions, a CooldownInfo object with human-readable remaining time, and support for both cache and database storage backends. The database backend is useful for critical actions like billing where cache flushes could remove locks. Requires PHP 8.2 and supports Laravel 11, 12, and 13.

   22

   1
10. 10
    Article

    Laravel News·5w

    RouteKey Model Attribute in Laravel 13.21

    Laravel 13.21 ships several developer-facing additions: a #[RouteKey] PHP attribute for declaratively setting the route model binding column on Eloquent models (replacing getRouteKeyName() overrides), a base64 validation rule that enforces strict RFC 4648 encoding, a #[RequestAttribute] contextual attribute for injecting request bag values directly into controller parameters, and expanded Image component output formats (PNG, GIF, AVIF, BMP) alongside a fix for the AVIF MIME mapping. The release also introduces a customizable ApplicationBuilder via a protected static property, a standalone illuminate/concurrency subsplit, and a range of bug fixes covering database transaction rollback callbacks, multibyte string handling, enum key support in cache/logging, and pipeline/serve command corrections.

    21

    1
11. 11
    Article

    W endell Adriel·5w

    PHP Attributes: What, Why, How and When

    PHP attributes (introduced in PHP 8) are typed, structured metadata attached to classes, methods, properties, parameters, and more. They don't execute code themselves — a consumer must read them via the Reflection API and turn them into behavior. The post covers how to define attributes with target restrictions and constructor arguments, how to build a practical webhook handler registry using reflection, performance best practices (reflect at boot, use plain data at runtime), Laravel examples like #[Scope] and #[Config], testing strategies, and a clear decision checklist for when attributes are appropriate versus when interfaces, configuration, or explicit code are better choices.

    20

    2
12. 12
    Article

    W endell Adriel·7w

    UUIDs, ULIDs and Sqids: A Practical Deep Dive

    A thorough comparison of UUIDs (v4 and v7), ULIDs, and Sqids covering their generation models, sorting behavior, database storage trade-offs, and security implications. UUIDv4 offers opaque distributed IDs, UUIDv7 adds time-ordering while keeping UUID semantics, ULIDs provide compact lexicographically sortable 128-bit IDs, and Sqids generate reversible short public IDs from existing integers. The post includes PHP code examples using ramsey/uuid, robinvdvleuten/ulid, and the official Sqids package, plus a practical decision flow, database storage guidance (CHAR vs BINARY), and common mistakes like treating Sqids as encryption or relying on hard-to-guess IDs instead of proper authorization.

    16
13. 13
    Article

    FREEK.DEV·6w

    New in PHP 8.6: Faster array_map with first-class callables

    PHP 8.6 introduces a performance improvement for array_map when used with first-class callables. A video by Tideways demonstrates how this change speeds up the function in practice.

    15

    1
14. 14
    Article

    Laravel News·6w

    Laravel Legacy Bridge: Carry Authenticated Sessions from a Legacy App into Laravel

    Laravel Legacy Bridge is a PHP package that solves the double-login problem when incrementally migrating a legacy PHP app (e.g., CodeIgniter) to Laravel. It works by reading the legacy PHPSESSID cookie on unauthenticated requests, decoding the session payload from the legacy database, and calling loginUsingId() to authenticate the user in Laravel — so users never see a second login prompt mid-migration. Key features include support for multiple payload formats (native PHP, JSON, Laravel serialized, encrypted), configurable resolver drivers (auto, key-based, or custom class), typed events for success/failure with no built-in logging, one-time session invalidation after bridging, an interactive install command with framework presets, and a verify command to test configuration against a real legacy database before going live. Security considerations include treating the legacy sessions table as a trust boundary, requiring HTTPS on both apps, and using read-only database credentials.

    14
15. 15
    Article

    Laravel News·4w

    Queue-SQL: Run Mass Deletes and Updates Across Parallel Queue Jobs

    Queue-SQL is a Laravel package that solves the problem of long-running mass database writes by splitting large UPDATE, DELETE, and INSERT statements into parallel queued jobs. It works by calculating the min/max primary key range, slicing it into chunks, and dispatching an Illuminate\Bus\Batch to process each slice independently. Key features include a query builder macro with a queue() method, safe SQL compilation to avoid closure serialization issues, flexible batch sizing via chunk or maxJobs, native Laravel Batch support with callbacks, Artisan CLI commands for monitoring and cancellation, and Horizon tagging. A dryRun() method previews the batching plan without dispatching. Compared to Laravel's built-in Prunable trait, Queue-SQL runs concurrently and supports arbitrary updates and bulk inserts. Requires PHP 8.1+, Laravel 10–13, and an integer primary key for range-based chunking.

    41

    3
16. 16
    Article

    JetBrains·6w

    PhpStorm 2026.2 is Now Out

    PhpStorm 2026.2 is released with a broad set of improvements across AI integration, PHP/Laravel support, version control, databases, terminal, and cloud tooling. Key AI additions include an agent skills manager for persistent domain knowledge, native GitHub Copilot integration via JetBrains-Microsoft partnership, support for third-party OpenAI-compatible providers in code completion, and faster MCP server setup for terminal AI sessions. PHP gains a new #[FileReference] attribute for persistent file path references, configurable trigger modes for quality tools like PHPStan, and PER Coding Style 3.0 support. Laravel developers get a new tool window with dashboard, error browsing, and Laravel Cloud management. Web support includes TypeScript 7 with up to 4x faster type-checking. Git improvements cover enhanced worktree management, automatic simple conflict resolution, and @mention autocompletion in code reviews. Database tooling sees a redesigned empty state, customizable query console names, and an improved color system. Docker Compose gains inline container status and service templates, and Terraform testing framework support is introduced. Performance work lays groundwork for future startup and indexing improvements, with up to 10% faster project indexing currently.

    13

    2
17. 17
    Article

    Laravel News·7w

    Passwordless Sign-In with Fortify Two-Factor Support in Laravel

    Email Magic Link for Laravel is a passwordless authentication package that lets users sign in via an emailed link or one-time code. It solves the common problem of email scanners burning single-use tokens by splitting the flow: a GET request renders a confirmation page while a POST actually consumes the token. The package integrates with Laravel Fortify, routing TOTP-enabled users to the two-factor challenge before authentication rather than bypassing it. Tokens are stored as keyed HMAC-SHA256 hashes, each with its own brute-force lockout. A mint API lets developers issue links and codes for delivery over SMS or custom channels. Resend limiting uses escalating cooldowns (30s, 60s, 120s) plus a rolling hourly cap. Requires PHP 8.4 and Laravel 13; Fortify is optional.

    12
18. 18
    Article

    freeCodeCamp·7w

    How MCP Is Changing WordPress Development

    Model Context Protocol (MCP) is transforming WordPress development by giving AI assistants live, bidirectional access to a site's actual codebase, database, plugins, and configuration — rather than relying on copy-pasted snippets. Tools like WPVibe AI, Cursor, and Zed are already leveraging MCP to let developers audit plugins, debug conflicts, generate context-aware code, and manage multiple client sites from a single AI-assisted workflow. The shift moves AI from reactive autocomplete to an agent with real project context, lowering the effort for tedious tasks while raising the stakes for developer judgment, since mistakes can propagate faster when AI acts with greater autonomy.

    13
19. 19
    Article

    PHP·8w

    PHP: PHP 8.3.32 Release Announcement

    The PHP development team has released PHP 8.3.32, a security release. All PHP 8.3 users are encouraged to upgrade immediately. Source downloads and Windows binaries are available on the official PHP downloads page, with the full list of changes in the ChangeLog.

    12

    1
20. 20
    Article

    Collections·4w

    Laracon US 2026 announcements: LSP, Blade formatting, Doctor, and more

    Laracon US 2026 keynote introduced a wide range of Laravel updates. Key framework additions include Laravel LSP for multi-editor language server support (NeoVim, Zed, Sublime Text, Cursor, OpenCode), Blade file formatting in Pint 1.30, and a new `artisan doctor` health-check command covering environment config and security audits. Other framework additions include `artisan dev`, a head tag API, refreshable locks, debounced jobs, and a CPX tool similar to npx for PHP. On the AI SDK front, human-in-the-loop tool approval, filesystem tools for agents, multimodal embeddings, and OpenAI-compatible provider support were added. Laravel Cloud gains scale-to-zero Flex compute with sub-500ms cold starts (including MySQL), autoscaling managed queues with FIFO ordering, a built-in secrets manager, monorepo deployments for Next.js and Nuxt, and HIPAA compliance for Private Cloud.

    15

    2
21. 21
    Article

    PHP Digest·5w

    WordPress RCE chain goes public, PhpStorm 2026.2 ships

    Two chained WordPress CVEs dubbed wp2shell enable unauthenticated remote code execution on default installs running 6.8 through 7.0.1, with public proof-of-concept exploits already in the wild. WordPress maintainers enabled forced auto-updates, but you should manually verify every site you manage is on 7.0.2, 6.9.5, or 6.8.6. PhpStorm 2026.2 landed with GitHub Copilot integration, a new Laravel tool window, and TypeScript 7 support. Laravel 13.20 shipped a first-party Image facade and a migration timestamp fix that matters if you use AI agents to scaffold code.

    11
22. 22
    Article

    Laravel·7w

    Laravel June Product Updates

    Laravel's June 2026 product updates cover three main products. The Laravel Framework added Bus::bulk() for dispatching large job batches in a single database insert, Postgres transaction pooler support for PgBouncer and RDS Proxy, and MCP client/server tooling so AI agents can connect to remote MCP servers. Laravel Cloud now supports fully managed Symfony 7.4 LTS and 8.x apps with zero code changes, added Stripe Projects integration for provisioning and billing, improved per-member notification routing, and expanded outbound IP addresses. Laravel Forge introduced managed Valkey caches and managed object storage, both provisioned directly from the dashboard.

    11
23. 23
    Article

    Laravel News·5w

    Scaffold Packages with the `laravel package` Command in Laravel Installer v5.31.0

    Laravel Installer v5.31.0 ships a new `laravel package` command that scaffolds Laravel packages by cloning the official package-skeleton repo, cleaning git history, installing dependencies, and running the configuration script. The command supports flags for including config files, routes, views, migrations, facades, and more, plus metadata options for author and package details. Other additions include automatic PHP version matching for GitHub Actions CI workflows, propagation of the `--no-node` flag to starter kit hooks via an environment variable, a fallback for missing `Laravel\Prompts\callout()`, and a Windows fix adding `--timeout=0` to queue listeners.

    10
24. 24
    Article

    ACF·6w

    ACF 6.8.6

    Advanced Custom Fields (ACF) version 6.8.6 is now available. This release is a bug-fix update addressing seven issues: Google Maps field values being double-encoded in ACF blocks, Link field insertion triggering premature validation in the Classic Editor, Auto Inline Editing blocks returning incorrect placeholder strings for empty fields from other posts, ACF Blocks crashing when rendering oEmbed fields with titles starting with '[' or '{', PHP warnings from field group location rules without a value, visual appearance fixes for URL/Number/Select fields on WordPress 7.0+, and ACF fields failing to save on WooCommerce orders when using HPOS in compatibility mode.

    10
25. 25
    Article

    WordPress Developer·7w

    What’s new for developers (July 2026)

    WordPress 7.1 enters beta on July 15 with a final release scheduled for August 19, 2026. Key developer-facing changes include: responsive styling now available for testing with a deprecated useResizeCanvas() hook, a merge proposal for expanding the Core Abilities API with read-only abilities, a new wp_knowledge custom post type proposal, React 19 compatibility testing via an experimental Gutenberg flag, hard-deprecation of the __next40pxDefaultSize prop across ~20 components, breaking icon color changes in @wordpress/icons v15, Unicode email address support, AI Client streaming and embeddings primitives, and WordPress Studio now available on Linux. WordPress Playground gained MCP support, WebRTC remote access, and Blueprint v2 infrastructure. WordPress 7.0.1 shipped with 13 Core and 13 Gutenberg bug fixes.

    10