Adding the last types to PHP code 2026 update note: This is an update of the original 2022 article, with annotations added locally to flag what’s changed in the PHP language since: mainly PHP 8.4’s property hooks and asymmetric visibility, which give native answers to several problems the article works around by hand. Adding the […]
02
Sep
Sep
setlocale() and Its Six Personalities What does setlocale() actually do? It changes the date format, right? It’s a fair guess, and it’s wrong in an interesting way: setlocale() doesn’t touch one behavior, it touches six, and most of them have nothing to do with dates. Under the hood it’s a thin wrapper around the C […]
01
Sep
Sep
The Clock That Cracks Passwords To understand what is the clock that cracks passwords, let’s start with a quizz. Which security flaw does the following PHP login check contains? If you said “the password should be hashed with bcrypt”, you are right and you may stay. If you said “use === instead”, you are wrong […]
30
Aug
Aug
Blocking PHP Reverse Shells: A Config-First Guide Every PHP reverse shell floating around GitHub, pentestmonkey’s original and the forty-seven forks that added a banner and changed the default port, does the same three things. It opens an outbound socket, it spawns a shell, and it detaches from the request so it doesn’t get murdered by […]
28
Aug
Aug
What 3052 composer.json files tell us about the Composer plugin ecosystem I like to read composer.json files the way other people read tea leaves. Take enough of them and patterns emerge: which packages everyone depends on, which ones are stuck two major versions behind, and what a minimum-stability field says about a maintainer’s risk tolerance. […]
19
Aug
Aug
The Secret Life of “Magic Null” in PHP PHP 8 has started a tightening in native functions arguments: every version brings stricter checks on calls to common functions. Gone are the days of passing null into a function expecting an integer and hoping for the best. Today, usort($arr, null) or array_walk($arr, null) will instantly crash […]
18
Aug
Aug
PHP Method Resolution Order: Class · Trait · Parent · Interface PHP offers three different places to define a method: directly in a class, in a trait the class uses, and in a parent class it extends. Interfaces define contracts, the method signatures without a body, so they don’t contribute an implementation to the chain, […]
14
Aug
Aug
Recently updated PIE extensions (since 7th, 2026) 24 PHP Pie extensions were updated. bsn4/grpc (v0.3.0): Rust-based gRPC extension for PHP — drop-in replacement for ext-grpc flow-php/flow-php-ext (0.43.0): Flow PHP native extension (Rust) – Floe frame-body encoder/decoder for DataFrame Rows xberg-io/tree-sitter-language-pack (v1.15.0): Pre-compiled tree-sitter grammars for 371 programming languages thomas-0816/pdo-duckdb-php (1.5.5.7): PHP PDO Driver for DuckDB, […]
13
Aug
Aug
What Can Implement An Interface In PHP? Ask a PHP developer what implements an interface, and you will get class Foo implements Bar. Ask again, insist a little, and you might get abstract class. Ask a third time and people start looking at their shoes. Yet the implements keyword, and its cousin, extends, has a […]
12
Aug
Aug
Two Large PHP Datasets, and How to Read Them With Itself PHP has a large code base online. At Exakat, we run the engine on a corpus of 3000+ open source projects. If you want to train, fine-tune, or evaluate an AI model on PHP code, or just mine a few hundred thousand real-world snippets […]
09
Aug
Aug
Convert a boolean into a string What could go wrong? I was recently spelunking through the Cornstack/nomic training dataset, the massive corpus of code that feeds some of our modern AI overlords, when I noticed something amusing. One of the queries in that dataset ask how to “convert a boolean to a string in PHP,” […]