I Have a Dream of a PHP Preprocessor

What if PHP could be faster, stricter, and more expressive, without waiting for PHP 9? What if we could preprocess PHP code into something more optimized, more…

Recently updated PIE extensions #5 (since August 27th, 2026)

27 PHP Pie extensions were updated.

• iliaal/mdparser (0.6.0): Native C CommonMark + GitHub Flavored Markdown parser for PHP, targeting CommonMark 0.31 + GFM. ~10-20x faster than…

Tree-sitter and PHP: Two Directions, Endless Possibilities

Tree-sitter is a very popular library in the computer ecosystem at large. It powers syntax highlighting in Neovim, structural search in VS Code, and a growing wave of…

Adding the last types to PHP code

2026 update note: This is an update of the original 2022 article, with annotations added locally to flag what’s changed in the PHP language since: mainly PHP…

setlocale() and Its Six Personalities

What does setlocale() actually do? It changes the date format, right? It’s a fair guess, and it’s wrong in an interesting way: setlocale() doesn’t touch…

The Clock That Cracks Passwords

To understand what is the clock that cracks passwords, let’s start with a quizz. Which security flaw does the following PHP login check contains?

<?php if ($userPassword == $storedSecret) {…

I recently was troubleshooting how to force the browser to hyphenate a PHP class name, and discovered something new.

The HTML entity ­ is a "soft hyphen"; it won't display unless the browser decides to introduce a line wrap at that point.

It's shy like that.

…

Blocking PHP Reverse Shells: A Config-First Guide

Every PHP reverse shell floating around GitHub, pentestmonkey’s original and the forty-seven forks that added a banner and changed the default port, does the same three things. It…

TypePHP, native PHP, NativePHP: the ecosystem has a vocabulary problem

PHP names things by accretion. A word gets used for something, then reused for something adjacent, then reused again by a project that picked the…

Recently updated PIE extensions #4 (since August 21st, 2026)

25 PHP Pie extensions were updated.

• hmennen90/php-steamworks (v0.15.0): PHP extension providing access to the Valve Steamworks SDK via a flat C API
• symfony/deepclone (v0.8.3): Export any…