A developer built Qbix, a PHP webserver that forks thousands of lightweight worker processes from a single parent process using pcntl_fork(), relying on the Linux kernel's copy-on-write memory sharing. Unlike FrankenPHP, RoadRunner or PHP-FPM, which are limited by worker count due to memory duplication, Qbix lets each worker share the framework's loaded classes and only pay memory costs for pages it actually modifies during a request.
qbixserver.com
· 2026-09-18
A developer who wrote a 174-line PHP polyfill in 2014 as a temporary fix for AOL's content management system has now marked the package as deprecated. The code, originally meant to replace a deprecated function from the pecl_http extension, was shared on Packagist and has since been installed nearly 20 million times, with over 400,000 installs still occurring monthly. It also spread indirectly through WPML, idna-convert, SPIP, and Linux distributions like Debian and Ubuntu.
jakeasmith.com
· 2026-09-15
Hackers are exploiting an unauthenticated file-upload vulnerability (CVE-2026-27540) in the WooCommerce Wholesale Lead Capture plugin for WordPress, versions 2.0.3.1 and earlier, to install PHP webshells. Wordfence says its firewall has blocked over 100,000 attack attempts, with spikes in June, July and August, and the shells allow attackers to gather site information and upload further malicious files.
bleepingcomputer.com
· 2026-09-15
Sophos researchers detailed a second-stage Linux rootkit infecting F5 BIG-IP APM systems, likely delivered after attackers exploited the critical CVE-2025-53521 remote code execution flaw. The malware infects Apache's httpd process, hooks internal functions to intercept PHP file loading, and injects a web shell into memory rather than writing files to disk, while also altering SELinux settings and persisting through firmware upgrades. ESET separately analyzed the same threat under the name PoisonedRefresh.
bleepingcomputer.com
· 2026-09-08
A software developer recounts how a fascination with building things from scratch drew them into programming, initially learning PHP, HTML and CSS to create back-end systems and websites. Over time, the writer says the appeal shifted from the act of coding itself toward creating products people actually use, pushing them toward startups and leadership roles rather than large companies or pure engineering work.
orchidfiles.com
· 2026-09-07
Germany has budgeted €108 million over four years to fund the eleventh version of its Government Site Builder, a PHP-based content management system already used by more than 80 federal agencies to run over 250 websites. The spending splits into €26.88 million for development, €73.2 million for migration and relaunch, and €8 million for operations. The author contrasts this with the roughly $730,000 the PHP Foundation received in total contributions in 2025.
thephp.foundation
· 2026-09-02
Security researchers disclosed CVE-2026-82222, a maximum-severity vulnerability in the GiveWP donation plugin affecting versions through 4.16.7.1. By chaining an unauthenticated registration bypass, an insecure PHP unserialize function, and a gadget chain in bundled libraries, attackers can create an account, plant a malicious object in the plugin's session data, and trigger arbitrary command execution on the server by simply loading a front-end page.
bleepingcomputer.com
· 2026-08-28
GoKawiil