ABOUT THIS EPISODE
Hosts: Joe Ferguson, Sara Golemon & Holly Schilling
A surprise RC7, assembly-level ABI detective work, Claude landing commits in php-src, a survey on why nobody upgrades, Portuguese wiring codes, and the corporate spy saga that ate your RAM. Just an “off week.” The Surprise RC7 and the Last-Minute Regression
Joe, serving as a first-time release manager alongside Matteo Beccati, walked through why PHP 8.6.0 RC7 appeared seemingly out of nowhere. RC6 was tagged on the usual Tuesday cadence, but a regression needed to land, leaving the team a choice: ship 8.6.0 GA with a known regression where working 8.5 code would break on upgrade, or throw another RC. As Joe put it, he’d rather apologize for a last-minute RC than apologize for a regression on GA.
The decision was made easier by the fact that packagers like Remy need lead time to rebuild extensions. Because the team committed to an extra RC, they were also able to slip in a few nice-to-haves, including some use-after-free OpenSSL fixes that were all public knowledge and nothing security-embargoed.
Sara fully endorsed the “when in doubt, add an RC” philosophy, pointing out that releases happen on Thursdays precisely so the weekend acts as a buffer. A December GA wouldn’t be the end of the world either — uptime-conscious shops wait until January anyway, giving the packages and the public beta crowd time to shake out surprises. Holly reminded everyone: this is a release candidate, not a release. Don’t run it in production.
Reading Assembly to Hunt an ABI Break
The RC saga tied back to an earlier mistake: the ABI version bump that was missed in RC3 because of the CVE scramble on the 21st. That meant RC3 and RC4 could have had nasty extension conflicts, and anyone seeing weird extension behavior on those builds was likely hitting the ABI break that wasn’t caught until RC5.
Joe showed off Daniel Scherzer’s blog post, which drops down into the actual assembly and diffs the obj-dump output for the exception check. The trio squinted at near-identical instruction listings until the real difference surfaced: a jump target that moved from one address to another — about 32 bytes off from where the code expected to be looking.
Sara reverse-engineered the cause live: roughly four word-sized fields had been added to the end of a structure (it’s in Reflection), shifting every subsequent offset. She explained the ABI lesson clearly — a header says “this field is X bytes into the structure,” and if you mix an 8.5 header with an 8.6 build, you read garbage memory. For a plain integer that’s bad data; for a pointer, the CPU politely tells you to fuck off, mate. The catch: it only bites extensions built as separate shared objects, not statically built ones.
Claude as a Contributor and the “Humans.txt” Problem
Joe raised a spirited discussion happening in the PHP Foundation’s internals Slack: Claude Code now shows up as a contributor in php-src, and some worry that reads like the project endorsing a commercial AI tool. Sara pushed back — commits attributed to @yahoo.com or @facebook.com addresses aren’t endorsements, they’re just people contributing while earning a living. Holly added that mailing lists and git clients have appended “Sent from my iPhone” style signatures forever and nobody cared.
The real sticking point, Joe argued, is that AI-generated contributions haven’t been tested against open-source licensing in any legal system, yet those contributions are now in the project. Sara pointed to php.net/humans.txt, which still reads “built by humans, mostly” — a “mostly” she thinks may have quietly been there all along.
The conversation also detoured into Claude’s new 5.2 behavior around security: it’ll audit your own code and describe exploits with suggested patches, but it won’t generate a proof-of-concept exploit to actually validate the vulnerability. Holly found that limitation a bit pointless, while the gang schemed about pointing it at localhost.
Why Teams Don’t Upgrade PHP
Joe dug into a recent opt-in survey about what blocks teams from upgrading. The headline findings: it’s almost never a single blocker (47–51% cite more than one), 86% cite at least one business or resource reason, and 51% say there’s no visible ROI in upgrading. Sara’s immediate rebuttal: if you’re on PHP 5, there absolutely is an ROI — you can run half as many servers.
Holly aired a pet peeve that upgrading a language version shouldn’t break things, prompting a friendly “citation needed” from Sara. Joe countered that the real pain in legacy apps (pre-8) is usually unvetted, unmaintained dependencies — the one-off package that did one thing well but got abandoned, so even 5.5 to 5.6 broke it. Sara agreed that’s an ecosystem problem, not PHP’s fault, and challenged the group to name actual PHP-caused breaks: pulling mysql out of core, the ternary precedence swap, and little surprises like opcache becoming standard.
That opcache change was exactly Holly’s lived example: an 8.3-to-8.5 Docker build broke because a now-unnecessary build step for opcache failed with no obvious documentation. Sara’s gentle suggestion to read the migration guides (plural, since it was a two-version jump) sparked some mock outrage, but the underlying point stood — unnecessary friction is a real cost, and the bigger the version gap, the more insurmountable the step. The survey also noted 56% cite missing tests or staging environments, and even many who run automated tests lack confidence in their coverage.
Home Automation, Portuguese Wiring, and the Spouse Test
A tangent about testing “wiring” turned literal when Sara revealed she’s been rewiring her new place in Portugal — where brown is live and blue is neutral (IEC color codes), which Joe immediately flagged as a nightmare for the colorblind. Sara’s home is heavy on automation: motorized metal sun shutters, IKEA smart bulbs in GU10 sockets, Shelly modules behind the light switches, internet-connected heat pumps, and a smart plug that only runs the water heater in the cheap overnight electricity window.
The group compared setups and the all-important “spouse test.” Joe keeps it minimal — doorbell camera, backyard security cam, and a Google Nest thermostat that keeps re-adding a schedule he deleted — and admitted his Jellyfin server didn’t pass the spouse test at all. Sara and Joe both evangelized Home Assistant: mostly Python but happy to call out to PHP scripts that return JSON, container-friendly via docker-compose, and far from the painful early days of home automation.
They swapped favorite automations — Holly’s litter-box nag texts and fridge-door-left-open light color alerts, Joe’s jealousy over people graphing solar production in the Rove Discord’s home automation channel. Add an MQTT broker and Node-RED and you’ve got message buses the whole house can listen to. Holly offered to info-dump on anyone who drops by Discord’s general channel (dark mode supported, naturally).
The NVIDIA Spy Saga and a GA on the Horizon
Somewhere between RAM shortages and bad TV writing, the crew riffed on the ex-NVIDIA CEO news — allegedly running GPUs on Chinese hardware he wasn’t married to, plus a third “integration” that shouldn’t have been happening, with a spy in the mix and the board already preparing to oust him. Joe shared a Mastodon favorite: a “NVIDIA CEO transitions” headline quote-tooted with “I’m so happy for her,” which Holly and Sara declared very brave in this climate.
Back to business: PHP 8.6.0 is scheduled to hit general availability on November 19th, and the team floated doing some live server upgrades as a “release party” during next week’s recording. Huge shout-out to Matteo (watching live from a very late timezone) for herding php-src pull requests and pinging contributors for approvals to get RC6 and RC7 ready. And as always — there are socks that need selling, a freshly leaked phparch.com redesign to break, and a PHP Arch cowboy hat the people are now demanding.
Links from the show:- PHP Tek 2027 — Chicago, April 27–29, early bird tickets available
- Join the PHP Architect Discord
- production.phparch.com — the new site preview (go break it, nicely)
- Home Assistant — open-source home automation
- What stops PHP teams from upgrading
- What happened to PHP 8.6.0RC6?
- Mastodon: @joepferguson@phpc.social
- PHPArch.me: @svpernova09
- Mastodon: @pollita@phpc.social
- Mastodon: @TheCodeLorax@tech.lgbt
Looking to hire PHP developers? Email support@phparch.com – Joe and the team are available for consulting, infrastructure work, Ansible playbooks, and code review.
PartnerThis podcast is made a little better thanks to our partners
Your security posture, on autopilot with OurCVEs
Cut code review time & bugs in half instantly with CodeRabbit.
Your PHP codebase deserves a partner, not a contractor. PHP Architect provides long-term technical partnerships for organizations that need senior-level PHP expertise that you can depend on. https://www.phparch.com/consulting/
Music Provided by Epidemic Sound
https://www.epidemicsound.com/
Join Us Live Next WeekGot feedback? Join us on Discord at discord.phparch.com
The post The PHP Podcast 2026.11.12 appeared first on PHP Architect.
