tideways.com
The new Polling API in PHP 8.6 offers a scalable alternative to stream_select(). Using an echo
server, the author demonstrates how it handles thousands of idle connections while keeping latency low.
Developers can attach application data directly to each connection instead of maintaining a separate
mapping.
Picked by Stefan Priebsch –
"PHP core developer Tim Düsterhus shows how a cleaner API can improve both performance and readability.
Keeping connection state alongside the polling handle makes an event loop easier to follow and leaves
less room for mistakes."
dustri.org
The author reverse engineers ionCube's loader and follows the steps from an encoded file to readable PHP.
The investigation covers its encryption layers and modified Zend VM, then uses the loader to recover
bytecode before the protected code executes. It also explores generating a static unpacker with help
from an LLM.
Picked by Sebastian Bergmann –
"This is a detailed account of how PHP bytecode works and how much can be learned by patiently examining
an unfamiliar binary. The author explains the wrong turns as well as the discoveries, which makes the
investigation especially useful."
daubois.dev
Alexandre Daubois explains how PHP's HTTP stream wrapper forwarded sensitive headers when a redirect
changed the request's origin. The article traces the long history of the bug and the fix developed with Jakub
Zelenka.
Picked by Stefan Priebsch and Sebastian Bergmann –
"A routine API call can cross a trust boundary without the calling code making another explicit request.
We appreciate the care that went into this fix, and the explanation of what developers still need to
handle themselves."
