Issue #9

Old lessons, new threats

28 April 2026

"Some lessons age remarkably well. This week, we revisit two classic PHP articles that helped us understand what happens under the hood of PHP. Then we look ahead to an uncomfortable future: AI finding vulnerabilities faster than humans can fix them."
— Stefan & Sebastian

blog.ulf-wendel.de

Prepared statements under the hood

A classic deep dive into how PDO and mysqlnd handle prepared statements. Although written in 2008, it remains a fundamental resource for understanding the nuances of database interactions in PHP and why certain configuration choices matter.

Picked by Stefan Priebsch – "Ulf Wendel was deeply familiar with the PHP database stack at the time. This shows in the level of detail with which he explains the performance impact of prepared statements."

schlueters.de

Do not use PHP references

Johannes Schlüter explains why PHP references are often misunderstood and misused. This post is a timeless reminder that references in PHP are not pointers and can often lead to unexpected behavior and performance issues.

Picked by Sebastian Bergmann – "Written by former PHP core contributor and release manager Johannes Schlüter, this article helps us understand how the language works under the hood."

blog.mozilla.org

When AI finds zero-days faster than humans can fix them

It seems that AI finds previously undiscovered security vulnerabilities so quickly that the only realistic response is to counter it with AI as well. If that is true, then a new arms race has just begun.

Picked by Stefan Priebsch and Sebastian Bergmann – "Open Source maintainers may struggle to keep up without burning out. We need to start talking about this now."