Artisan Weekly Edition 108

Edition №108

Published

Week ending October 30, 2026

Items

10 featured · 5 notable

Editor's
Note

It's been a quieter week, I've managed to take some time off and enjoyed a bit of being out in the open. But i have managed to catch up on some articles

By
Daniel Newns

Top 10 Links

Featured · Edition 108

Blog Post laravel-news.com

Volker Dusch on the PHP RCE Vulnerabilities and Disclosure

Eric Barnes chats to Volker from the PHP Foundation Security Team about the recent PHP2Shell what happened, how the bugs were found and what actually happened with that embargo.

Eric Barnes · Volker Dusch

YouTube Video youtube.com

This Week In PHP Internals | Oct 29, 2026

A week after two critical bugs in PHP's own engine, one developer asked the internals list to freeze new features and cosmetic deprecations until PHP has a formal spec and four independent implementations. Four people who work on PHP replied, and Larry Garfield called fixing PHP's bugs a money problem.

Len Woodward

YouTube Video youtube.com

LARACON EU 2026

All of this years talks from Laracon EU are now available on Youtube, go check out the playlist.

John Rudolph Drexler

YouTube Video youtube.com

PHP Internals: What Really Happened (w/ Derick Rethans)

After the recent PHP security issues, Nuno chats to Derick Rethans from the PHP Internals contributor, talking to us about the timeline what actually happened.

Nuno Maduro · Derick Rethans

YouTube Video youtube.com

Laravel Worldwide Meetup - AI can find it! Semantic search with the Laravel AI SDK

Full-text search doesn't cut it when your client needs to find meaning, not just matching keywords. In this talk, Nico will build real-world semantic search using RAG (Retrieval-Augmented Generation) with Eloquent, Postgres, and the Laravel AI SDK - demystifying chunks, vectors, and embeddings along the way.

Nico Devs

Blog Post laracraft.tech

PHP2Shell: you patched, but were you hit? A read-only triage script for your server

A guide to investigating whether your PHP server was compromised by the PHP2Shell vulnerabilities, featuring a practical read-only triage script to help detect indicators of compromise in your logs and files.

Zacharias Creutznacher

YouTube Video youtube.com

local development might actually be dead

If you've not given AMP a go I 100% recommend it. I've been using it for the last month and am really enjoying it. In this video Nuno has a go and tells us all his thoughts on it.

Nuno Maduro

Blog Post exakat.io

From Commit to Production: How a PHP Fix Actually Reaches You

An in-depth look at how PHP security fixes travel through the ecosystem from initial commit to production servers, detailing the complex supply chain involving release managers, packagers, and distributions worldwide.

Blog Post paulisaris.dev

Serving Large Private Files from Laravel

A comprehensive guide to securely serving large private files in Laravel applications, exploring why the public disk isn't suitable for sensitive data and demonstrating a practical approach using authorised endpoints and filesystem configuration.

Blog Post blog.packagist.com

Composer 2.11 Release

Composer 2.11 introduces a new cooldown dependency policy that withholds newly published package versions for a configurable period, enhancing security against malicious releases whilst providing several performance improvements and security fixes.

Nils Adermann

Also Notable

+5 more

Blog Post masteringlaravel.io

Why does diffForHumans say 1 day ago for something 47 hours old?

Discover why Carbon's diffForHumans() method truncates instead of rounds when displaying relative times, and learn how to customise the output with rounding, additional parts, or compact formatting for more precise human-readable timestamps.

Joel Clermont

Blog Post

Blog Post jasonmccreary.me

I Don't Write Code Anymore

Jason McCreary shares his journey of transitioning from writing code himself to letting AI handle all aspects of development, exploring four distinct stages of AI adoption and how he's maintaining confidence through testing and CI pipelines.

Jason McCreary

Blog Post

Blog Post hafiz.dev

6 Eloquent Patterns That Kill Your MySQL Index

An in-depth exploration of six common Eloquent patterns that inadvertently break MySQL indexes through loss of sargability, with practical fixes and EXPLAIN verification techniques to optimise your queries.

Hafiz Riaz

Blog Post

Blog Post laravel-news.com

Sloppy: Static Analysis for AI-Written PHP

Sloppy is a static analysis tool by heyosseus for the maintenance problems AI coding agents can leave in PHP projects. It runs locally, without a model or API key, and checks for patterns such as swallowed exceptions, duplicate logic, and unfinished method bodies. The same checks apply to code you write yourself; Sloppy makes no attempt to identify AI authorship

Yannick L.

Blog Post

Blog Post sentinel.rootstuff.io

I Replaced 50+ PHP Workers With One Go Process

I run a Laravel monitoring platform and recently replaced its Laravel edge workers with lightweight Go probes. This is a production write-up of why I made the change, what happened to memory usage and check cadence, and why Laravel still runs the rest of the platform. Laravel News also picked up the article this week.

Blog Post