php[podcast] episodes from php[architect]

PHP Podcast – June 11, 2026

Guest Hosts: Sara Golemon, Elizabeth Barron & Holly Schilling

Eric and John are out this week — Sara, Elizabeth, and Holly take over. Here’s what they covered:

PHPVerse Recap

PHPVerse just wrapped up, and Elizabeth was there in Amsterdam. The format is unusual — all speakers are flown to one location, but the audience is entirely virtual. It was a class act: professional TV crew, studio lighting, and a makeup and hair team on site. Around 2,500–3,000 people watched the live stream. Everything was broadcast as one long block; individual talk segments and possibly the documentary trailer will be cut and released separately. The full stream is available now — the PHP documentary trailer (produced by Jet Breeze, covering 30+ years of PHP history) appears around the 2:24:30 mark.

PHP Foundation 2026 Strategy Document

Elizabeth and the PHP Foundation released their 2026 strategy document the same day as this recording. The foundation gathered community input across numerous conversations and conferences, synthesized it into findings, and has now published a plan for the rest of the year. Key themes: repositioning PHP’s public perception (which Elizabeth calls a solvable problem), creating six special interest groups, and launching an Onboarding Initiative to build a real on-ramp for new PHP developers. Elizabeth’s view is that the two things giving her the most hope for PHP’s future are the passion and expertise of the community, and how good the language itself has gotten. Visit thephp.foundation to read the full document.

The Onboarding Initiative

One of the six special interest groups the foundation is launching is specifically focused on bringing new developers into PHP. Goals include creating a true learning path (not just a reference manual that assumes existing knowledge), improving educational resources, and potentially working with the php.net website to improve the first-time experience. Holly made the point that PHP’s barrier to entry is genuinely lower than almost any other language — the Hello World program is 11 characters — but that story isn’t being told outside the PHP bubble. New developers are turning to JavaScript as a first language and running into minified spaghetti instead of something approachable.

AI Writing PHP — And PHP as a Second Language

Holly built the entire PHP Tek conference app backend in Laravel without writing a single line of code herself — AI-generated throughout, which she reviewed and approved. The code held up to peer review at the conference with only minor style nits. She ran it on PHP 8.3 and used modern standards throughout (one piece of feedback: stop using empty()). The consensus: AI models write good modern PHP because of the vast amount of open source PHP they were trained on. The caveat Sara raised is worth thinking about — how much of that training data is PHP 4-era code and WordPress 3 repositories? Either way, Holly’s case for PHP as a second language is strong: low ceremony, low boilerplate, readable syntax, and it’s a language where you can do something useful in minutes.

PHP’s Reputation Problem (and Why It’s Fixable)

The group dug into PHP’s perception gap — the mismatch between how good the language actually is and how it’s perceived outside the community. Holly’s experience as a mobile developer who recommends PHP to others: the pushback is immediate (“isn’t that slow?”, “isn’t that dead?”). The benchmarks don’t support that reputation — PHP outperforms Python on most comparable workloads — but data alone doesn’t shift perception. Elizabeth’s point is that this is primarily a storytelling and coordination problem, not a language problem, and that the foundation’s repositioning work is exactly aimed at closing that gap. The community has the passion. It just needs to tell the story outside its own bubble.

PHP Polling API RFC

Sara walked through the RFC for a new Polling API in PHP (wiki.php.net/rfc/poll_API). The short version: PHP currently has five or six different ways to do I/O multiplexing (watching multiple streams and acting on whichever one is ready first), and which one works depends on the OS, available extensions, and PHP version. The Polling API proposal creates a single, unified interface that abstracts all of that. The immediate beneficiaries are async frameworks like Amp PHP, ReactPHP, and Revolt, which currently have to maintain multiple backend implementations to cover different environments. The bigger picture: this is a building block on the path toward true async PHP, likely contributing to something more complete in PHP 9.0. Most app developers won’t use it directly — but the libraries they depend on will. RFCs are all listed at wiki.php.net/rfc.

PHP.net: Do As We Say, Not As We Do

Sara, who has contributed to php.net, copped to the state of the codebase: some of it dates to the PHP 3 era, there are functions.inc files, and it is very much “do as we say, not as we do.” The historical reason is that php.net used to rely on community-administered mirrors (r-synced servers running everything from PHP 5.1 to 5.6 simultaneously), so modernizing the code was impossible without controlling the runtime. That’s changed with CDN-based load balancing — they can now control what PHP version runs on php.net — and the code has been getting better. But it’s a slow process.

PHP Podcasts Past, Present, and Future

Holly asked about the PHP Town Hall podcast (Ben Edmonds and Phil Sturgeon), and the group did a quick tour of PHP podcast history. The PHP Roundtable — originally started by Sammy, taken over by Eric — has produced about three episodes. Sara and producer Joe are planning to take it off Eric’s hands and actually do it properly. And Elizabeth announced that the PHP Foundation is launching a new podcast: tentatively called PHP at Scale, hosted by Ben Marx, focused on telling the stories of organizations pushing PHP to its limits. No launch date yet, but there’s already a queue of interested guests.

Next Week’s Show — Moved to Wednesday

Sara will be on a boat off the coast of Galicia on Thursday, so next week’s episode is moving to Wednesday. Guests will include Paul Reinheimer and (hopefully) Sean Coase — two veterans from PHP’s podcasting past. Elizabeth is going to try to make it work around the Canadian Grand Prix.

Mac Mini M4 for Local LLMs

Holly picked up a refurbished Mac Mini M4 (16GB RAM, 512GB storage) specifically to run LLM models locally via Ollama. Apple Silicon is a solid choice for this because the unified memory architecture gives the neural cores access to far more RAM than a discrete GPU setup. Sara is waiting for the M5, which is reportedly not coming until fall — and is already resigned to spending too much on it when it lands.

Links from the show:

PHP Foundation — 2026 Strategy Document

PHP RFC: Polling API

PHP RFC Wiki — All RFCs Under Discussion

Amp PHP — Async framework

ReactPHP — Event-driven async PHP

Revolt — Event loop for PHP

php.net website source code (github.com/php/web-php)

PHP Architect Discord

Guest Hosts:

Sara Golemon

Based in Lisbon, Portugal

PHP core contributor; code contributor via the Curl project (which means she technically has code on Mars)

Elizabeth Barron

Executive Director, PHP Foundation

Based in Germany

Holly Schilling

Primary mobile developer; built the PHP Tek 2026 conference app

Based near Chicago, IL

Streams:

Youtube Channel

Twitch

Connect & Hire

PHP Architect Website

Twitter/X

Mastodon

Hire PHP Developers

Looking to hire PHP developers? Email support@phparch.com – Joe and the team are available for consulting, infrastructure work, Ansible playbooks, and code review.

Partner

This podcast is made a little better thanks to our partners

Displace



Infrastructure Management, Simplified

Automate Kubernetes deployments across any cloud provider or bare metal with a single command. Deploy, manage, and scale your infrastructure with ease.

https://displace.tech/



PHPScore

Put Your Technical Debt on Autopay with PHPScore



Music Provided by Epidemic Sound

https://www.epidemicsound.com/

Join Us Live Next Week

Note: Next week’s show is on Wednesday (not Thursday) with guests Paul Reinheimer and Sean Coase.

Youtube Channel

Got feedback? Join us on Discord at discord.phparch.com

The post The PHP Podcast 2026.06.11 appeared first on PHP Architect.

PHP Podcast – June 4, 2026

Hosts: Eric Van Johnson & John Congdon

Another fun episode of the PHP Podcast! Here’s what we covered:

PHP Tek 2027 — New Dates, Bold New Format

Mark your calendars: PHP Tek 2027 is happening April 27–29 in Chicago, and Eric and John are shaking things up. Rather than a straight three-day PHP conference, next year gets three tracks — two of which are familiar PHP-focused content, and a third specialty track that rotates each day: one day of JavaScript, one day of DevOps, and one day of Laravel. The Laravel track is specifically focused on how developers actually use the framework day-to-day, not a product pitch. Single-day passes will be available, so if you’re only coming for the DevOps or JS day, you’re covered. One important heads-up: there’s a big convention happening at a venue nearby in Rosemont, so the hotel block could sell out faster than usual. When they open reservations, don’t wait.

Holly the Elephant Is Going Fast

The PHP Architect conference elephant, named Holly, is now available at store.phparch.com, and demand has been remarkable. Eric woke up one morning to a flood of orders and genuinely couldn’t figure out what happened. The warning from last year applies here: people said they’d grab Tony later, and now Tony is gone forever. Holly ships June 17th for most orders, but if you’ve already ordered, it’s likely on its way. Get yours while you can.

PHP Tek TV Is Doing Something Different This Year

In past years, conference talk videos would get edited and uploaded weeks (or months) after the event. This year, John is doing things differently: the raw, unedited recordings are going up now, with timestamps in the description so you can jump straight to specific talks — some rooms recorded a seven-hour continuous feed and just left it running. The clean edited versions are still coming (a video editor friend in the UK is on it), but if you want to see a talk right now, the raw version is there. Audio quality varies by room, but it’s watchable.

Immich — A Self-Hosted Google Photos That Actually Works

John has been running Immich, a self-hosted photo management platform, in a Docker container for about a month and loves it. It does facial recognition, GPS tagging, and auto-uploads from his phone — essentially everything he cares about in Google Photos, without handing his photos to Google or Apple. He’s now planning to use it as the PHP Architect conference photo library, centralizing all the Tech photos in one browsable, shareable place. It’s fully open source, with no licensing cost, and an optional donation tier. If you’re sick of paying ever-increasing storage bills to big tech companies, this is worth a look.

Ben Ramsey’s PHP Tek Homecoming Article Is Free to Read

The May issue of PHP Architect magazine is now available to digital subscribers, and this month’s free article is Ben Ramsey’s piece on the PHP Tek homecoming experience. Eric reached out to Ben last minute and he delivered. If you’ve never subscribed, this is a low-barrier way to see what the magazine is like. Head to phparch.com, grab the free article, and if you like what you see, subscriptions are not expensive.

John Is Resurrecting a Legacy Laravel App — With Claude’s Help

John has been grinding away on a Laravel 6 app that was a passion project years ago and has now been revived as an actual client project. Using Claude to methodically baby-step through each version upgrade — starting with writing tests to establish a baseline — he’s worked up through the major Laravel versions. The turning point came when he hit the version where the old event sourcing package (Prooph) was clearly on its way out, and the decision was made to migrate to Verbs, Nuno Maduro’s Laravel-native event sourcing package. John’s now looking forward to it. He’s also accidentally been burning tokens on the company Anthropic account (not his personal account), which Eric caught live on air. They are going to talk about it after the show.

Eric’s Mystery Side Project Is Almost Ready — If DNS Would Cooperate

Eric teased a new side project last week and intended to reveal it this week, but he’s stuck waiting on DNS propagation. The domain was registered with DigitalOcean DNS already in use by a previous owner, so Eric moved it to Cloudflare — only to discover there may be a conflict because the previous owner was also on Cloudflare. The result: the name servers are stuck on old values. John’s live suggestion was to move it to Route 53, and Eric was immediately sold. The project is almost ready to show the world, DNS gods willing.

Meta’s AI Support Bot Got Socially Engineered

Eric shared a video demonstrating how someone prompt-injected Meta’s AI customer support bot into sending a verification code to an attacker-controlled email address — and then using that code to add the email to an account, enabling a full password reset and account takeover. The irony: Meta is the company behind Llama and has some of the deepest AI expertise on the planet, and they still shipped a support bot with permissions it shouldn’t have. Eric’s point was pointed: you can fire a human employee who gets social engineered, which creates accountability throughout the team. An AI has no such incentive structure. Crowbarring AI into account-modification workflows without appropriate guardrails is just asking for this.

The PHP Foundation Now Publishes Board Meeting Minutes

Eric discovered that the PHP Foundation has started publishing their board meeting minutes in a public GitHub repository. Nothing earth-shattering yet, but seeing who attended, what was discussed, and what decisions are being made gives the community a real window into how the foundation operates at scale. It also helps explain something Eric and John have always found interesting: why PHP stalled so hard between versions 5 and 7. There was no foundation, no financial backing, just volunteer hours. Now there’s a paid staff and governance structure — and the minutes show exactly how complex running something at PHP’s scale actually is.

The PHP Foundation Has a Dedicated Security Team Now

Speaking of the Foundation, it now has a dedicated security team — a sign of how seriously the supply chain attack problem has gotten. AI tools are being deployed by black hat actors to find vulnerabilities in open source projects at a scale that wasn’t possible before. PHP is not just another open source project; it underpins a massive slice of the web, and companies depend on it staying secure. Having a team specifically focused on this is the right call, even if it’s a sobering reminder of where the threat landscape is heading.

Moat — Nuno’s GitHub Security Auditing Tool

Nuno Maduro (of Laravel fame) quietly shipped a tool called Moat that audits your GitHub presence for security gaps. Install it globally via Brew or Composer, point it at your GitHub org, a specific repo, or even a specific branch, and it gives you a report on where your security posture could be improved. It’s read-only — it won’t change anything — and it’s explicit that it is not a security certification. Eric wants to use it to audit the PHP Architect organization’s repos, many of which haven’t been touched in years. Think of it as a fast, opinionated triage tool, not a replacement for a real security audit.

Links from the show:

PHP Tek 2027 — Chicago, April 27–29

PHP Architect Store — Holly the Elephant

Immich — Self-Hosted Photo Management

PHP Architect Magazine

Verbs — Laravel Event Sourcing by Thunk

Moat — GitHub Security Auditing by Nuno Maduro

PHP Foundation on GitHub

PHP Architect Discord

Host:

Eric Van Johnson

X: @shocm

Mastodon: @eric@phparch.social

Bluesky: @ericvanjohnson.bsky.social

PHPArch.me: @eric

John Congdon

X: @johncongdon

Mastodon: @john@phparch.social

Bluesky: @johncongdon.bsky.social

PHPArch.me: @john

Streams:

Youtube Channel

Twitch

Connect & Hire

PHP Architect Website

Twitter/X

Mastodon

Hire PHP Developers

Looking to hire PHP developers? Email support@phparch.com – Joe and the team are available for consulting, infrastructure work, Ansible playbooks, and code review.

Partner

This podcast is made a little better thanks to our partners

Displace



Infrastructure Management, Simplified

Automate Kubernetes deployments across any cloud provider or bare metal with a single command. Deploy, manage, and scale your infrastructure with ease.

https://displace.tech/





PHPScore

Put Your Technical Debt on Autopay with PHPScore

CodeRabbit

Cut code review time & bugs in half instantly with CodeRabbit.



Music Provided by Epidemic Sound

https://www.epidemicsound.com/

Join Us Live Next Week

Youtube Channel

Got feedback? Join us on Discord at discord.phparch.com

The post The PHP Podcast 2026.06.04 appeared first on PHP Architect.

PHP Podcast – May 28, 2026

Hosts: Eric Van Johnson & John Congdon

Links from the show:

PHP barely avoided disaster – YouTube

CVE-2026-45793: Anatomy of a 14-Hour PHP Supply-Chain Near-Miss · graycoreio/github-actions-magento2 · Discussion #261 · GitHub

An Update on Composer & Packagist Supply Chain Security

PHP Tek: A Homecoming by Ben Ramsey

Tek Roundup – Roave

Speaking at PHP Tek 2026! #tech – YouTube

PHP Tek is behind us, the ballroom is cleaned up, and we’re back to talk about all of it. Here’s what we covered:

RIP Archie Bot

After a long fight to keep him alive, Eric has officially retired Archie — the Discord bot built on OpenClaw that handled team standups, monitored PHP Architect’s Twitter/X group for join requests, and did a surprising amount of background work for the consulting team. When Anthropic shut down the OpenClaw API, Eric tried every model and service he could find to bring Archie back to form, but nothing got him all the way there. After a month of “almost working,” the call was made. He’s dead. Eric hasn’t ruled out revisiting it eventually — maybe with Claude Cowork — but for now, the bot is gone and the starting-soon link in Discord is broken because of it.

Reviving a Six-Year-Old Codebase

A client PHP Architect Consulting worked with from 2018 to 2021 has come back. The project — a reimagining of their app — was killed off when COVID hit and the CEO couldn’t align with the team’s vision. The last commit was six years ago. Now the client wants to bring it back, and Eric is spending the next few days analyzing what it’ll take to get it running again. Outdated packages, an old PHP version, and the general entropy of time are all on the checklist. Eric has genuine affection for this codebase — it was one of the first projects where he felt like the team was truly operating as a team, not just as an extension of him. Now it’s time to dust it off.

Partner Spotlight: PHP Score → Our CVEs

The PHP Score sponsor read may be getting a refresh — the folks at Artisan Build, who built PHP Score, have a new product they’re excited about: ourCVEs.com. It monitors your codebase’s Composer and NPM packages — and optionally your servers via a lightweight agent — for exposure to open CVEs, and alerts you when something needs attention. Pricing is generous: free forever for open source projects, $17/month for solo devs, $83/month for teams (or $1,000/year), with server monitoring scaling at $1 per server above 50. Ed from Artisan Build was at PHP Tek and made a strong impression. Go check it out at ourcves.com.

How PHP Barely Avoided a Supply Chain Disaster

Brent Roose released a 22-minute video covering a near-miss in the PHP ecosystem involving GitHub and Composer. The short version: GitHub changed their token format and briefly released it before Composer was ready to handle it. Composer was logging the token when the format check failed — meaning GitHub tokens were ending up in CI logs. In GitHub Actions, depending on how your action is configured, that container (and its token) might stick around for a while, giving an attacker a window to act. An alert developer caught the issue, used Claude to help research it, then did responsible disclosure — contacting the Composer maintainers and reaching out to Taylor Otwell, Vincent Pontier, and others in the ecosystem to disable their actions until the fix was in place. Update your Composer. GitHub rolled back the new token format but won’t keep it rolled back forever.

Packagist MFA and Account Security

Following up on the supply chain theme: Nils and Igor (Composer/Packagist maintainers) released a blog post on what they’re doing to improve supply chain security. The immediate ask for anyone publishing packages is to enable MFA on your Packagist account — it’s not required yet, but it will be. Eric went to check his own account, found MFA was already on, but noticed his username was still “diegodev” and he was using an old email. While updating it, he noted that Packagist didn’t require him to re-authenticate or confirm the change via the old email — a gap worth flagging if you have popular packages and someone ever gets into your session.

PHP Tek 2026 Recap — The Good

PHP Tek 2026 in Chicago is done, and despite everything (see below), the team is proud of how it went. Some highlights:

Holly (CodeLorax) built a conference mobile app from scratch, released on both Google Play and the Apple App Store within 24 hours of the conference opening. The app let attendees build their own schedule, detected conflicting talk selections, sent push notifications when talks moved rooms, and even included a vendor lead-scanning feature where vendors could scan attendee QR codes to capture contacts. It was a genuine game-changer for the event. Eric and John named the conference elephant after Holly in appreciation — she also changed a trailer tire during setup, which sealed the deal.

Clayton Kendall sponsored and produced the conference shirts and bags on an extremely tight timeline — shirts two weeks out, bags just one week before the event. Both were a hit. Attendees at the conference were getting questions about the rainbow PHP Architect shirt in particular.

A job fair ran for the first time, with four companies represented. One hiring manager showed up even though they already had 1,400 applicants — because they knew that conference attendees are exactly the kind of motivated, self-improving developers they want. Attendees got to ask questions directly, including the real-world stuff like remote vs. office. Eric would love feedback on how to make it better next year.

JS Tech debuted as a fourth track alongside the three PHP tracks, bringing in fresh faces from the JavaScript community. Eric came away energized by the cross-pollination — different people, different approaches to similar problems.

Ben Ramsey and James Tickham (Rove) both wrote great blog posts about the conference. Ben’s will be featured in the magazine. Diana Pham also put together a video recap. Links in the show notes.

PHP Tek 2026 Recap — The Incident

On Monday during final setup, a hotel employee had a medical incident while walking through the main ballroom — leaving a trail that required hazmat-suited cleanup crews and forced the team to quarantine the ballroom, the hallway leading to it, and the adjacent bathroom. The person is okay and was back at the hotel by Friday, which was a relief. But in the moment, nobody knew what was happening or how long the room would be unavailable.

The team had to rebuild the entire conference footprint overnight. The keynote moved, the JS Tech track went into the quiet room, vendors moved to the atrium, and the hotel staff — to their enormous credit — cleared their own furniture and accommodated every ask without complaint. Attendees were equally patient; once they understood the situation, there was no drama, just “tell us where to go.”

The incident also took out the streaming setup for day one, compounding an already-difficult start. The solution that eventually worked — plugging the Ethernet into a hub before the streaming equipment — wasn’t tried until day three. Eric is mad at himself for thinking of it and not doing it sooner.

PHP Tek 2027 — Save the Date (TBD)

Planning for next year is already underway. The current target is April 2027 — away from the May timing that caused Eric to miss two of his kid’s band performances this year. Nothing is locked yet, but they’re working through venue and date options and hope to have an announcement soon.

Links from the show:

ourCVEs.com — Daily security audit on autopilot

PHPScore — Technical debt monitoring for PHP

Brent Roose — “How PHP Barely Avoided Disaster” (YouTube)

Packagist — Enable MFA on your account

PHP Architect Discord

PHP Architect Merch Store

PHP Architect YouTube

Host:

Eric Van Johnson

X: @shocm

Mastodon: @eric@phparch.social

Bluesky: @ericvanjohnson.bsky.social

PHPArch.me: @eric

John Congdon

X: @johncongdon

Mastodon: @john@phparch.social

Bluesky: @johncongdon.bsky.social

PHPArch.me: @john

Streams:

Youtube Channel

Twitch

Connect & Hire

PHP Architect Website

Twitter/X

Mastodon

Hire PHP Developers

Looking to hire PHP developers? Email support@phparch.com – Joe and the team are available for consulting, infrastructure work, Ansible playbooks, and code review.

Partner

This podcast is made a little better thanks to our partners

Displace



Infrastructure Management, Simplified

Automate Kubernetes deployments across any cloud provider or bare metal with a single command. Deploy, manage, and scale your infrastructure with ease.

https://displace.tech/





PHPScore

Put Your Technical Debt on Autopay with PHPScore



CodeRabbit



Cut code review time & bugs in half instantly with CodeRabbit.



Music Provided by Epidemic Sound

https://www.epidemicsound.com/

Join Us Live Next Week

Youtube Channel

Got feedback? Join us on Discord at discord.phparch.com

The post The PHP Podcast 2026.05.28 appeared first on PHP Architect.

PHP Podcast – May 14, 2026

Hosts: Eric Van Johnson & John Congdon

Another fun episode of the PHP Podcast! Here’s what we covered:

PHP Tek Is Four Days Away

The countdown clock is basically ticking in real time — PHP Tek 2026 in Chicago is just four days and ten hours out as this episode begins. Eric flies Friday, John flies Saturday, and the team descends on the venue Sunday to get the trailer unloaded, the booth assembled, and everything tested before the conference kicks off. The conference magazines — ordered three weeks ago and still showing “printing” on Tuesday — pulled through at the last minute and are set to arrive at the venue tomorrow. That’s cutting it close, but it counts.

Win a Free PHP Tek Ticket — Live on Air

John put a full conference ticket up for grabs: DM him on any social platform, and he’d draw a winner on the live stream. The caveat? You had to be watching live — audio listeners are out of luck on this one. The lucky winner drawn on air was Jeffrey Davidson, who will now be at PHP Tek. Eric offered to even bring him to the team’s Saturday minor league baseball game if he flies in early enough. Jeffrey gets a hand-printed sticker name badge, but he’ll have a badge.

New PHP Architect Conference Merch

Fresh shirts are coming to the PHP Tek booth courtesy of Clayton Kendall, who is producing the apparel. The new design goes with a smaller logo placement — a more subtle, wearable-anywhere look compared to the big bold prints. If you’re headed to Chicago, swing by the PHP Architect table and see what’s there.

Holly’s Conference App Gets a Vendor Mode

The PHP Tek attendee app built by Holly (developed by CodeLorax) has been upgraded ahead of the conference. What started as a schedule browser with conflict detection and push notifications has now merged with a vendor lead scanning tool. Attendees can log in by scanning the QR code on their badge, and vendors can scan attendee badges to capture leads — all in a privacy-preserving way that doesn’t expose raw contact data. Eric’s wife Bek figured out the app entirely on her own without being told anything, which remains one of the best usability endorsements you can give.

Something Big Is Happening in the PHP Community

Eric teased something he can’t officially talk about yet — a community acquisition that’s still working through the legal and DNS transfer process. A new droplet has been created. Joe has already figured out what it is. Eric is too excited not to bring it up but too responsible to spill the details before it’s official. The plan is to announce after PHP Tek. If you want to know early, apparently getting Joe drunk at the conference is your best strategy.

Grok AI Exploited via Morse Code in Bank Transactions

A video from the Dave’s Garage YouTube channel surfaced a genuinely unsettling AI exploit: someone used a Grok-powered AI banking agent and embedded hidden instructions inside transaction memo fields — written in Morse code. The agent decoded the dots and dashes, interpreted them as instructions, and followed them, ultimately losing somewhere between $154,000 and $200,000 in crypto transfers. This is prompt injection in its most creative and alarming form yet. The attack surface for AI agents hooked into real financial systems is not theoretical — it’s happening.

TanStack Hit by NPM Supply Chain Attack

The TanStack ecosystem — the popular query, router, and table libraries — was hit by a supply chain attack via GitHub Actions cache poisoning. The attack vector was a forked pull request: a malicious fork can trigger GitHub Actions workflows and potentially inject poisoned artifacts into the build cache, which then get picked up by the legitimate package. Simon Hamp from NativePHP caught it and raised the alarm in the PHP Architect Discord. It’s a good reminder that the supply chain attack surface extends well beyond just what’s in your `composer.json` or `package.json` — your CI pipeline’s caching behavior matters too.

PHP Tek Job Fair — Wednesday Afternoon

There will be a job fair at PHP Tek this year, scheduled for Wednesday afternoon. At least one confirmed hiring manager will be there. If you’re looking for PHP work, or if you’re a company looking for PHP talent, this is worth planning around. Eric and John both see it as a natural fit for the conference — the PHP community is tight-knit enough that a job fair actually means something.

Eric’s Birthday Spa Day in Palm Springs

Eric’s wife Bek surprised him with a birthday spa day in Palm Springs. It was his first massage ever, and he paired it with a mineral soak in the natural springs. He came away thoroughly convinced — the combination of the mineral water and a proper massage left him feeling better than he expected, and he’s already thinking about going back. Beck planned the whole thing, and Eric was appropriately grateful.

John’s First Couples Massage

John has now also had his first couples massage, and it did not go quietly. He opted for deep tissue — which means the therapist was working hard — and his wife, in the room next door, was apparently convinced something was wrong based on the sounds coming through the wall. John described it as the kind of massage where you’re not entirely sure if you’re being helped or attacked, and the answer turns out to be both. He’d do it again.

PHP Architect Becomes Padres Season Ticket Holders

Eric and John are now official San Diego Padres season ticket holders — their first year in the program. As first-timers, they’re at the very bottom of the seniority ladder, which means they were among the last to pick seats. John blames Eric for not signing up years ago. There’s an upcoming Wednesday day game against the Dodgers with available tickets if anyone in San Diego wants them — reach out to John.

Links from the show:

PHP Tek 2026 — Chicago

TanStack — Open Source Data Tools for the Web

NativePHP — Simon Hamp’s Native App Framework for PHP

PHP Architect Store

PHP Architect Discord

Host:

Eric Van Johnson

X: @shocm

Mastodon: @eric@phparch.social

Bluesky: @ericvanjohnson.bsky.social

PHPArch.me: @eric

John Congdon

X: @johncongdon

Mastodon: @john@phparch.social

Bluesky: @johncongdon.bsky.social

PHPArch.me: @john

Streams:

Youtube Channel

Twitch

Connect & Hire

PHP Architect Website

Twitter/X

Mastodon

Hire PHP Developers

Looking to hire PHP developers? Email support@phparch.com – Joe and the team are available for consulting, infrastructure work, Ansible playbooks, and code review.

Partner

This podcast is made a little better thanks to our partners

Displace



Infrastructure Management, Simplified

Automate Kubernetes deployments across any cloud provider or bare metal with a single command. Deploy, manage, and scale your infrastructure with ease.

https://displace.tech/





PHPScore

Put Your Technical Debt on Autopay with PHPScore



CodeRabbit



Cut code review time & bugs in half instantly with CodeRabbit.



Music Provided by Epidemic Sound

https://www.epidemicsound.com/

Join Us Live Next Week

Youtube Channel

Got feedback? Join us on Discord at discord.phparch.com

The post The PHP Podcast 2026.05.14 appeared first on PHP Architect.

In this episode, Scott talks Global Accessibility Awareness Day with Joe Devon the creator of the day.

Links:

Our Discord – https://discord.gg/aMTxunVx

Buy our shirts – https://store.phparch.com/products/community-corner-podcast-t-shirt

Joe’s Links:

LinkedIn – https://www.linkedin.com/in/joedevon/

Global Accessibility Awareness Day – https://accessibility.day/

Accessibility and Gen AI Podcast – https://podcasts.apple.com/us/podcast/accessibility-and-gen-ai-podcast/id1759047581

Scott’s Links:

Website – https://scott.keck-warren.com/

Bluesky – https://bsky.app/profile/scottkeckwarren.bsky.social

LinkedIn – https://www.linkedin.com/in/scott-keck-warren-91689810/

Mastodon – https://phpc.social/@scottkeckwarren

PHP Architect Social Media:

X: https://x.com/phparch

Mastodon: https://phparch.social/@phparch

Bluesky: https://bsky.app/profile/phparch.com

Discord: https://discord.phparch.com

Subscribe to our magazine: https://www.phparch.com/subscribe/

Partners

This podcast is made a little better thanks to our partners.

Displace

Infrastructure Management, Simplified

Automate Kubernetes deployments across any cloud provider or bare metal with a single command. Deploy, manage, and scale your infrastructure with ease.

https://displace.tech/

PHPScore

Put Your Technical Debt on Autopay with PHPScore

https://phpscore.com/

CodeRabit

CodeRabbit – Cut code review time & bugs in half instantly with CodeRabbit.

https://www.coderabbit.ai/

Music Provided by Epidemic Sound https://www.epidemicsound.com/

#phpc #php #communityCornerPodcast #podcast #phptek

The post Community Corner: Global Accessibility Awareness Day with Joe Devon appeared first on PHP Architect.