Top story: PECL now has a proposed shutdown date. @asgrim, who wrote the RFC that adopted PIE, opened the follow-up: read-only from June 30th, 2027, then brownouts, then shutdown on December 31st, 2027. His first draft ran to 2029. @imsop flagged the risk of serving packages nobody can patch, @derickr suggested shortening it "by a year", and James cut it "to a year". Derick is okay with that, and @timwolla says the plan makes sense.
PECL, the old home of PHP extensions, now has a proposed shutdown date. In the first draft, that date was the end of 2029. Six days later, after one misread word, it's the end of 2027. And the person who was misread is okay with it.
This Week in PHP Internals, November 12, 2026: 18 stories.
https://youtu.be/-5PJCG1um6M
This year, FrankenPHP fixed a session ID leaking to other clients, a use-after-free, and a double free. Its creator, @dunglas, says each one came from state that wasn't reset between two requests, because PHP's engine can't tell when a request ends if the same script serves the next one. He wants to change that.
This Week in PHP Internals, November 5, 2026: 14 stories.
https://youtu.be/SFKA5PAmGNs
And the reason there's anything to report each week: the PHP Foundation funds more than half of ongoing php-src commits.
If you use the language, consider donating — or guilt your employer into it.
This week's episode is supported by Scalpels: open source apps you host yourself, installed in one click into your own Laravel Cloud or Forge account. The Free plan is $0 forever, and Laravel bills you directly for the hosting. It launches this Saturday, October 31st.
@nicolasgrekas wants SSRF blocking in curl; Levi Morrison asked why not streams too. Máté Kocsis keeps the query params length limit. Abbas proposed async/await on Fibers. And paren-less scalar extension methods got a strong -1 from @imsop.
Quick hits: Pratik Bhujel fixed the Io\Terminal bugs Sjoerd found, vote on hold. Damian postponed the CSV vote at @timwolla's request. Sjoerd proposed openssl_get_channel_binding for SCRAM-PLUS logins.
Votes, at recording: Sjoerd Langkemper's RFC to make hexdec, octdec, bindec and base_convert throw on invalid characters is 25–1 (closes Nov 1). Muhammed Arshid's Filter enums RFC is 2–11 (closes Nov 4).
Ayoub Ezzini's array_partition splits an array into matching and non-matching halves in one pass, keys preserved. He kept it to two groups, since PHP casts true/false keys to 1/0. @timwolla: "well-written, well-researched and well-argued."
Arsan Gamal proposed effect declarations: functions that declare they start processes, read files or touch the network. David Maye and Damian Jóźwiak asked why not attributes. @Crell: engine-enforced without opt-in is "a complete non-starter."
Frode Børli's Scope RFC gives each unit of work an identity: an HTTP request, a queue job, a CLI command. Code can key its own state by it, and secondary votes would make superglobals, session, locale and timezone follow it. @Crell called it promising.
Artem Ukrainskiy went through a year of first-time PRs to php-src: about half accepted, 29% for a first PR, 66% after one lands. A reply within a day means a ~20-hour close; over a week, ~32 days. He asked whether a triage bot is worth prototyping.
On Windows? @shivammathur announced rebuilt PHP 8.2–8.5 packages with Brotli 1.2.1, fixing a 9.2 decoder bug reachable via curl's automatic decompression. And php.net suggests session.upload_progress.enabled=0 until the next bugfix release.
A week after two critical bugs in PHP's own engine, someone asked the internals list to freeze PHP until it has a formal spec and four independent implementations. Four people who work on PHP replied. One called fixing PHP's bugs a money problem.
This Week in PHP Internals, October 29, 2026: 15 stories, about 12 minutes.
https://youtu.be/oeDHs-qXXwA
And the reason there's anything to report each week: the PHP Foundation funds more than half of ongoing php-src commits.
If you use the language, consider donating — or guilt your employer into it.
This week's episode is supported by Scalpels: open source apps that each replace a paid service, forked into your GitHub org and deployed to your own Laravel Cloud. The platform that manages them is one lifetime purchase, not another subscription.