Hey folks,

I am new here but old PHP user and I think its time to give some more love to the PHP community.

I recently created a video and also wrote a blogpost about using Grafana with PHP for bringing observability to your applications.

It is purely focused on using open source tools integrations. (No AI or agents involved).

Here is the link to the video:
https://www.youtube.com/watch?v=SEN5wfb2gDY

The video description also contains the link to the GitHub repo. and also to the blogpost (English and German versions).

I hope it will be helpful!! 🙂

pdo_duckdb is my PDO driver for DuckDB, the in-process analytical database. 0.9.0 bundles DuckDB 2.0.0 GA in every prebuilt binary. The last version I posted here was 0.5.0, so this covers 0.6.0 through 0.9.0, starting with what changes for your code when you move to 2.0.

What breaks on 2.0

• New files are unreadable by 1.5. 2.0 writes storage version 69, and 1.5 reads only 64 to 68 (IO Error: Trying to read a database file with version number 69). Existing 1.5 files keep their format. If a 1.5 process shares a new file, open it with new PDO('duckdb:/data/shared.duckdb;storage_compatibility_version=v1.5.6').
• Any failed statement aborts the transaction. Inside beginTransaction(), a parser or catalog error now aborts it too, and every later statement fails. On either version, commit() on an aborted transaction returns true and keeps nothing, so call rollBack() after a failure or set default_transaction_invalidation_policy=SYNTACTIC_ERRORS_DO_NOT_INVALIDATE.
• Integer division by zero throws. 1 // 0 raises instead of returning NULL. Wrap it in TRY(...) or set error_on_division_by_zero=false.
• x -> x + 1 lambdas are rejected. Write lambda x: x + 1, which also works on 1.5.
• The PEG parser is the default, and it numbers parameters differently: $1_0 is parameter 10 under PEG and parameter 1 under the legacy parser. ? and :name are portable.

Source builds still work against DuckDB 1.5.3 and newer. configure detects 2.0 from duckdb_v2.h, since the 2.0 headers still report C API 1.5.6.

New in 0.9.0

• PDO::DUCKDB_ATTR_NATIVE_STRUCTURES, an opt-in that fetches LIST, ARRAY, STRUCT, MAP, UNION, JSON and VARIANT as lossless PHP values instead of canonical strings.
• VARIANT fetching, top-level and nested, and Appender input for it from arrays and objects.
• Two PDO connections to the same file could lose writes and see stale reads. Equivalent paths now share one DuckDB instance, and transactions stay per connection.
• Prebuilts for PHP 8.2 to 8.6 (8.6 as development builds) on Linux glibc and musl, macOS arm64, and Windows x64. They need PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12+, the October security releases; older patches build from source.

Security fixes since 0.5.0

0.8.0 carries the fixes from a security scan of the driver this month. An unclosed Appender in a reference cycle could read its PDO connection after gc_collect_cycles() or shutdown freed it. Hitting memory_limit during column setup could leave uninitialized type handles that were destroyed later. Earlier, 0.6.0 and 0.7.0 rejected DECIMAL types outside DuckDB's width and scale limits, a falsy force_mbedtls_unsafe that crashed the process, LOB binds over 64 MB, and Appender rows nested deeper than 128 levels.

pie install iliaal/pdo_duckdb

https://github.com/iliaal/pdo_duckdb

If you run DuckDB from PHP, I'd like to hear which 2.0 change hits your code first.

For the past few months I've been working on JumPHP, an open-source framework for writing 90s-style 2D games in plain PHP.

https://github.com/davidnurdin/jumPhp

The idea is simple: you write your game once, in PHP, and the same code runs in three places.

- On the desktop: a native window with sound, using PHP 8.3 and the SDL2 extensions.

- In the browser: PHP 8.3 and SDL2 are compiled to WebAssembly, so the game is a plain static web page. PHP runs on the player's machine; you don't need a PHP server, any static host works.

- On phones: the browser build ships with touch controls (floating joystick, buttons, fullscreen and landscape lock).

What it's for

- Platformers, shoot 'em ups, brick breakers, adventure games, puzzle games.

- Porting old games whose source code is available. Many C games from the 80s and 90s translate to PHP surprisingly well.

- Learning game programming with a language you already know, without switching to JavaScript, C# or Lua.

- Small multiplayer games you can share with a link.

What's in the box

- Scenes, sprites and animations, a camera, menus and HUD helpers, bitmap and TTF fonts.

- Saves (stored in IndexedDB in the browser), options and translations.

- Online multiplayer through a small relay server: rooms, 4-letter codes, quick match. The same code works on desktop and in the browser.

- A single CLI, bin/jumphp, that runs everything in Docker: PHP, Composer, Emscripten, tests, headless screenshots, browser builds, deployment. You only need Docker on your machine.

- An AGENTS.md that documents the whole contract, so you can also build a game with an LLM coding agent. Most of the games below were made that way, with me reviewing, testing and fixing.

The constraints are few: never block the frame (no sleep()), remember that integers are 32-bit in the browser, and use the engine's network layer instead of raw sockets.

What I've built with it so far

- Pong (bundled with the engine): against the computer, two players on one keyboard, or online. It's the reference game for the networking layer.

- Breakout (bundled with the engine): three lives, a new wall every level.

- Invaders: waves of aliens, shields, a bonus saucer. https://github.com/davidnurdin/php-invaders

- Moktar, a 1991 French DOS platformer, ported from OpenTitus (the open-source C engine for the game). Everything is PHP, down to the original file formats and an AdLib/OPL2 FM synth emulator that renders the original soundtrack. Play: https://moktar.mimichat.fr, code: https://github.com/davidnurdin/moktarPhp

- Sapiens, a 1986 prehistoric adventure game by Didier and Olivier Guillion. Its C sources were released under GPL v3 in 2018, and the port follows them function by function: a first-person 3D landscape, side-view fights, dialogues with the tribes, flint knapping. I also decoded the music files of the 1996 version (an undocumented Harmony Assistant format) to play the soundtrack with its original sampled instruments. Play: https://sapiens.mimichat.fr, code: https://github.com/davidnurdin/sapiensPhp

- Sonic PHP, a fan remake of the Master System game built on the same PHP + SDL2 + WebAssembly stack. It runs at 60 fps and has online multiplayer for up to 6 players (race, flag, rings, deathmatch). Play: https://sonic.mimichat.fr, code: https://github.com/davidnurdin/sonicGamePhp

Getting started

git clone https://github.com/davidnurdin/jumPhp

cd jumPhp

bin/jumphp new mygame "MY GAME"

bin/jumphp install mygame

bin/jumphp run mygame # desktop window

bin/jumphp build mygame # browser build

The new game starts from a small platformer skeleton you can replace bit by bit.

Feedback is welcome, especially from people who try to build something with it. And if you could bring back one old game in PHP, which one would it be?

I've been working on Encryption-tool, an open-source PHP project focused on encrypted file packaging, authenticated encryption, and reliable decryption.

I'm currently working on hardening the implementation and stabilizing the file format before releasing a dependable version. Areas of focus include input validation, package integrity, safe file restoration, error handling, and testing encryption/decryption behavior with corrupted or malformed data.

The project uses Argon2id for password-based key derivation and XChaCha20-Poly1305 for authenticated encryption.

I'd be interested in constructive feedback on the implementation, testing strategy, and design of encrypted file formats.

GitHub: https://github.com/ElmanCod110/Encryption-tool

Look, folks, I don’t get all this panic! Is everyone just lazy, or what? At the end of the day, it’s really just a case of "hunting the invisible," which is no big deal these days. I’m sitting here with GLM and Claude, getting them to learn my "Palantir detector" to help come up with potential solution. Not just to defeat something like PHP2Shell, but to define broader Open SIEM labs or Sigma rules. I’d love to connect with others who are focused on finding solutions for systems that can’t be patched (or can’t be patched yet because they still need to be migrated). Sure, there are some existing solutions out there, but honestly, they’ve got zero kick! So, if anyone’s up for some real, serious thinking, shoot me a DM! Cheers.

(Translated from German with Google (didn’t want to embarrass myself by subjecting you to my own jumbled, "scrambled-egg" brain thoughts! :D)

Title: PHP2Shell explained — how a PHP vulnerability could lead to RCE without stealing your password
I was researching the recent PHP2Shell vulnerabilities and found the story behind them pretty interesting — especially how the issue was discovered and why authentication wasn’t necessarily the main barrier.
I put together a video breaking down:
what PHP2Shell is
how the vulnerability works at a high level
how it was discovered
the timeline around disclosure
why it matters for PHP developers/server admins
what developers should take away from it
Video: https://youtu.be/JmeYBki6WYY
Would also be interested to hear from people running PHP in production — how quickly do you normally roll out security updates when something like this drops?

[ Removed by Reddit on account of violating the content policy. ]

1) I want use ports but not working: mydomain.com:101/index.html

2) This does work: mydomain.com/php56/index.html

So dev and production environments match want to avoid that subfolder.

--------httpd.conf for #2:------------------------

<VirtualHost *:80> <Directory /var/www/html> Options Indexes FollowSymLinks AllowOverride None Require all granted </Directory> <Location /php82> ProxyPass "unix:/run/php/php8.2-fpm.sock|fcgi://localhost/var/www/html/php82" </Location> <Location /php56> ProxyPass "unix:/run/php/php5.6-fpm.sock|fcgi://localhost/var/www/html/php56" </Location> </VirtualHost> 

--------httpd.conf for #1:------------------------

<VirtualHost *:80> <Directory /var/www/html> Options Indexes FollowSymLinks AllowOverride None Require all granted </Directory> <Location /php82> ProxyPass "unix:/run/php/php8.2-fpm.sock|fcgi://localhost/var/www/html/php82" </Location> </VirtualHost> <VirtualHost *:101> <Directory /var/www/html/php56> Options Indexes FollowSymLinks AllowOverride None Require all granted </Directory> ProxyPass "unix:/run/php/php5.6-fpm.sock|fcgi://localhost/var/www/html/php56" </VirtualHost> 

EDIT: Added Listen 101 and didn't fix anything. See comment with text "AH00526" for details on error from running "apachectl configtest"

Hi,

I've made a demo of sonic the hedgedog in full php ( https://davidnurdin.github.io/php-wasm-sdl/ ) , it execute a php interpreter in the navigator to play with the open source game (https://github.com/davidnurdin/sonicGamePhp) , what do you think about that ? thanks

David

TL;DR for the first 26 hours the page was a static html page being served by php. After the challenger author was informed that if there is no php code php doesn't execute, the author added a phpversion() script.

After this became exploitable it took 2 hours for someone to hack the server and steal the bitcoin.