Alexander Makarov

Will solve complicated problems of virtually any level: tracking stolen money in blockhains, selecting database engine for specific needs, troubleshooting, making systems stable, improving performance, scaling systems, audit etc. High rates.

🎁 samdark/sitemap 3.1.0. Unlike other sitemap packages, this one is memory-efficient and fast. This release adds support for image sitemaps. github.com/samdark/sitemap

@alexdaubois How about httpOnly?

Session fixation in #PHP: if you don't rotate the session ID after login, an attacker can pre-set a victim's PHPSESSID cookie and hijack the session once they authenticate. 🔐 The fix is one line: session_regenerate_id(true) after a successful login. The `true` matters: it deletes the OLD session file. Without it, the old ID stays valid on disk, and a stolen pre-auth cookie still works. Most frameworks rotate by default.

In case you missed it, we launched our first State of PHP survey together with @phpstorm (a JetBrains IDE.) This initiative aims to build a clearer picture of today’s PHP ecosystem. Take the survey and help us map the herd! 👉 thephp.foundation/blog/2026/06/0… #phpcommunity #stateofphp

The X link-removal RFC didn't pass 🙌 So I updated the Social Media Policy RFC and it's open for feedback: github.com/php/policies/p…

@pronskiy @vanamerongen @ThePHPF If you need me and/or Qiang Xue to speak about Yii, let me know.

Fair point, Pauline, worth some context though. What we showed yesterday was an early cut. We wanted to have something for the event, so it only included interviews filmed so far. Production is still going: Sara's interview is being scheduled, Elizabeth will be in it too, plus several more people. The trailer will be updated as those come in. Thanks for raising it.

Just saw the trailer for the PHP documentary shown at PHPVerse… ZERO women? Are you serious? 5 women (including at least 3 past or present core developers that I know of, and the executive director) on the @ThePHPF , and the story of PHP includes ZERO women? Not to mention those prominent in the community that aren’t part of the Foundation itself. You can’t be serious.

The @ThePHPF Survey for 2026 is on: take a moment to ask yourself important #PHP questions, and contribute your observation with the community and the fundation. thephp.foundation/blog/2026/06/0…

20 years. One project. Zero signs of stopping. 🔥 @fabpot is live at #PHPverse 2026, and he’s about to reveal the real secrets behind sustaining @symfony. This is required watching for every OSS maintainer 👉 bit.ly/4eusH4C

We've got a new demo for Yii3 which is local LLM-powered document summarizer: reddit.com/r/PHP/comments… #yii

Timing attacks are real, and most devs don't protect against them. When you compare two strings with === or strcmp(), #PHP stops at the first different byte. If the first character matches, it takes slightly longer than if it doesn't. An attacker can measure response times to guess a secret character by character. HMAC token, API key, CSRF token... byte by byte, statistically. hash_equals() was added in PHP 5.6 specifically for this. It always compares ALL bytes, regardless of where the first mismatch is. Constant time. Same applies to #golang: use crypto/subtle.ConstantTimeCompare(). Same in #nodejs: crypto.timingSafeEqual(). If you're comparing secrets with == or ===, you may be leaking information through time!

🎁 Yii2 HTTP Client 2.0.17 is out. This release focuses on compatibility, stability, and maintenance for the Yii2 HTTP client extension. What changed: • Fixed a `stream_get_contents()` TypeError when PHP error reporting is turned off. • Fixed PHP 8.5 deprecation around the predefined `$http_response_header` variable. • Fixed `curl_close()` and `curl_multi_close()` deprecations in PHP 8.5. • Improved PHPDoc annotations for response status code handling. • Added full HTTP status line details to `Message::getHeaders()` / `Client::getHeaders()`. • Applied Yii2 coding standards. • Raised the minimum PHP version to 7.4. A small but important maintenance release to keep Yii2 HTTP Client reliable across modern PHP versions. github.com/yiisoft/yii2-h…

Finished two big migration guides today for Yii3 docs: - yiisoft.github.io/docs/guide/int… - yiisoft.github.io/docs/guide/int… Straight migration is, of course, not possible since it is a different framework but I was able to cover many nuances. If something is missing or not clear — let me know.

Introducing CTOR: #PHPStan extension package to catch fake optional setters ↓ tomasvotruba.com/blog/introduci… Useful for both legacy and modern codebases to improve latent object design.

🎁 Yii 2.0.55 is released Yii Framework 2.0.55 is here with an important security fix for CVE-2026-39850, plus continued PHPStan/Psalm, PHPDoc, and type annotation improvements. Upgrade instructions: yiiframework.com/download/

Lately I've been working on integrating #Testo #PHP with @infection_php There's still more ahead, but in the meantime you can read my fresh article about mutation testing php-testo.github.io/docs/theory/mu…

@infection_php Nice! How about Psalm?

Now officially: Infection supports killing mutants by Static Analysis tools: - PHPStan - Mago infection.github.io/guide/static-a… Enjoy!

And 42K RPS in the case of APIs (no DB), which are lighter than web.

During preps for a talk got ~20K RPS with #yii 3 and #frankenphp for session-enabled app and ~30K for session-less one. Single server.

Yii2 22.0 is here. And yes we just removed jQuery from the core. - No more forced frontend stack. - No Bootstrap dependency. - The framework is now fully CSS/JS agnostic. But we didn’t forget where we came from. The new app-basic still ships with jQuery (via extension) for those who prefer the classic approach. Meanwhile: - NPM instead of Bower (via php-forge/foxy). - Composer-only autoload. - Legacy extensions removed. - PHP 8.5/8.6 support. And the new app-basic? Modern structure, RBAC, SQLite by default, full testing, PHPStan max. Yii2 isn’t being maintained. It’s being rebuilt. Inertia v3, apps are coming next. ⭐ Give it a star → github.com/yiisoft/yii2-a…

Big thanks to @GitHubCopilot, @AnthropicAI, and @OpenAI for supporting Yii2 Open Source. We’ve reduced issues from 488 → 368. Next target: zero. This isn’t about opinions. Not about “do we like it?” or “is it necessary?” It’s about testing things deterministically and proving what actually matters. That’s how we move Yii2 forward.

PHP frameworks in 2026: Laravel: "We have Telescope". Symfony: "We have the Web Profiler". Yii2: "We have an AI duck that debugs your code" . Not a joke. Debug Duck analyzes your requests, exceptions, and queries in real time using any LLM. And yes it works with Laravel and Symfony too. Open source. Free models. Zero config.