PHP news and engineering summaries

A major supply chain attack compromised over 30 WordPress plugins from the 'Essential Plugin' library. After being sold on Flippa to a commercial buyer, the plugins were updated with a dormant backdoor that triggered months later, using blockchain-based command-and-control to inject spam. WordPress.org eventually closed the plugins, but users must manually clean their compromised wp-config.php files.

The 100-million-row challenge is a PHP competition focused on high-performance data processing. Participants must parse page visit datasets into JSON files, optimizing for speed and resource management on a standard server environment. Running until March 15, 2026, the contest awards top performers with prizes from PhpStorm and Tideways.

An unauthenticated attacker can exploit get_page_template() to resolve a chosen readable local .php file outside active WordPress theme directories, potentially enabling RCE when a parent or child theme has a top-level page- directory and server prerequisites apply. WordPress 7.1.2 fixes the vulnerability, backported to branches back to 4.7. Robert Ressl disclosed it responsibly.

A security vulnerability was discovered in Roundcube Webmail's sanitizer, specifically within the rcube_washtml class, which allowed attackers to bypass the 'Block remote images' privacy feature. While the sanitizer correctly blocked external resources for common tags like <img> and <use>, it failed to properly handle the SVG <feImage> element. Because its href attribute was routed through a link-washing function instead of the image-validation path, external URLs were permitted. This flaw allowed unauthorized tracking of users, enabling attackers to log IP addresses and confirm email opens by embedding invisible SVG filters. The issue has been addressed in versions 1.5.13 and 1.6.13 by ensuring <feImage> is correctly categorized as an image-bearing attribute during the validation process.

This article discusses the transition of a senior PHP developer to Go by leveraging their existing backend expertise. It contrasts the framework-heavy philosophy of PHP (like Laravel) with Go's emphasis on explicit code, standard library usage, and composition. The author provides a roadmap for learning Go, focusing on practical production patterns like error handling, context management, and CLI development.

Despite PHP's maturity and versatility, the language features unintuitive quirks that often lead to bugs. Key issues include the overloaded array structure, which acts as a key-value dictionary rather than an ordinal list, and a clunky, inconsistent type system regarding uninitialized class properties. Despite these challenges, PHP remains an efficient, productive language for web development.

The PHP 8.6 RFC proposes two performance optimizations for closures: automatic static inference for closures not using $this to prevent memory reference cycles, and caching for stateless closures. These changes aim to improve application performance and reduce memory usage, despite minor backward-incompatible changes regarding reflection and object lifecycle behavior.

kiki is a lightweight, minimalist homepage building kit designed for simplicity and human readability. With only 1500 lines of PHP code, it avoids bloated modern dependencies, databases, and tracking. It supports static and dynamic site generation, wiki modes, and responsive themes, prioritizing ease of use for users who prefer simple, hand-coded web development over complex frameworks.