Every
Link.

Introducing CTOR: Prefer Constructor over Always-Called Setters

Tomas Votruba introduces CTOR, a PHPStan extension that detects setter methods always called after object instantiation and suggests moving them into the constructor instead. The tool helps Laravel developers prevent half-valid objects by enforcing proper dependency injection through constructors rather than relying on mandatory setter chains.

Aegis for Laravel: Scaffolding and Validation Helpers for Value Objects

The final boss. Generics in PHP

Brent goes through the latest Generics RFC that has been submitted. Let's see what he thinks and will we actually get it coming to a PHP near you.

The PHP Foundation Impact and Transparency Report 2025

The PHP Foundation's impact and Transparency report for 2025, A year where PHP turned 30, The PHP Foundation helped ship PHP 8.5, launched PIE 1.0 and initiated a number of other projects read on to find out more.

An Update on Composer & Packagist Supply Chain Security

Packagist outlines their comprehensive supply chain security roadmap following recent attacks, including integrated malware detection with Aikido, immutable stable versions launching this week, and plans for mandatory MFA and SLSA build provenance.

Building a Production MCP Server in Laravel

A comprehensive guide to building a production-ready Model Context Protocol (MCP) server in Laravel, covering transport modes, capability negotiation, and tool implementation. Explores the server-side perspective of MCP integration, focusing on HTTP+SSE deployment for multi-client environments.

Laravel Paper: A Flat-File Eloquent Driver (No Database)

The Reason I Love Tempest for APIs

Steve McDougall explores why Tempest simplifies API development by eliminating boilerplate code, using typed properties with validation attributes directly on request classes, and keeping routes as attributes alongside controller methods for a more declarative, focused approach.

50,000 Spam Emails and a 3 AM Panic: What Happened When I Forgot About a Side Project

A cautionary tale of how an outdated Livewire vulnerability in a forgotten side project led to 50,000 spam emails being sent, and how Docker containerisation limited the damage. Daniel shares the full story of discovering the breach, the panicked overnight investigation, and the lessons learnt about security and updating dependencies.

Laravel Cloud is Now Inside PhpStorm (First Look)

Making Pest parallel and time-based sharding work in Bitbucket Pipelines

A practical guide to implementing Pest 4.6's time-based sharding feature in Bitbucket Pipelines. Covers the setup process, common pitfalls specific to Bitbucket's environment, and workarounds for reducing CI test suite runtime from 24 minutes using parallel execution.

Laravel Lang Supply Chain Advisory

Snyk's security advisory detailing a supply chain vulnerability discovered in the Laravel Lang package ecosystem, explaining the attack vector and providing guidance for Laravel developers to protect their applications.

Setting up Satis on Laravel Forge

A practical guide to setting up Satis, a static site generator for private Composer packages, on Laravel Forge. Covers site creation, deployment configuration, and authentication handling to avoid monthly Private Packagist costs.

Restoring an explicit empty fillable after a Laravel upgrade

Joel shares how to preserve the intent of an empty fillable property when upgrading to Laravel 13, demonstrating the correct syntax for the new #[Fillable] attribute when you want to explicitly prevent mass assignment.

Security Tip: Secure Your Repositories with Laravel Moat

A practical guide to securing your Laravel repositories using Laravel Moat, a new tool from Nuno Maduro that reviews GitHub security posture and provides actionable recommendations for hardening your repositories against supply chain attacks.

Introducing Moat: A Security Review for Your GitHub Account

Laravel has released Moat, a package that audits GitHub security settings across users, organisations, and repositories. With a single command, developers can review their security posture and receive actionable suggestions to improve protections like 2FA, branch protection, and workflow permissions.

The Ecosystem Security Team at The PHP Foundation

The PHPFoundation have recently received a grant to invest in security which is a great thing. Brent sits down and talks to Volker about his new role for the next 6 months.

Service Layer vs Action Pattern vs Jobs in Laravel

It's very easy to start your application off and throw everything into the controllers and before you know it you have super large controllers that are messy to work with and difficult to change. Maybe its time to think about structuring your code In this post Adriana walks us through Service Layers, Action Patterns and using Laravel Jobs to help better structure your code.

Implement SAML SSO Authentication in Laravel Filament with Socialite

Are multiline short closures coming to PHP?

Are we finally going to get Multiline Short Closures in PHP??? A new RFC has landed and Brent walks us through it. Will this finally be the time.