Modern PHP applications rarely fail because of a simple SQL injection vulnerability or a missing input validation rule alone. Real-world compromises increasingly occur at the infrastructure layer through exposed services, weak deployment pipelines, leaked credentials, misconfigured containers, vulnerable dependencies, or poorly isolated application environments.
PHP 8.3, released in November 2023, is a focused release. It does not introduce a sweeping new feature like fibers or enums, but it adds several small improvements that remove friction from everyday PHP code. The two most immediately useful additions are typed class constants and the json_validate() function.
PHP 8.1 introduced Fibers, and they are the most significant change to PHP's execution model since generators. Unlike threads or async/await in other languages, Fibers do not add implicit concurrency. They are a tool for cooperative concurrency — a way for application code to yield control voluntarily and resume later.
Readonly properties arrived in PHP 8.1. Readonly classes — where every property is implicitly readonly — arrived in PHP 8.2. Together they enable a clean immutability model for value objects, DTOs, and configuration records without boilerplate.
Tree-sitter is a parser generator and incremental parsing library that gives text editors access to a concrete syntax tree of the code being edited. Emacs 29 shipped with built-in tree-sitter support, and Emacs 30 continues to expand it.
Getting Xdebug 3 working through a Docker/Nginx stack is the kind of task that takes an afternoon if you don't know the networking pitfalls. This guide cuts straight to a working configuration, explains every setting, and covers both PhpStorm and Emacs (DAP Mode) as IDE targets.
PHP 8.4, released November 21 2024, ships a feature that immediately earns its keep in any domain-model-heavy codebase: asymmetric property visibility. You can now declare a property's read scope and write scope independently, in a single declaration — no boilerplate getters, no magic __set guards, no readonly trade-offs.
PHPStan is now used by 36% of PHP projects — a jump driven by modern frameworks, Drupal core's own adoption, and the realisation that type errors caught at analysis time cost nothing compared to type errors caught in production.
PHP-FPM (FastCGI Process Manager) is the standard way to run PHP behind Nginx. Its defaults are conservative and will not serve a production Drupal or PHP application efficiently.
GitHub Actions is the dominant CI/CD platform for PHP projects, and for good reason: it is free for public repositories, tightly integrated with your code history, and the marketplace has ready-made actions for every part of a PHP pipeline.