## Executive Summary As of early 2025, The PHP Foundation comprises **8 volunteer board members** , **an Executive Director** sponsored by JetBrains, and **10 developers** paid part-time/full-time who contribute significantly to the PHP language and its extensions. In 2024, The PHP Foundation received **$683,550 in donations and investments** from organizations and individuals. The foundation’s primary focus in 2024 remained strengthening the maintenance of PHP core, housed in the php/php-src GitHub repository. This project is the home of the PHP language, where PHP’s interpreter is developed. Everyone who uses PHP benefits in one way or another from the work that is done in this repository. The 10 part-time and full-time developers contracted by The PHP Foundation were responsible for a substantial portion of the commits and reviews made to the PHP language. **Key achievements in 2024 included:** * Completion of projects funded by the Sovereign Tech Fund * Expansion of the development team * Increased contributions to PHP core * Enhanced community engagement and sponsor relations The foundation **plans to spend up to $900,000 in 2025** , including compensation and fees. We continue to seek additional sponsor contributions to sustain and expand these efforts in the coming years. ## The PHP Foundation Mission The PHP Foundation’s mission remains focused on ensuring the long-term prosperity of the PHP language. Our priorities continue to be: * Improving the language for users * Providing high-quality maintenance * Improving the project to retain current contributors and integrate new ones * Promoting the public image of PHP ## The PHP Foundation Sponsors In 2024, the following companies made major financial contributions (donating $12,000 or more): **Sovereign Tech Agency, JetBrains, Automattic, Laravel, GoDaddy.com, Craft CMS, Private Packagist, Cybozu, Tideways, Mercari Inc., pixiv Inc., Sentry, Manychat, Zend by Perforce, Les-Tilleuls.coop, CH Studio, Aternos GmbH.** Overall, 658 organizations and individuals sponsored the foundation in 2024 through on Open Collective and GitHub Sponsors. Here is what some of the prominent folks say. > “The PHP Foundation plays a vital role in ensuring the long-term sustainability and health of PHP. By supporting core development and fostering collaboration across the community, the Foundation helps keep PHP modern, stable, and thriving for years to come.” Taylor Otwell, Founder & CEO, Laravel > “At JetBrains, we’re proud to support the PHP Foundation and its commitment to strengthening PHP. It’s great to see how the Foundation’s achievements directly benefit the developer community we deeply care about, and we’re excited to be part of PHP’s ongoing success.” Artemy Pestretsov, Product Leader, PhpStorm at JetBrains > “At GoDaddy, we recognize that PHP is the backbone of the open web and the engine powering many of the sites we host. Our contribution to The PHP Foundation is a strategic investment in maintaining the secure, reliable, and innovative technology that drives our digital ecosystem.” Courtney Robertson, Open Source Developer Relations, GoDaddy > “PHP is absolutely vital to global business, enabling digital public spaces, human interaction, and commerce around the world. We’re proud to do our part by contributing to PHP’s continuous improvements through the PHP Foundation, and call on all other companies relying on PHP to join us.” Nils Adermann, Co-Founder, Composer, Private Packagist > “PHP is my favorite foundation. There I said it. Why? Their primary objective is to pay developers. You'd think that is obvious but most foundations do everything but that.” Chad Whitacre, Head of Open Source, Sentry ## Projects for The Sovereign Tech Agency Delivered Successfully The Sovereign Tech Agency (STA) supports the development, improvement, and maintenance of open digital infrastructure in the public interest. Its goal is to strengthen the open-source ecosystem sustainably, focusing on security, resilience, technological diversity, and the people behind the code. STF is funded by the German Federal Ministry for Economic Affairs and Climate Action (BMWK) and supported by the German Federal Agency for Disruptive Innovation GmbH (SPRIND). The Sovereign Tech Agency commissioned work on four major projects, all of which we successfully delivered. Here’s a brief overview of the results. ### PECL Overhaul The previous system for distributing PHP extensions, PECL/PEAR, is outdated, clumsy for users, and prone to supply-chain attacks, making it unreliable for average developers. This as a result leads to the creation of redundant tools and multiple security issues. We proposed to rewrite the PECL installer, replacing the messy code and the inefficient website. The result is **🥧PIE** **(PHP Installer for Extensions)** , a new tool that replaces PECL with a PHP-native toolchain that is easier to maintain and more secure. It relies on the packagist.org infrastructure which is also a native PHP ecosystem. Follow the progress of **PIE** here: https://github.com/php/pie. The tool has already gathered a group of contributors and was well received in the community: * Pie: new extension installer for PHP * PIE: The PHP’s Next Big Thing * Introducing PIE: The Modern PHP Extension Installer * PIE (PHP Installer for Extensions) We continue investing in PIE in 2025. ### Web Services Tool for PHP-FPM The Web Services Tool (WST) is a command-line application designed to test PHP-FPM integration across different web servers, environments, and configurations. Currently, the tool is hosted under a separate GitHub organization (wstool/wst), with plans to move it to the official PHP GitHub organization in the future. WST has already proven valuable for PHP-FPM development and testing, helping to identify and address complex issues that were previously untested in an automated way. Learn more in the introductory blog post. ### Security Audit We conducted the first external security audit of the PHP core source code in over a decade. The audit is organized in partnership with **OSTIF** and performed by **Quarkslab**. The public report is currently pending and will be published on The PHP Foundation website once available. ### Documentation Improvements We made multiple incremental improvements to the PHP documentation and also conducted a security review of the docs. Like the source code audit, this review was organized in partnership with **OSTIF** and performed by **Quarkslab**. As the scope here was too huge, we had to be smart and limit the review to certain most impactful pages. Additionally, a new Wasm-based PHP runner has been included allowing all code example blocks to be executed directly on the page thanks to Les-Tilleuls.coop. Further improvements have been made since then, by fixing more examples and including resources to make the XML extensions' examples work.. An auto-cleaner script has also been added that removes comments older than 1 year with a score of -5 or lower. This has removed around 2000 low-quality notes from the site. ### Infrastructure Update As part of The Sovereign Tech Bug Resilience Program, we partnered with Neighbourhoodie Software to overhaul the scripts powering parts of PHP’s web infrastructure, and also set up more appropriate back-ups. Previously scattered scripts have been consolidated into robust Ansible playbooks. The rollout is currently being planned, and will result in a much easier to maintain and restore the PHP project's infrastructure. In the future, all infrastructure will likely be managed through this. ## The PHP Foundation Staff ### Renewing contracts In 2023, we had a team of 6 developers. All of them demonstrated a high quality of work, and dedication to the mission of the foundation. We were happy to renew the contracts for 2024 as well as extend the total number of hours for developers requesting it. We aim to review the rates every year based on the available funding and priorities. ### Growing the Team As was mentioned in the previous transparency report, we aimed to extend the team. It did not happen in 2023 because one of the prospective developers could not join the team for personal reasons, and had to step down from PHP core development entirely. Again, this is the Bus Factor at its worst. However, we were able to extend the team starting with 2024. Initially, we offered the new developers 6-month trial contracts so that the developers and the Governing Board can evaluate the results and then decide whether to continue the engagements. The results were far beyond our expectations. All new developers David Carlier, James Titcumb, Saki Takamachi, and Shivam Mathur demonstrated dedication and brought high value results, and demonstrated value. ### Why didn’t we add more developers? In October 2024, following our usual process, we opened applications to expand or update our development team. We received many applications, including some from highly qualified candidates. However, we ultimately decided not to expand the team this time. **The main reason is simple: budget constraints.** Our funding from sponsorships determines how much we can afford, and we prioritize long-term stability over short-term expansion. Retaining the current team ensures we maintain the compound benefits of accumulated knowledge and experience. Growing the team temporarily, only to downsize later, would be counterproductive. If we secure additional funding throughout the year, we may revisit the decision to expand the team. ### The team as of 2025 Starting from January, we continue contracting 10 developers to work on PHP: * **Arnaud Le Blanc** @arnaud-lb * **David Carlier** @devnexen * **Derick Rethans** @derickr * **Gina Peter Banyard** @Girgias * **Ilija Tovilo** @iluuu1994 * **Jakub Zelenka** @bukka * **James Titcumb** @asgrim * **Máté Kocsis** @kocsismate * **Saki Takamachi** @SakiTakamachi * **Shivam Mathur** @shivammathur ## Retrospective: Goals of 2024 In the previous report, we outlined a few organizational and technical goals. Let’s look back and evaluate the results. ### Organization goals **Onboard new major sponsors ❌✅** We did have a few new and returning major sponsors, including Laravel, GoDaddy, Manychat. And of course we are happy about ongoing sponsorship from our founding members, and increased commitment from Automattic. **Explore strategic partnerships and marketing opportunities ✅** We did collaborate with the Sentry team on Open Source Pledge initiative **Further develop the Advisory Board initiative ❌** The Advisory Board played a big role in shaping the Hooks RFC. However, we have much more potential. In 2025, we’d like to revamp the AB to make it more useful and collaborative. **Grow the foundation's community ✅** The PHP Foundation Slack is an invite-only community, and its closed nature has helped keep it very productive. We gradually add more community leaders and developers, along with one-channel guests for specific tasks. We also maintain a public channel, **# php-internals**, which is mirrored on the PHP Community Discord server. ### Technical goals **Ongoing maintenance and development of the PHP core ✅** **Deliver the STF projects ✅** **Improve the quality of the ideas and RFCs coming from the foundation ✅** All of the RFCs from The PHP Foundation — even major ones like Hooks — passed the vote. We see that as a clear sign of the proposals’ quality. **Conduct research and surveys to define priorities ❌✅** We conducted quantitative research in collaboration with the PhpStorm team and JetBrains. However, we were unable to conduct a PHP community survey. Nevertheless, we supported Zend by Perforce PHP Landscape Survey. **Develop a high-level roadmap for PHP changes sponsored by the foundation ❌** The roadmap and vision need further development and discussion. We plan to announce a few strategic moves in the upcoming months. ## PHP Language Impact Every day, the PHP Foundation staff team contributes to the open-source repositories of the PHP GitHub organization. The foundation team contributes in many forms: filing issues, reviewing pull requests, participating in discussions on mailing lists, triaging issues, submitting RFC proposals. In this document, four categories of contributions are presented in more detail: commits to php-src, reviews of pull requests on php-src, submitted RFC documents, and documentation work. ### Commits to PHP The following chart summarizes the number of commits made to the php/php-src repository in 2024. | 2022 | 2023 | 2024 ---|---|---|--- Total by The PHP Foundation | 683 | 784 | 1976 Total other | 885 | 1588 | 3378 We’re happy to see not only an **increase in commits from PHP Foundation** developers but also a significant **boost in contributions from other developers** and the wider community. We consider this one of our biggest achievements and a strong sign of a thriving, **healthy ecosystem**. > Note that the number of commits does not fairly represent the level of effort or the scope of the work. However, it can demonstrate the foundation's relative level of contribution to the PHP core through an objective metric. ### Reviews The diagram summarizes the number of pull request reviews made in the php/php-src repository from January 1 to December 31, 2024. | 2022 | 2023 | 2024 ---|---|---|--- Total by The PHP Foundation | 283 | 702 | 1278 Total other | 551 | 416 | 866 ### RFCs Below are the RFC proposals authored or co-authored by The PHP Foundation developers in 2024 (date order). RFC | Proposed | Status ---|---|--- Property hooks | 2023-01-03 | Implemented Release cycle update | 2023-11-05 | Implemented Dedicated StreamBucket class | 2024-01-19 | Implemented Support object type in BCMath | 2024-03-24 | Implemented Correctly name the rounding mode and make it an Enum | 2024-04-21 | Implemented Asymmetric Visibility v2 | 2024-05-09 | Implemented Lazy Objects | 2024-06-03 | Implemented Property hook improvements | 2024-06-28 | Implemented Make the GMP class final | 2024-06-29 | Implemented Add bcdivmod to BCMath | 2024-06-30 | Implemented Fix up BCMath Number Class / Change GMP bool cast behavior | 2024-06-30 | Implemented Change Directory class to behave like a resource object | 2024-09-14 | Implemented PHP.net Analytics Collection | 2024-10-28 | Approved ### Generics Generics are one of the most requested PHP features, but also the hardest. In 2024, the Foundation funded exploratory research into how generics might be implemented. The result of that research is available in its own blog post. In short, there is potential to make it happen but still some significant performance-related issues to resolve. ### Release Maintenance Saki Takamachi, one of the Foundation developers, volunteered to be a release manager for PHP 8.4. The PHP Foundation supported such an initiative. Jakub Zelenka, another foundation developer, continued duty as a release manager for PHP 8.3. Also supported by the foundation. ### Security The PHP Foundation contributed significantly to the 4 security releases. As per PHP 8.1 changelog, most security issues were addressed by Niels Dossche (11), followed by the foundation developers Jakub Zelenka (6) and Arnaud Le Blanc (1). There has been additional work done in terms of reviews and release preparations. In addition, various documentation security issues were fixed by the foundation developers as result of the security audit. ## The PHP Foundation and the EU Cyber Resilience Act The PHP Foundation is now a founding member of the Cyber Resilience Act Working Group, giving us a key role in monitoring developments, representing PHP’s interests, and ensuring compliance with the regulation. Late last year, the group evolved into the Open Regulatory Compliance Working Group (ORCWG). Jakub Zelenka, the Foundation developer, is part of the FAQ task force. That allows us to play an advisory role and help prepare the PHP ecosystem for the regulations. For more details, see: * TechCrunch: Open Source Foundations Unite on Common Standards * Eclipse Foundation Announcement * ORCWG website: orcwg.org ### Open Source Pledge Collaboration with Sentry In 2024, Sentry launched the Open Source Pledge, with the aim of encouraging companies that rely on Open Source systems to help directly fund Open Source development. The PHP Foundation is also a supporter of this effort; contributing to Open Source is its entire purpose. The Foundation also welcomes sponsorships from companies and organizations that wish to support Open Source as part of their Pledge. ## The PHP Foundation brand & public channels The PHP Foundation represents a community of core PHP developers and advocates for the PHP programming language. The PHP Foundation used the channels listed below for public communication: * 12,546 Twitter followers https://twitter.com/thephpf * 18,337 LinkedIn page followers https://www.linkedin.com/company/phpfoundation * 1,060 Mastodon followers https://phpc.social/@thephpf * 1,029 Bluesky followers https://bsky.app/profile/thephpf.bsky.social PHP Foundation developers and board members gave talks at multiple conferences throughout the year: * Laracon EU – Roman Pronskiy * PHP UK Conference – Derick Rethans, Gina Banyard * International PHP Conference – Derick Rethans, Nils Adermann * FrOSCon – Sebastian Bergmann * php[tek] – Derick Rethans, Nils Adermann * DrupalCon Barcelona- Nils Adermann * betterCode(PHP) – Saki Takamachi, Sebastian Bergmann, Nils Adermann * ForumPHP – Gina P. Banyard, Derick Rethans, Nicolas Grekas * SymfonyCon – Nicolas Grekas, Nils Adermann * Various Symfony meetups in France and Germany - Nicolas Grekas * ConFoo — Derick Rethans, Nicolas Grekas * Dutch PHP Conference — Derick Rethans * phpDay — Derick Rethans, Gina Banyard * AFUP Days 2024 Lille — Gina Banyard ### Gina made it to OpenUK’s ‘New Year Honours List’ Gina Banyard, one of the Foundation's developers, was awarded an Honour by OpenUK, an Open Technology organization that recognizes "above and beyond" contributions to Open Source. Congratulations, Gina! ## Financial report In 2024, The PHP Foundation was financially backed by organizations and individuals with the goal of paying a competitive salary to as many core developers as possible. | 2021-2022 | 2023 | 2024 ---|---|---|--- Total donated | $ 712,484 | $ 478,767 | $ 683,550 Fees * | $ 90,273 | $ 60,098 | $ 83,110 Total received | $ 622,211 | $ 418,669 | $ 600,440 Paid to developers | $ 133,285 | $ 275,181 | $ 635,487 _* Fees include a 10% Open Source Collective fiscal host fee (dealing with contracts, expense reviews and payments, bank account management, official registrations and dealing with government requirements, open collective platform development etc), and 1-5% percent of payment processing fees, depending on the payment method used._ All incoming and outgoing transactions of The PHP Foundation are publicly available to view for anyone: https://opencollective.com/phpfoundation#category-BUDGET ## Goals for 2025 Our foremost mission remains the same: **maintain and develop the PHP language**. We’d like PHP to be the best platform for users and for businesses creating web applications and APIs. The main challenge for continuing the work of The PHP Foundation is to ensure sustainable sponsorship. From a technical standpoint, the goal is to ensure that foundation developers work on valuable tasks. ### Organization Goals * Secure funding to support core development and marketing initiatives. * Launch the "PHP 30" anniversary campaign in collaboration with JetBrains. * Consolidate and grow social media presence across multiple platforms. * Increase website traffic through improved documentation and resources. * Develop an Ambassador Program. * Begin preparation for the "PHP Next" marketing campaign to highlight PHP's modernization. * Modernize PHP's website with updated downloads page, documentation, and homepage. ### Technical Goals * Continue on-going maintenance and development of the PHP core. * Establish a working group for integrating modern HTTP server capabilities into PHP core. * Address key developer experience pain points, particularly for first-time users. ## Budget plan for 2025 In 2025, we adjusted the developers’ hours according to their availability, requests, and our budget restrictions. With this plan, we estimate our annual spending cap at approximately **$900,000** for developer compensation. Our collaboration with the OpenCollective platform has been positive, and we plan to continue operating under the umbrella of the Open Source Collective in 2025. This means that sponsorships we receive are reduced by 10% for Open Source Collective fees and 0-5% for payment processing fees. ## Outro The PHP language is a living entity and, as such, requires continuous support to address developer issues, resolve security vulnerabilities, and has to evolve to meet the needs of the future. Based on the strong third year of the foundation, we are excited to continue and multiply the efforts in the next years. With **your help**, we continue the mission to support, advance, and develop the PHP language. Join The PHP Foundation

We are thrilled to announce that after a year of hard work, dedication, and collaboration, **PHP 8.4** is officially here! Thanks to the tireless efforts of the PHP Foundation members, the core PHP development team, and an incredible community of contributors, this upcoming version brings major new features and syntax, performance and security enhancements, and a healthy amount of deprecations. ## A Year of Hard Work and Collaboration The PHP Foundation financially supports ten PHP core developers. The PHP Foundation members, along with a total of **115 contributors** , have made over **2,600 commits** since PHP 8.3 until PHP 8.4.0 release. PHP 8.4 includes changes from **36 RFCs**. There have also been numerous mailing list discussions and RFCs that were withdrawn, declined, or are still under discussion. Since PHP 8.0, PHP 8.4 received the highest number of RFCs, and PHP 8.4 brings the changes such as property hooks and asymmetric visibility that received significant community involvement and refinement. ## What PHP 8.4 Brings PHP 8.4 brings numerous new features and improvements to PHP. We covered some of them in our previous post as well, but they are mentioned here as well, for more complete picture. As we also covered in PHP Core Roundup #19, Property Hooks and Asymmetric Visibility are two of the highlighted features in PHP 8.4 * * * ### PHP 8.4 supports Property Hooks! In PHP 8.4, it is possible for a class to declare class properties with "hooks", that get executed when the property is accessed or set, and the hooks can access the object context. Property hooks open up a wide range of use cases that allow classes to declare virtual properties that enable expressive and intuitive APIs, make code readable and simple and avoid boilerplate code. class User { public string $emailAddress { set { if (!filter_var($value, FILTER_VALIDATE_EMAIL)) { throw new ValueError('emailAddress property must be a valid email address'); } $this->emailAddress = $value; } } } $user = new User(); $user->emailAddress = '[email protected]'; // Allowed $user->emailAddress = 'not an email address'; // Throws ValueError Larry Garfield wrote in PHP 8.4: How Property Hooks Happened about how he and Ilija Tovilo 💜 brought Property Hooks to PHP. ### Asymmetric Visibility PHP 8.4 introduces asymmetric visibility, allowing different access levels for getting and setting class properties. This feature is useful when you want to expose a property for reading but not writing. class User { public private(set) int $userId; public function __construct() { $this->userId = 42; } } $user = new User(); echo $user->userId; // 42 $user->userId = 16; // Error: Cannot modify private(set) property ### Lazy Objects PHP 8.4 brings support for Lazy Objects. Using the Reflection API, it is possible to create class instances in PHP 8.4 that they are initialized only if needed. The Lazy Objects documentation provides detailed examples and use cases. ### HTML5-compliant parser in DOM Extension PHP 8.4 upgrades the DOM extension with HTML5-compliant parsing. The new `Dom\HTMLDocument` and `Dom\XMLDocument` classes replace libxml2, which previously lacked HTML5 support. These updates improve DOM spec compliance and add features like CSS selector support. ### BCMath adds operator-overloaded `BcMath\Number` class The BCMath extension now includes the `BcMath\Number` class, enabling operator overloading for arithmetic operations. use BcMath\Number; $num1 = new Number('22'); $num2 = new Number('7'); $num3 = new Number('100'); $result = ($num1 / $num2) + $num1 - $num2; echo $result; // 18.1428571428 You can now use standard operators (`+`, `-`, `/`) with `BcMath\Number` objects, which also support all `bc*` functions. These objects are immutable and implement the `Stringable` interface, so they can be used in string contexts like `echo $num`. ### New Functions * `array_find`, `array_find_key`, `array_any`, and `array_all` * `bcdivmod`, `bcround`, `bcceil`, and `bcfloor` * `mb_trim`, `mb_ltrim`, and `mb_rtrim` * `mb_ucfirst` and `mb_lcfirst` * `grapheme_str_split` * `fpow` * `http_get_last_response_headers` and `http_clear_last_response_headers` ### PDO Driver-Specific Subclasses The PDO Driver-specific subclasses RFC is implemented in PHP 8.4. Previously, it was voted for PHP 8.3 but was not implemented in PHP 8.3 before its feature-freeze. PHP 8.4 now adds `Pdo\Mysql`, `Pdo\Pgsql`, `Pdo\Sqlite`, `Pdo\DbLib`, and `Pdo\Firebird` classes that extend the `PDO` class. Driver-specific methods, properties, and constants are now available in the driver-specific subclass. Driver-specific sub classes also allow APIs to be more expressive and restrictive by allowing the functions and methods only to accept/return driver-specific sub-classes. ### `AEGIS-128L` and `AEGIS256` support in Sodium extension **AEGIS** is an AES-based family of authenticated encryption algorithms that is faster than AES-GCM. The Sodium extension in PHP 8.4 supports `AEGIS-128L` and `AEGIS256` encryption algorithms if the Sodium extension is compiled with `libsodium` 1.0.19 or later. Apart from the new features, PHP 8.4 also updates several underlying dependencies and datasets, as well as unbundling three extensions: ### Updated dependencies * The Curl extension now requires libcurl 7.61.0 or later, and even capable of making HTTP/3 requests if it is compiled with a supporting TLS library. * The PCRE extension ships with PCRE 10.44, which provides support for Unicode 15 characters and character blocks, improved Regular Expression syntax, and performance improvements on certain systems. * OpenSSL extension now requires OpenSSL 1.1.1 or later, with improved support for OpenSSL 3.x series. It can now support Curve25519 and Curve448 based keys. Further, OpenSSL can be compiled to provide Argon2 password hashing on OpenSSL 3.2+ on PHP NTS builds. * To compile PHP as an Apache module (`mod_php`), PHP 8.4 drops support for the EOL Apache 2.0 and 2.2 series. The minimum required Apache version is now 2.4. * The zlib extension now requires zlib version 1.2.11 at minimum. ### Unbundled Extensions IMAP, Pspell, OCI8, and PDO_OCI8 extensions are unbundled from the PHP core, and are now available as PECL extensions, for which PIE might help to install easily. ### Updated PHP Icon on Windows PHP 8.4 also brings a minor, yet _very_ overdue change to the PHP icon on Windows executables: | ---|--- | Old Icon | New Icon ## Looking Ahead: PHP 8.4 and Beyond PHP 8.4 is the first major new PHP releases since the adoption of the new PHP maintenance policy. PHP 8.4, along with all current active PHP versions, will receive two years of active support and two years of security fixes. What this means is that PHP 8.4 will receive bug fixes until the end of 2026 and security fixes until the end of 2028. We just announced the pre-release of PIE - PHP Installer for Extensions. PIE will significantly improve the workflow of downloading and compiling PHP extensions. PHP 8.5 (in the `master` branch) is currently under active development, and we already have RFCs such as Support Closures in constant expressions in voting phase, and Add RFC3986 and WHATWG compliant URI parsing support under discussion. ## Get Ready to Upgrade PHP 8.4.1 is now a tagged release on PHP's GitHub repository. Compiled binaries and container images are available for: * Debian and Ubuntu-based Linux distros from Ondrej Sury's repositories. * Fedora/RHEL/Rocky/Alma Linux from Remi's repositories. * MacOS on MacPorts and Homebrew shivammathur/homebrew-php tap. * Windows on windows.php.net. * Docker and Podman Docker Hub * * * ## Support PHP Foundation At The PHP Foundation, we support, promote, and advance the PHP language. We financially support ten PHP core developers to contribute to the PHP project. You can help support PHP Foundation on OpenCollective or via GitHub Sponsors. A big thanks to all our sponsors — PHP Foundation is all of us! Follow us on Twitter/X @ThePHPF, Mastodon, LinkedIn, and Bluesky to get the latest updates from the Foundation. 💜️ 🐘 > PHP Roundup is prepared by Ayesh Karunaratne from **PHP.Watch** , a source for PHP News, Articles, Upcoming Changes, and more.

We’re thrilled to announce that **Passbolt has joined the PHP Foundation** as a Silver sponsor! PHP powers over 77% of the web – including Passbolt’s collaborative password and secrets manager. Their support strengthens our mission to keep it thriving. Check out their heartfelt announcement here: **Passbolt’s Blog**. The Foundation funds developers to ensure PHP remains fast, secure, and innovative. With Passbolt and many other industry leaders by our side, we’re building a sustainable future for the language we all rely on. > This post kicks off a new blog series highlighting our amazing sponsors. Stay tuned as we spotlight the companies and individuals driving PHP forward – each one a vital part of our community’s success. Want to join the effort? Sponsor The PHP Foundation and help us power the web’s backbone! 🐘💜

Wow. Can you believe it? Just three years (and one day) ago, PHP had no organization behind it. Only two people were being paid to work on the language that powers 70% of the web. Here’s the very first announcement about the creation of the PHP Foundation: The New Life of PHP – The PHP Foundation. ## Fast forward to today We now have a team of 10 talented engineers dedicated to PHP. We’re supported by major companies, governments, and an incredible community. That same community is creating amazing projects with PHP, while businesses continue to thrive thanks to a mature, secure, and performant language. Since 2021, we’ve seen three PHP releases—PHP 8.2, 8.3, and the freshly released PHP 8.4. Here are just a few highlights from these releases, developed by the PHP Foundation team: * Property hooks * Asymmetric Visibility * Lazy Objects * New tool for installing extensions: pie * Support object type in BCMath * Saner Increment/Decrement operators * Multiple type system improvements: null and false as stand-alone types, Disjunctive Normal Form Types * Readonly amendments * Dynamic class constant fetch * Arbitrary static variable initializers ## Feature development is only about 20% of what the foundation team does Behind the scenes, there’s a lot more: triaging and fixing issues, handling security reports, reviewing code, updating documentation, and maintaining infrastructure. All of this work empowers the community and ensures PHP is stable and reliable. Here are some highlights: * The total contributions to the PHP repositories grew by 51+% * We conducted the first external security audit for PHP in 10 years * We extended security support for PHP versions by one year * We improved CI and testing infrastructure * We introduced automated benchmarks to track performance regressions None of this would be possible without our sponsors. Huge thanks to every company and individual who has supported us over the past three years! Special shout-outs to: JetBrains, Automattic, Sovereign Tech Agency, Craft CMS, Private Packagist, Tideways, Zend by Perforce, Laravel, Symfony, Mercari Inc., Les-Tilleuls.coop, pixiv Inc., Aternos GmbH, Sentry, Ardennes-étape, Cybozu, and many others — PHP is all of us! If you haven’t already, please consider sponsoring the PHP Foundation 🙏 Here’s to PHP and many more years ahead! 🐘💜

At the PHP Foundation, we’re proud to be supported by companies that build amazing products and contribute back to the PHP ecosystem. Today we’d like to highlight Manychat — one of our Silver sponsors. Manychat is the world’s leading chat marketing platform, helping businesses connect with their customers on Instagram, WhatsApp, Facebook Messenger, and beyond. With over **1 billion conversations powered every year** across **170+ countries** , Manychat is a great example of how PHP scales and supports high-traffic applications around the world. ## Why PHP? Because Speed Wins In their recently published case study — _How Manychat Scaled to 1 Billion Conversations Using PHP_ — the Manychat team shares the story of how PHP helped them go from a tiny startup with just one developer to a platform supporting millions of users. > _“We could build right away — our only developer already knew PHP, so we skipped onboarding and got straight to work.”_ By choosing PHP, Manychat was able to build their MVP in just a few days and start learning from real users immediately. As they grew, they faced the familiar scaling challenges of high traffic, heavy workloads, and resource management. Their case study provides mentions architectural decisions they made — from using asynchronous request handling with NGINX + Lua, to optimizing background task processing with PHP-CLI workers, and managing database connections efficiently with PgBouncer. ## PHP at the Heart of a Global Platform Today Manychat’s platform continues to run on PHP, handling millions of API calls and conversations while keeping infrastructure costs under control. If you’re excited about building products that reach millions and love working with PHP at scale, check out the open positions at Manychat. They’re hiring PHP engineers! ## Supporting the Community Manychat isn’t just building with PHP — they’re giving back to the community. As a **Silver sponsor** of the PHP Foundation, they help us fund initiatives that keep PHP stable, modern, and accessible to millions of developers worldwide. In addition, Manychat is active in the tech community, hosting PHP meetups and events in **Barcelona** and **Amsterdam**. We love seeing our sponsors not only build great products but also foster connections between developers around the world. ## Read Their Story We encourage you to check out their full case study on scaling with PHP: 👉 _How Manychat Scaled to 1 Billion Conversations Using PHP_ **Thank you, Manychat, for your support!** 🐘💜 * * * > This post continues the blog series highlighting our amazing sponsors. Stay tuned as we spotlight the companies and individuals driving PHP forward – each one a vital part of our community’s success. Want to join the effort? Sponsor The PHP Foundation and help us power the web’s backbone!

As 2024 comes to a close, we at the PHP Foundation want to take a moment to thank everyone who has supported us this year. It’s been an incredible journey, and we couldn’t have done it without the amazing PHP community and our generous sponsors. ## A Year of Milestones In its third year, the PHP Foundation has achieved several milestones that have further strengthened the PHP ecosystem: first in a decade security audit, pie, numerous features and improvements for PHP 8.4, and much more to come next year! ## Celebrating Our Sponsors We owe a special thanks to our major sponsors who make our work possible: ### Platinum **Sovereign Tech Agency** **JetBrains** **Automattic** ### Gold **Laravel** **GoDaddy** **[ new! ✨]** ### Silver **Private Packagist** **Craft CMS** **Cybozu** **Tideways** **Zend by Perforce** **Symfony Corp** **Sentry** **Manychat** **[ new! ✨]** **Mercari Inc.** **Les-Tilleuls.coop** **pixiv Inc.** **Aternos GmbH** **CH Studio** Big thanks to newly joined major sponsors: **GoDaddy** and **Manychat**! Your contributions enable us to support developers, fund crucial projects, and ensure PHP is a modern and reliable choice for web development. If you are yet to decide on sponsoring the foundation, here you can find information on how to join us and why it matters. ## Wishing You Joyful Holidays ✨ To everyone in the PHP community, we wish you a joyful holiday season filled with warmth, happiness, and a well-deserved break. Thank you for your support, passion, and commitment to PHP. Here’s to a wonderful 2025! 🥂 Warm wishes, The PHP Foundation 🐘💜

The PHP Foundation is thrilled to announce our community sponsorship of both Laracon EU and Laracon India! We believe in the power of in-person connections and are excited to support these conferences as they bring together PHP enthusiasts from around the world. ## Laracon EU * **Location:** Amsterdam, Netherlands * **Date:** February 3–4 * **Meet us:** This year at Laracon EU you can meet Roman Pronskiy, Sebastian Bergmann, and Nils Adermann from the PHP Foundation board. Can you spot our first ever conference banner? ## Laracon India * **Location:** Ahmedabad, India * **Date:** March 8–9 * **Sponsorship:** Laracon India welcomes sponsors who are eager to support the Laravel community and connect with talented developers in India. ## Let's Collaborate! The PHP Foundation is committed to fostering the growth and development of the PHP ecosystem. We’re excited to collaborate with and support (non-financially) PHP conferences and meetups worldwide! 📩 Get in touch: [email protected]. Here are a few upcoming events to watch for: * PHP UK Conference 2025 – London, UK, February 19. * Dutch PHP Conference – Amsterdam, March 18–21. * PHP Conference Odawara 2025 – Japan, April 12. * PHPDay – Verona, May 16-17. * php[tek] 2025 – Chicago, IL, USA, May 20-22. * PHPers Summit 2025 – Poznań, Poland, 24-25 May. * International PHP Conference – Berlin, June, 3–5. 🐘💜

FrankenPHP, a modern high-performance PHP application server created by Kévin Dunglas and sponsored by Les-Tilleuls.coop, is now officially supported by the PHP Foundation. FrankenPHP integrates PHP directly into Go and Caddy, simplifying deployment, improving performance, and reducing costs. It powers real-time features, supports advanced hosting scenarios, and offers a performance-boosting “worker mode” already integrated by Laravel, Symfony, and Yii. The PHP Foundation will actively contribute to FrankenPHP’s development and host its code on the official PHP GitHub, marking a major step toward modernizing the PHP ecosystem while keeping governance with the original maintainers. PHP is a programming language used by around 70% of websites and applications, and by key software and frameworks such as WordPress, Laravel, and Symfony. FrankenPHP offers a host of new features that allow to: * simplify the development of applications written in PHP; * drastically improve performance, while considerably reducing hosting costs (FinOps) and energy consumption (GreenOps); * facilitate deployment in production, whether on bare-metal servers or in cloud-native environments; * easily develop real-time features thanks to native Mercure protocol support; * extend PHP apps with Go, C, and C++ programming languages; * support the PHP programming language in any application written in Go (server, proxy, in-house development...). Specifically, FrankenPHP integrates the official PHP interpreter as a module for Go and Caddy, the popular next-generation web server that supports the latest web platform innovations in terms of performance, security, and DevOps: HTTP/3, compression with Zstandard, 103 Early Hints, automatic generation and renewal of HTTPS certificates, Encrypted Client Hello, structured logs, OpenMetrics/Prometheus metrics… Caddy is also co-maintained by Kévin and sponsored by Les-Tilleuls.coop. Thanks to its innovative architecture, FrankenPHP lets you install a complete PHP environment (interpreter, web server, extensions, etc.) optimized for performance and security, by downloading a standalone statically compiled executable or a Docker image. FrankenPHP also offers a performance-optimized mode called “worker mode”, which takes advantage of the capabilities of the Go programming language. When this optional mode is used, the PHP application will be able to retain in memory those elements that can be reused to process other HTTP requests instead of being completely reset to process each incoming HTTP request (“share nothing” model). Worker mode is especially useful for frameworks such as Symfony and Laravel that can prevent rebuilding their kernels and services again and again for nothing. Using this mode requires minimal adaptations to the code of modern PHP applications in line with good programming practice. The Laravel, Symfony and Yii frameworks already offer official integrations of FrankenPHP's worker mode, enabling worker mode to be activated without modifying the application code. According to an analysis carried out this summer by Sylius, the publisher of the eponymous e-commerce platform, the use of FrankenPHP's worker mode reduces the software's response times by 80%, while reducing by more than 6 the number of machines required to serve the same number of users. FrankenPHP is now a reliable, mature solution used in production for an ever-increasing number of projects. The project now has almost 8,000 stars on GitHub, has passed the symbolic 100-contributor mark, and is officially supported by numerous hosting providers, including Upsun, Laravel Cloud, and Clever Cloud. To get to this point, it was necessary to initiate close collaboration between the development teams of FrankenPHP, the PHP interpreter itself, the Caddy web server, and even the Go programming language. Today, we're proud to announce that, with the aim of intensifying this collaboration, enabling the project to gain momentum, and modernizing the entire PHP ecosystem, **the FrankenPHP project is now officially supported by the PHP Foundation**. In concrete terms, FrankenPHP's source code will be transferred to the PHP project's GitHub organization, and the PHP Foundation team will contribute to the maintenance and development of FrankenPHP to ensure its reliability, durability, and compatibility with the latest language innovations. Part of the FrankenPHP documentation will also be transferred to the PHP website. The governance of the project remains unchanged, and the current team of maintainers (Kévin Dunglas, Robert Landers, Alexander Stecher) will continue to be in charge of releases, as well as code reviews. They will be actively collaborating with the PHP Foundation team in charge of the language development. In addition to the support provided by the foundation, Les-Tilleuls.coop will continue to sponsor FrankenPHP (as well as PHP and Caddy) by providing developers and contributing financially. FrankenPHP is already promoted by Caddy as the official, modern solution for using PHP with this server. In the future, to simplify the PHP development experience (one-line installation of a complete development environment) and to promote a solution that, for projects requiring it, considerably improves the performance and efficiency of PHP applications, FrankenPHP may be highlighted on the PHP website as one of the ways to use the language (other SAPIs such as PHP-FPM will continue to be fully supported solutions). To find out more about FrankenPHP and the many new possibilities it offers, take a look at its documentation. To meet the software's authors and find out how it is used in production, don't miss the API Platform conference (by the same authors as FrankenPHP) taking place on September 18 and 19 in France (Lille). Also, join us online for **PHPverse on June 17** — a special event celebrating PHP’s 30th anniversary. Finally, to help keep the PHP ecosystem innovating, support the foundation! The PHP Foundation Les-Tilleuls.coop The Caddy team

The PHP Foundation is pleased to announce the completion of a comprehensive security audit of the PHP source code (php/php-src), **commissioned by theSovereign Tech Agency**. This initiative was organized in partnership with the Open Source Technology Improvement Fund (OSTIF) and executed by the esteemed security group Quarkslab. ## Audit Overview Conducted over a two-month period in 2024, the audit encompassed: * Development of a threat model tailored to php-src * Manual code reviews * Dynamic testing procedures * Cryptographic assessments The collaboration between Quarkslab’s auditors and PHP maintainers ensured a thorough examination of the codebase. > _⚠️_ > Due to budget constraints, the recent security audit focused on the most critical components of the PHP source code rather than the entire codebase. Organizations interested in sponsoring a comprehensive audit or additional assessments are encouraged to contact us! > _⚠️_ ## Key Findings The audit identified 27 issues, with 17 having security implications: * 3 High-severity * 5 Medium-severity * 9 Low-severity Additionally, 10 informational findings were reported. Notably, four vulnerabilities received CVE identifiers: * CVE-2024-9026: Log tampering vulnerability in PHP-FPM, allowing potential manipulation or removal of characters from log messages. * CVE-2024-8925: Flaw in PHP’s multipart form data parsing, potentially leading to data misinterpretation. * CVE-2024-8929: Issue where a malicious MySQL server could cause the client to disclose heap content from other SQL requests. ## Recommendations and Resolutions Quarkslab’s report commended the overall high quality and specification adherence of the php/php-src project. The PHP development team has addressed all identified issues. Users are strongly encouraged to upgrade to the latest PHP versions to benefit from these security enhancements. ## Acknowledgments We extend our gratitude to the individuals and organizations that made this audit possible: * **The PHP Foundation Team and PHP maintainers:** Jakub Zelenka, Arnaud Le Blanc, Niels Dossche, Ilija Tovilo, Stas Malyshev, Dmitry Stogov, Derick Rethans, and Roman Pronskiy. * **Quarkslab Team:** Angèle Bossuat, Julio Loayza Meneses, Mihail Kirov, Sebastien Rolland, Ramtine Tofighi Shirazi. * **Sovereign Tech Agency:** Abigail Garner and the team – for commissioning the audit and all the help. * **OSTIF:** Amir Montazery, Derek Zimmer, Helen Woeste – for organizing the collaboration. This audit underscores our commitment to enhancing PHP’s security and reliability. We remain dedicated to ongoing improvements and collaborations to ensure PHP’s robustness for the global development community. ## Further Reading * Audit Report * OSTIF Blog * Quarkslab Blog If your company is interested in commissioning another round of security audit, please contact The PHP Foundation team: [email protected]. 🐘💜

On June 8, 1995, Rasmus Lerdorf released the first version of the PHP language. Over time, PHP has become the most popular server-side programming language, now powering over 70% of websites! Exactly 30 years after the first release of PHP, we are proud to announce that FrankenPHP, a modern and high-performance application server based on Caddy, is now part of the PHP organisation on GitHub. As a reminder, FrankenPHP offers features that are unique in the PHP ecosystem: * simplify the development of applications written in PHP; * drastically improve performance, while considerably reducing hosting costs (FinOps) and energy consumption (GreenOps); * facilitate deployment in production, whether on bare-metal servers, or in cloud-native environments; * easily develop real-time features thanks to native Mercure protocol support; * extend PHP apps with Go, C, and C++ programming languages; * support the PHP programming language in any application written in Go (server, proxy, in-house development…). The move of FrankenPHP into the PHP organisation follows the announcement of FrankenPHP support by the PHP Foundation, in collaboration with Les-Tilleuls.coop (the creator of FrankenPHP) and the team maintaining the Caddy web server. This is the first step towards greater integration of the tool into the language ecosystem. The roadmap and new features that are likely to change the way PHP applications are developed will be announced at the **JetBrains PHPverse 2025** online conference on **June 17** , to celebrate PHP's 30th birthday. There is still time to register, and it's free! Happy 30th birthday, PHP! 🎉 🐘💜

We're thrilled to introduce the pre-release of the PHP Installer for Extensions (PIE) – **github.com/php/pie**! PIE aims to simplify managing PHP extensions by providing a modern, flexible alternative to PECL and treating extensions as first-class citizens in the PHP ecosystem. > PIE development is commissioned by the **Sovereign Tech Agency**. This initial pre-release is available as a PHAR download, and we invite you to take it for a spin and share your feedback. While this release is an exciting milestone, we know there's a lot more work ahead to make PIE ready for widespread use, so your feedback is invaluable. If you encounter any issues, or have any questions, feel free to open an issue on GitHub, and help us shape the future of PIE. ## Why PIE? With PIE, the process of managing PHP extensions becomes more streamlined. Extensions are distributed via Packagist just like regular PHP packages! It makes the installation and update process quite familiar if you already use Composer. We’re working to make PIE stronger and easier to use. We’re improving how PHP extensions are managed and using ideas from Composer to make the process smoother. ## Are you an extension author? Extensions do need to be made compatible with PIE by adding a `composer.json` (more instructions here), and submitting it to Packagist. Once a package has added support for PIE, it will appear on the Packagist Extensions list page. 💜️🐘

At the PHP Foundation, we’re proud to be supported by companies that build amazing products and contribute back to the PHP ecosystem. Today we’d like to highlight Manychat — one of our Silver sponsors. Manychat is the world’s leading chat marketing platform, helping businesses connect with their customers on Instagram, WhatsApp, Facebook Messenger, and beyond. With over **1 billion conversations powered every year** across **170+ countries** , Manychat is a great example of how PHP scales and supports high-traffic applications around the world. ## Why PHP? Because Speed Wins In their recently published case study — _How Manychat Scaled to 1 Billion Conversations Using PHP_ — the Manychat team shares the story of how PHP helped them go from a tiny startup with just one developer to a platform supporting millions of users. > _“We could build right away — our only developer already knew PHP, so we skipped onboarding and got straight to work.”_ By choosing PHP, Manychat was able to build their MVP in just a few days and start learning from real users immediately. As they grew, they faced the familiar scaling challenges of high traffic, heavy workloads, and resource management. Their case study provides mentions architectural decisions they made — from using asynchronous request handling with NGINX + Lua, to optimizing background task processing with PHP-CLI workers, and managing database connections efficiently with PgBouncer. ## PHP at the Heart of a Global Platform Today Manychat’s platform continues to run on PHP, handling millions of API calls and conversations while keeping infrastructure costs under control. If you’re excited about building products that reach millions and love working with PHP at scale, check out the open positions at Manychat. They’re hiring PHP engineers! ## Supporting the Community Manychat isn’t just building with PHP — they’re giving back to the community. As a **Silver sponsor** of the PHP Foundation, they help us fund initiatives that keep PHP stable, modern, and accessible to millions of developers worldwide. In addition, Manychat is active in the tech community, hosting PHP meetups and events in **Barcelona** and **Amsterdam**. We love seeing our sponsors not only build great products but also foster connections between developers around the world. ## Read Their Story We encourage you to check out their full case study on scaling with PHP: 👉 _How Manychat Scaled to 1 Billion Conversations Using PHP_ **Thank you, Manychat, for your support!** 🐘💜 * * * > This post continues the blog series highlighting our amazing sponsors. Stay tuned as we spotlight the companies and individuals driving PHP forward – each one a vital part of our community’s success. Want to join the effort? Sponsor The PHP Foundation and help us power the web’s backbone!

## Executive Summary As of early 2025, The PHP Foundation comprises **8 volunteer board members** , **an Executive Director** sponsored by JetBrains, and **10 developers** paid part-time/full-time who contribute significantly to the PHP language and its extensions. In 2024, The PHP Foundation received **$683,550 in donations and investments** from organizations and individuals. The foundation’s primary focus in 2024 remained strengthening the maintenance of PHP core, housed in the php/php-src GitHub repository. This project is the home of the PHP language, where PHP’s interpreter is developed. Everyone who uses PHP benefits in one way or another from the work that is done in this repository. The 10 part-time and full-time developers contracted by The PHP Foundation were responsible for a substantial portion of the commits and reviews made to the PHP language. **Key achievements in 2024 included:** * Completion of projects funded by the Sovereign Tech Fund * Expansion of the development team * Increased contributions to PHP core * Enhanced community engagement and sponsor relations The foundation **plans to spend up to $900,000 in 2025** , including compensation and fees. We continue to seek additional sponsor contributions to sustain and expand these efforts in the coming years. ## The PHP Foundation Mission The PHP Foundation’s mission remains focused on ensuring the long-term prosperity of the PHP language. Our priorities continue to be: * Improving the language for users * Providing high-quality maintenance * Improving the project to retain current contributors and integrate new ones * Promoting the public image of PHP ## The PHP Foundation Sponsors In 2024, the following companies made major financial contributions (donating $12,000 or more): **Sovereign Tech Agency, JetBrains, Automattic, Laravel, GoDaddy.com, Craft CMS, Private Packagist, Cybozu, Tideways, Mercari Inc., pixiv Inc., Sentry, Manychat, Zend by Perforce, Les-Tilleuls.coop, CH Studio, Aternos GmbH.** Overall, 658 organizations and individuals sponsored the foundation in 2024 through on Open Collective and GitHub Sponsors. Here is what some of the prominent folks say. > “The PHP Foundation plays a vital role in ensuring the long-term sustainability and health of PHP. By supporting core development and fostering collaboration across the community, the Foundation helps keep PHP modern, stable, and thriving for years to come.” Taylor Otwell, Founder & CEO, Laravel > “At JetBrains, we’re proud to support the PHP Foundation and its commitment to strengthening PHP. It’s great to see how the Foundation’s achievements directly benefit the developer community we deeply care about, and we’re excited to be part of PHP’s ongoing success.” Artemy Pestretsov, Product Leader, PhpStorm at JetBrains > “At GoDaddy, we recognize that PHP is the backbone of the open web and the engine powering many of the sites we host. Our contribution to The PHP Foundation is a strategic investment in maintaining the secure, reliable, and innovative technology that drives our digital ecosystem.” Courtney Robertson, Open Source Developer Relations, GoDaddy > “PHP is absolutely vital to global business, enabling digital public spaces, human interaction, and commerce around the world. We’re proud to do our part by contributing to PHP’s continuous improvements through the PHP Foundation, and call on all other companies relying on PHP to join us.” Nils Adermann, Co-Founder, Composer, Private Packagist > “PHP is my favorite foundation. There I said it. Why? Their primary objective is to pay developers. You'd think that is obvious but most foundations do everything but that.” Chad Whitacre, Head of Open Source, Sentry ## Projects for The Sovereign Tech Agency Delivered Successfully The Sovereign Tech Agency (STA) supports the development, improvement, and maintenance of open digital infrastructure in the public interest. Its goal is to strengthen the open-source ecosystem sustainably, focusing on security, resilience, technological diversity, and the people behind the code. STF is funded by the German Federal Ministry for Economic Affairs and Climate Action (BMWK) and supported by the German Federal Agency for Disruptive Innovation GmbH (SPRIND). The Sovereign Tech Agency commissioned work on four major projects, all of which we successfully delivered. Here’s a brief overview of the results. ### PECL Overhaul The previous system for distributing PHP extensions, PECL/PEAR, is outdated, clumsy for users, and prone to supply-chain attacks, making it unreliable for average developers. This as a result leads to the creation of redundant tools and multiple security issues. We proposed to rewrite the PECL installer, replacing the messy code and the inefficient website. The result is **🥧PIE** **(PHP Installer for Extensions)** , a new tool that replaces PECL with a PHP-native toolchain that is easier to maintain and more secure. It relies on the packagist.org infrastructure which is also a native PHP ecosystem. Follow the progress of **PIE** here: https://github.com/php/pie. The tool has already gathered a group of contributors and was well received in the community: * Pie: new extension installer for PHP * PIE: The PHP’s Next Big Thing * Introducing PIE: The Modern PHP Extension Installer * PIE (PHP Installer for Extensions) We continue investing in PIE in 2025. ### Web Services Tool for PHP-FPM The Web Services Tool (WST) is a command-line application designed to test PHP-FPM integration across different web servers, environments, and configurations. Currently, the tool is hosted under a separate GitHub organization (wstool/wst), with plans to move it to the official PHP GitHub organization in the future. WST has already proven valuable for PHP-FPM development and testing, helping to identify and address complex issues that were previously untested in an automated way. Learn more in the introductory blog post. ### Security Audit We conducted the first external security audit of the PHP core source code in over a decade. The audit is organized in partnership with **OSTIF** and performed by **Quarkslab**. The public report is currently pending and will be published on The PHP Foundation website once available. ### Documentation Improvements We made multiple incremental improvements to the PHP documentation and also conducted a security review of the docs. Like the source code audit, this review was organized in partnership with **OSTIF** and performed by **Quarkslab**. As the scope here was too huge, we had to be smart and limit the review to certain most impactful pages. Additionally, a new Wasm-based PHP runner has been included allowing all code example blocks to be executed directly on the page thanks to Les-Tilleuls.coop. Further improvements have been made since then, by fixing more examples and including resources to make the XML extensions' examples work.. An auto-cleaner script has also been added that removes comments older than 1 year with a score of -5 or lower. This has removed around 2000 low-quality notes from the site. ### Infrastructure Update As part of The Sovereign Tech Bug Resilience Program, we partnered with Neighbourhoodie Software to overhaul the scripts powering parts of PHP’s web infrastructure, and also set up more appropriate back-ups. Previously scattered scripts have been consolidated into robust Ansible playbooks. The rollout is currently being planned, and will result in a much easier to maintain and restore the PHP project's infrastructure. In the future, all infrastructure will likely be managed through this. ## The PHP Foundation Staff ### Renewing contracts In 2023, we had a team of 6 developers. All of them demonstrated a high quality of work, and dedication to the mission of the foundation. We were happy to renew the contracts for 2024 as well as extend the total number of hours for developers requesting it. We aim to review the rates every year based on the available funding and priorities. ### Growing the Team As was mentioned in the previous transparency report, we aimed to extend the team. It did not happen in 2023 because one of the prospective developers could not join the team for personal reasons, and had to step down from PHP core development entirely. Again, this is the Bus Factor at its worst. However, we were able to extend the team starting with 2024. Initially, we offered the new developers 6-month trial contracts so that the developers and the Governing Board can evaluate the results and then decide whether to continue the engagements. The results were far beyond our expectations. All new developers David Carlier, James Titcumb, Saki Takamachi, and Shivam Mathur demonstrated dedication and brought high value results, and demonstrated value. ### Why didn’t we add more developers? In October 2024, following our usual process, we opened applications to expand or update our development team. We received many applications, including some from highly qualified candidates. However, we ultimately decided not to expand the team this time. **The main reason is simple: budget constraints.** Our funding from sponsorships determines how much we can afford, and we prioritize long-term stability over short-term expansion. Retaining the current team ensures we maintain the compound benefits of accumulated knowledge and experience. Growing the team temporarily, only to downsize later, would be counterproductive. If we secure additional funding throughout the year, we may revisit the decision to expand the team. ### The team as of 2025 Starting from January, we continue contracting 10 developers to work on PHP: * **Arnaud Le Blanc** @arnaud-lb * **David Carlier** @devnexen * **Derick Rethans** @derickr * **Gina Peter Banyard** @Girgias * **Ilija Tovilo** @iluuu1994 * **Jakub Zelenka** @bukka * **James Titcumb** @asgrim * **Máté Kocsis** @kocsismate * **Saki Takamachi** @SakiTakamachi * **Shivam Mathur** @shivammathur ## Retrospective: Goals of 2024 In the previous report, we outlined a few organizational and technical goals. Let’s look back and evaluate the results. ### Organization goals **Onboard new major sponsors ❌✅** We did have a few new and returning major sponsors, including Laravel, GoDaddy, Manychat. And of course we are happy about ongoing sponsorship from our founding members, and increased commitment from Automattic. **Explore strategic partnerships and marketing opportunities ✅** We did collaborate with the Sentry team on Open Source Pledge initiative **Further develop the Advisory Board initiative ❌** The Advisory Board played a big role in shaping the Hooks RFC. However, we have much more potential. In 2025, we’d like to revamp the AB to make it more useful and collaborative. **Grow the foundation's community ✅** The PHP Foundation Slack is an invite-only community, and its closed nature has helped keep it very productive. We gradually add more community leaders and developers, along with one-channel guests for specific tasks. We also maintain a public channel, **# php-internals**, which is mirrored on the PHP Community Discord server. ### Technical goals **Ongoing maintenance and development of the PHP core ✅** **Deliver the STF projects ✅** **Improve the quality of the ideas and RFCs coming from the foundation ✅** All of the RFCs from The PHP Foundation — even major ones like Hooks — passed the vote. We see that as a clear sign of the proposals’ quality. **Conduct research and surveys to define priorities ❌✅** We conducted quantitative research in collaboration with the PhpStorm team and JetBrains. However, we were unable to conduct a PHP community survey. Nevertheless, we supported Zend by Perforce PHP Landscape Survey. **Develop a high-level roadmap for PHP changes sponsored by the foundation ❌** The roadmap and vision need further development and discussion. We plan to announce a few strategic moves in the upcoming months. ## PHP Language Impact Every day, the PHP Foundation staff team contributes to the open-source repositories of the PHP GitHub organization. The foundation team contributes in many forms: filing issues, reviewing pull requests, participating in discussions on mailing lists, triaging issues, submitting RFC proposals. In this document, four categories of contributions are presented in more detail: commits to php-src, reviews of pull requests on php-src, submitted RFC documents, and documentation work. ### Commits to PHP The following chart summarizes the number of commits made to the php/php-src repository in 2024. | 2022 | 2023 | 2024 ---|---|---|--- Total by The PHP Foundation | 683 | 784 | 1976 Total other | 885 | 1588 | 3378 We’re happy to see not only an **increase in commits from PHP Foundation** developers but also a significant **boost in contributions from other developers** and the wider community. We consider this one of our biggest achievements and a strong sign of a thriving, **healthy ecosystem**. > Note that the number of commits does not fairly represent the level of effort or the scope of the work. However, it can demonstrate the foundation's relative level of contribution to the PHP core through an objective metric. ### Reviews The diagram summarizes the number of pull request reviews made in the php/php-src repository from January 1 to December 31, 2024. | 2022 | 2023 | 2024 ---|---|---|--- Total by The PHP Foundation | 283 | 702 | 1278 Total other | 551 | 416 | 866 ### RFCs Below are the RFC proposals authored or co-authored by The PHP Foundation developers in 2024 (date order). RFC | Proposed | Status ---|---|--- Property hooks | 2023-01-03 | Implemented Release cycle update | 2023-11-05 | Implemented Dedicated StreamBucket class | 2024-01-19 | Implemented Support object type in BCMath | 2024-03-24 | Implemented Correctly name the rounding mode and make it an Enum | 2024-04-21 | Implemented Asymmetric Visibility v2 | 2024-05-09 | Implemented Lazy Objects | 2024-06-03 | Implemented Property hook improvements | 2024-06-28 | Implemented Make the GMP class final | 2024-06-29 | Implemented Add bcdivmod to BCMath | 2024-06-30 | Implemented Fix up BCMath Number Class / Change GMP bool cast behavior | 2024-06-30 | Implemented Change Directory class to behave like a resource object | 2024-09-14 | Implemented PHP.net Analytics Collection | 2024-10-28 | Approved ### Generics Generics are one of the most requested PHP features, but also the hardest. In 2024, the Foundation funded exploratory research into how generics might be implemented. The result of that research is available in its own blog post. In short, there is potential to make it happen but still some significant performance-related issues to resolve. ### Release Maintenance Saki Takamachi, one of the Foundation developers, volunteered to be a release manager for PHP 8.4. The PHP Foundation supported such an initiative. Jakub Zelenka, another foundation developer, continued duty as a release manager for PHP 8.3. Also supported by the foundation. ### Security The PHP Foundation contributed significantly to the 4 security releases. As per PHP 8.1 changelog, most security issues were addressed by Niels Dossche (11), followed by the foundation developers Jakub Zelenka (6) and Arnaud Le Blanc (1). There has been additional work done in terms of reviews and release preparations. In addition, various documentation security issues were fixed by the foundation developers as result of the security audit. ## The PHP Foundation and the EU Cyber Resilience Act The PHP Foundation is now a founding member of the Cyber Resilience Act Working Group, giving us a key role in monitoring developments, representing PHP’s interests, and ensuring compliance with the regulation. Late last year, the group evolved into the Open Regulatory Compliance Working Group (ORCWG). Jakub Zelenka, the Foundation developer, is part of the FAQ task force. That allows us to play an advisory role and help prepare the PHP ecosystem for the regulations. For more details, see: * TechCrunch: Open Source Foundations Unite on Common Standards * Eclipse Foundation Announcement * ORCWG website: orcwg.org ### Open Source Pledge Collaboration with Sentry In 2024, Sentry launched the Open Source Pledge, with the aim of encouraging companies that rely on Open Source systems to help directly fund Open Source development. The PHP Foundation is also a supporter of this effort; contributing to Open Source is its entire purpose. The Foundation also welcomes sponsorships from companies and organizations that wish to support Open Source as part of their Pledge. ## The PHP Foundation brand & public channels The PHP Foundation represents a community of core PHP developers and advocates for the PHP programming language. The PHP Foundation used the channels listed below for public communication: * 12,546 Twitter followers https://twitter.com/thephpf * 18,337 LinkedIn page followers https://www.linkedin.com/company/phpfoundation * 1,060 Mastodon followers https://phpc.social/@thephpf * 1,029 Bluesky followers https://bsky.app/profile/thephpf.bsky.social PHP Foundation developers and board members gave talks at multiple conferences throughout the year: * Laracon EU – Roman Pronskiy * PHP UK Conference – Derick Rethans, Gina Banyard * International PHP Conference – Derick Rethans, Nils Adermann * FrOSCon – Sebastian Bergmann * php[tek] – Derick Rethans, Nils Adermann * DrupalCon Barcelona- Nils Adermann * betterCode(PHP) – Saki Takamachi, Sebastian Bergmann, Nils Adermann * ForumPHP – Gina P. Banyard, Derick Rethans, Nicolas Grekas * SymfonyCon – Nicolas Grekas, Nils Adermann * Various Symfony meetups in France and Germany - Nicolas Grekas * ConFoo — Derick Rethans, Nicolas Grekas * Dutch PHP Conference — Derick Rethans * phpDay — Derick Rethans, Gina Banyard * AFUP Days 2024 Lille — Gina Banyard ### Gina made it to OpenUK’s ‘New Year Honours List’ Gina Banyard, one of the Foundation's developers, was awarded an Honour by OpenUK, an Open Technology organization that recognizes "above and beyond" contributions to Open Source. Congratulations, Gina! ## Financial report In 2024, The PHP Foundation was financially backed by organizations and individuals with the goal of paying a competitive salary to as many core developers as possible. | 2021-2022 | 2023 | 2024 ---|---|---|--- Total donated | $ 712,484 | $ 478,767 | $ 683,550 Fees * | $ 90,273 | $ 60,098 | $ 83,110 Total received | $ 622,211 | $ 418,669 | $ 600,440 Paid to developers | $ 133,285 | $ 275,181 | $ 635,487 _* Fees include a 10% Open Source Collective fiscal host fee (dealing with contracts, expense reviews and payments, bank account management, official registrations and dealing with government requirements, open collective platform development etc), and 1-5% percent of payment processing fees, depending on the payment method used._ All incoming and outgoing transactions of The PHP Foundation are publicly available to view for anyone: https://opencollective.com/phpfoundation#category-BUDGET ## Goals for 2025 Our foremost mission remains the same: **maintain and develop the PHP language**. We’d like PHP to be the best platform for users and for businesses creating web applications and APIs. The main challenge for continuing the work of The PHP Foundation is to ensure sustainable sponsorship. From a technical standpoint, the goal is to ensure that foundation developers work on valuable tasks. ### Organization Goals * Secure funding to support core development and marketing initiatives. * Launch the "PHP 30" anniversary campaign in collaboration with JetBrains. * Consolidate and grow social media presence across multiple platforms. * Increase website traffic through improved documentation and resources. * Develop an Ambassador Program. * Begin preparation for the "PHP Next" marketing campaign to highlight PHP's modernization. * Modernize PHP's website with updated downloads page, documentation, and homepage. ### Technical Goals * Continue on-going maintenance and development of the PHP core. * Establish a working group for integrating modern HTTP server capabilities into PHP core. * Address key developer experience pain points, particularly for first-time users. ## Budget plan for 2025 In 2025, we adjusted the developers’ hours according to their availability, requests, and our budget restrictions. With this plan, we estimate our annual spending cap at approximately **$900,000** for developer compensation. Our collaboration with the OpenCollective platform has been positive, and we plan to continue operating under the umbrella of the Open Source Collective in 2025. This means that sponsorships we receive are reduced by 10% for Open Source Collective fees and 0-5% for payment processing fees. ## Outro The PHP language is a living entity and, as such, requires continuous support to address developer issues, resolve security vulnerabilities, and has to evolve to meet the needs of the future. Based on the strong third year of the foundation, we are excited to continue and multiply the efforts in the next years. With **your help**, we continue the mission to support, advance, and develop the PHP language. Join The PHP Foundation

We are thrilled to announce that after a year of hard work, dedication, and collaboration, **PHP 8.4** is officially here! Thanks to the tireless efforts of the PHP Foundation members, the core PHP development team, and an incredible community of contributors, this upcoming version brings major new features and syntax, performance and security enhancements, and a healthy amount of deprecations. ## A Year of Hard Work and Collaboration The PHP Foundation financially supports ten PHP core developers. The PHP Foundation members, along with a total of **115 contributors** , have made over **2,600 commits** since PHP 8.3 until PHP 8.4.0 release. PHP 8.4 includes changes from **36 RFCs**. There have also been numerous mailing list discussions and RFCs that were withdrawn, declined, or are still under discussion. Since PHP 8.0, PHP 8.4 received the highest number of RFCs, and PHP 8.4 brings the changes such as property hooks and asymmetric visibility that received significant community involvement and refinement. ## What PHP 8.4 Brings PHP 8.4 brings numerous new features and improvements to PHP. We covered some of them in our previous post as well, but they are mentioned here as well, for more complete picture. As we also covered in PHP Core Roundup #19, Property Hooks and Asymmetric Visibility are two of the highlighted features in PHP 8.4 * * * ### PHP 8.4 supports Property Hooks! In PHP 8.4, it is possible for a class to declare class properties with "hooks", that get executed when the property is accessed or set, and the hooks can access the object context. Property hooks open up a wide range of use cases that allow classes to declare virtual properties that enable expressive and intuitive APIs, make code readable and simple and avoid boilerplate code. class User { public string $emailAddress { set { if (!filter_var($value, FILTER_VALIDATE_EMAIL)) { throw new ValueError('emailAddress property must be a valid email address'); } $this->emailAddress = $value; } } } $user = new User(); $user->emailAddress = '[email protected]'; // Allowed $user->emailAddress = 'not an email address'; // Throws ValueError Larry Garfield wrote in PHP 8.4: How Property Hooks Happened about how he and Ilija Tovilo 💜 brought Property Hooks to PHP. ### Asymmetric Visibility PHP 8.4 introduces asymmetric visibility, allowing different access levels for getting and setting class properties. This feature is useful when you want to expose a property for reading but not writing. class User { public private(set) int $userId; public function __construct() { $this->userId = 42; } } $user = new User(); echo $user->userId; // 42 $user->userId = 16; // Error: Cannot modify private(set) property ### Lazy Objects PHP 8.4 brings support for Lazy Objects. Using the Reflection API, it is possible to create class instances in PHP 8.4 that they are initialized only if needed. The Lazy Objects documentation provides detailed examples and use cases. ### HTML5-compliant parser in DOM Extension PHP 8.4 upgrades the DOM extension with HTML5-compliant parsing. The new `Dom\HTMLDocument` and `Dom\XMLDocument` classes replace libxml2, which previously lacked HTML5 support. These updates improve DOM spec compliance and add features like CSS selector support. ### BCMath adds operator-overloaded `BcMath\Number` class The BCMath extension now includes the `BcMath\Number` class, enabling operator overloading for arithmetic operations. use BcMath\Number; $num1 = new Number('22'); $num2 = new Number('7'); $num3 = new Number('100'); $result = ($num1 / $num2) + $num1 - $num2; echo $result; // 18.1428571428 You can now use standard operators (`+`, `-`, `/`) with `BcMath\Number` objects, which also support all `bc*` functions. These objects are immutable and implement the `Stringable` interface, so they can be used in string contexts like `echo $num`. ### New Functions * `array_find`, `array_find_key`, `array_any`, and `array_all` * `bcdivmod`, `bcround`, `bcceil`, and `bcfloor` * `mb_trim`, `mb_ltrim`, and `mb_rtrim` * `mb_ucfirst` and `mb_lcfirst` * `grapheme_str_split` * `fpow` * `http_get_last_response_headers` and `http_clear_last_response_headers` ### PDO Driver-Specific Subclasses The PDO Driver-specific subclasses RFC is implemented in PHP 8.4. Previously, it was voted for PHP 8.3 but was not implemented in PHP 8.3 before its feature-freeze. PHP 8.4 now adds `Pdo\Mysql`, `Pdo\Pgsql`, `Pdo\Sqlite`, `Pdo\DbLib`, and `Pdo\Firebird` classes that extend the `PDO` class. Driver-specific methods, properties, and constants are now available in the driver-specific subclass. Driver-specific sub classes also allow APIs to be more expressive and restrictive by allowing the functions and methods only to accept/return driver-specific sub-classes. ### `AEGIS-128L` and `AEGIS256` support in Sodium extension **AEGIS** is an AES-based family of authenticated encryption algorithms that is faster than AES-GCM. The Sodium extension in PHP 8.4 supports `AEGIS-128L` and `AEGIS256` encryption algorithms if the Sodium extension is compiled with `libsodium` 1.0.19 or later. Apart from the new features, PHP 8.4 also updates several underlying dependencies and datasets, as well as unbundling three extensions: ### Updated dependencies * The Curl extension now requires libcurl 7.61.0 or later, and even capable of making HTTP/3 requests if it is compiled with a supporting TLS library. * The PCRE extension ships with PCRE 10.44, which provides support for Unicode 15 characters and character blocks, improved Regular Expression syntax, and performance improvements on certain systems. * OpenSSL extension now requires OpenSSL 1.1.1 or later, with improved support for OpenSSL 3.x series. It can now support Curve25519 and Curve448 based keys. Further, OpenSSL can be compiled to provide Argon2 password hashing on OpenSSL 3.2+ on PHP NTS builds. * To compile PHP as an Apache module (`mod_php`), PHP 8.4 drops support for the EOL Apache 2.0 and 2.2 series. The minimum required Apache version is now 2.4. * The zlib extension now requires zlib version 1.2.11 at minimum. ### Unbundled Extensions IMAP, Pspell, OCI8, and PDO_OCI8 extensions are unbundled from the PHP core, and are now available as PECL extensions, for which PIE might help to install easily. ### Updated PHP Icon on Windows PHP 8.4 also brings a minor, yet _very_ overdue change to the PHP icon on Windows executables: | ---|--- | Old Icon | New Icon ## Looking Ahead: PHP 8.4 and Beyond PHP 8.4 is the first major new PHP releases since the adoption of the new PHP maintenance policy. PHP 8.4, along with all current active PHP versions, will receive two years of active support and two years of security fixes. What this means is that PHP 8.4 will receive bug fixes until the end of 2026 and security fixes until the end of 2028. We just announced the pre-release of PIE - PHP Installer for Extensions. PIE will significantly improve the workflow of downloading and compiling PHP extensions. PHP 8.5 (in the `master` branch) is currently under active development, and we already have RFCs such as Support Closures in constant expressions in voting phase, and Add RFC3986 and WHATWG compliant URI parsing support under discussion. ## Get Ready to Upgrade PHP 8.4.1 is now a tagged release on PHP's GitHub repository. Compiled binaries and container images are available for: * Debian and Ubuntu-based Linux distros from Ondrej Sury's repositories. * Fedora/RHEL/Rocky/Alma Linux from Remi's repositories. * MacOS on MacPorts and Homebrew shivammathur/homebrew-php tap. * Windows on windows.php.net. * Docker and Podman Docker Hub * * * ## Support PHP Foundation At The PHP Foundation, we support, promote, and advance the PHP language. We financially support ten PHP core developers to contribute to the PHP project. You can help support PHP Foundation on OpenCollective or via GitHub Sponsors. A big thanks to all our sponsors — PHP Foundation is all of us! Follow us on Twitter/X @ThePHPF, Mastodon, LinkedIn, and Bluesky to get the latest updates from the Foundation. 💜️ 🐘 > PHP Roundup is prepared by Ayesh Karunaratne from **PHP.Watch** , a source for PHP News, Articles, Upcoming Changes, and more.

Wow. Can you believe it? Just three years (and one day) ago, PHP had no organization behind it. Only two people were being paid to work on the language that powers 70% of the web. Here’s the very first announcement about the creation of the PHP Foundation: The New Life of PHP – The PHP Foundation. ## Fast forward to today We now have a team of 10 talented engineers dedicated to PHP. We’re supported by major companies, governments, and an incredible community. That same community is creating amazing projects with PHP, while businesses continue to thrive thanks to a mature, secure, and performant language. Since 2021, we’ve seen three PHP releases—PHP 8.2, 8.3, and the freshly released PHP 8.4. Here are just a few highlights from these releases, developed by the PHP Foundation team: * Property hooks * Asymmetric Visibility * Lazy Objects * New tool for installing extensions: pie * Support object type in BCMath * Saner Increment/Decrement operators * Multiple type system improvements: null and false as stand-alone types, Disjunctive Normal Form Types * Readonly amendments * Dynamic class constant fetch * Arbitrary static variable initializers ## Feature development is only about 20% of what the foundation team does Behind the scenes, there’s a lot more: triaging and fixing issues, handling security reports, reviewing code, updating documentation, and maintaining infrastructure. All of this work empowers the community and ensures PHP is stable and reliable. Here are some highlights: * The total contributions to the PHP repositories grew by 51+% * We conducted the first external security audit for PHP in 10 years * We extended security support for PHP versions by one year * We improved CI and testing infrastructure * We introduced automated benchmarks to track performance regressions None of this would be possible without our sponsors. Huge thanks to every company and individual who has supported us over the past three years! Special shout-outs to: JetBrains, Automattic, Sovereign Tech Agency, Craft CMS, Private Packagist, Tideways, Zend by Perforce, Laravel, Symfony, Mercari Inc., Les-Tilleuls.coop, pixiv Inc., Aternos GmbH, Sentry, Ardennes-étape, Cybozu, and many others — PHP is all of us! If you haven’t already, please consider sponsoring the PHP Foundation 🙏 Here’s to PHP and many more years ahead! 🐘💜

We’re thrilled to announce that **Passbolt has joined the PHP Foundation** as a Silver sponsor! PHP powers over 77% of the web – including Passbolt’s collaborative password and secrets manager. Their support strengthens our mission to keep it thriving. Check out their heartfelt announcement here: **Passbolt’s Blog**. The Foundation funds developers to ensure PHP remains fast, secure, and innovative. With Passbolt and many other industry leaders by our side, we’re building a sustainable future for the language we all rely on. > This post kicks off a new blog series highlighting our amazing sponsors. Stay tuned as we spotlight the companies and individuals driving PHP forward – each one a vital part of our community’s success. Want to join the effort? Sponsor The PHP Foundation and help us power the web’s backbone! 🐘💜

The PHP Foundation is thrilled to announce our community sponsorship of both Laracon EU and Laracon India! We believe in the power of in-person connections and are excited to support these conferences as they bring together PHP enthusiasts from around the world. ## Laracon EU * **Location:** Amsterdam, Netherlands * **Date:** February 3–4 * **Meet us:** This year at Laracon EU you can meet Roman Pronskiy, Sebastian Bergmann, and Nils Adermann from the PHP Foundation board. Can you spot our first ever conference banner? ## Laracon India * **Location:** Ahmedabad, India * **Date:** March 8–9 * **Sponsorship:** Laracon India welcomes sponsors who are eager to support the Laravel community and connect with talented developers in India. ## Let's Collaborate! The PHP Foundation is committed to fostering the growth and development of the PHP ecosystem. We’re excited to collaborate with and support (non-financially) PHP conferences and meetups worldwide! 📩 Get in touch: [email protected]. Here are a few upcoming events to watch for: * PHP UK Conference 2025 – London, UK, February 19. * Dutch PHP Conference – Amsterdam, March 18–21. * PHP Conference Odawara 2025 – Japan, April 12. * PHPDay – Verona, May 16-17. * php[tek] 2025 – Chicago, IL, USA, May 20-22. * PHPers Summit 2025 – Poznań, Poland, 24-25 May. * International PHP Conference – Berlin, June, 3–5. 🐘💜

The PHP Foundation is pleased to announce the completion of a comprehensive security audit of the PHP source code (php/php-src), **commissioned by theSovereign Tech Agency**. This initiative was organized in partnership with the Open Source Technology Improvement Fund (OSTIF) and executed by the esteemed security group Quarkslab. ## Audit Overview Conducted over a two-month period in 2024, the audit encompassed: * Development of a threat model tailored to php-src * Manual code reviews * Dynamic testing procedures * Cryptographic assessments The collaboration between Quarkslab’s auditors and PHP maintainers ensured a thorough examination of the codebase. > _⚠️_ > Due to budget constraints, the recent security audit focused on the most critical components of the PHP source code rather than the entire codebase. Organizations interested in sponsoring a comprehensive audit or additional assessments are encouraged to contact us! > _⚠️_ ## Key Findings The audit identified 27 issues, with 17 having security implications: * 3 High-severity * 5 Medium-severity * 9 Low-severity Additionally, 10 informational findings were reported. Notably, four vulnerabilities received CVE identifiers: * CVE-2024-9026: Log tampering vulnerability in PHP-FPM, allowing potential manipulation or removal of characters from log messages. * CVE-2024-8925: Flaw in PHP’s multipart form data parsing, potentially leading to data misinterpretation. * CVE-2024-8929: Issue where a malicious MySQL server could cause the client to disclose heap content from other SQL requests. ## Recommendations and Resolutions Quarkslab’s report commended the overall high quality and specification adherence of the php/php-src project. The PHP development team has addressed all identified issues. Users are strongly encouraged to upgrade to the latest PHP versions to benefit from these security enhancements. ## Acknowledgments We extend our gratitude to the individuals and organizations that made this audit possible: * **The PHP Foundation Team and PHP maintainers:** Jakub Zelenka, Arnaud Le Blanc, Niels Dossche, Ilija Tovilo, Stas Malyshev, Dmitry Stogov, Derick Rethans, and Roman Pronskiy. * **Quarkslab Team:** Angèle Bossuat, Julio Loayza Meneses, Mihail Kirov, Sebastien Rolland, Ramtine Tofighi Shirazi. * **Sovereign Tech Agency:** Abigail Garner and the team – for commissioning the audit and all the help. * **OSTIF:** Amir Montazery, Derek Zimmer, Helen Woeste – for organizing the collaboration. This audit underscores our commitment to enhancing PHP’s security and reliability. We remain dedicated to ongoing improvements and collaborations to ensure PHP’s robustness for the global development community. ## Further Reading * Audit Report * OSTIF Blog * Quarkslab Blog If your company is interested in commissioning another round of security audit, please contact The PHP Foundation team: [email protected]. 🐘💜

FrankenPHP, a modern high-performance PHP application server created by Kévin Dunglas and sponsored by Les-Tilleuls.coop, is now officially supported by the PHP Foundation. FrankenPHP integrates PHP directly into Go and Caddy, simplifying deployment, improving performance, and reducing costs. It powers real-time features, supports advanced hosting scenarios, and offers a performance-boosting “worker mode” already integrated by Laravel, Symfony, and Yii. The PHP Foundation will actively contribute to FrankenPHP’s development and host its code on the official PHP GitHub, marking a major step toward modernizing the PHP ecosystem while keeping governance with the original maintainers. PHP is a programming language used by around 70% of websites and applications, and by key software and frameworks such as WordPress, Laravel, and Symfony. FrankenPHP offers a host of new features that allow to: * simplify the development of applications written in PHP; * drastically improve performance, while considerably reducing hosting costs (FinOps) and energy consumption (GreenOps); * facilitate deployment in production, whether on bare-metal servers or in cloud-native environments; * easily develop real-time features thanks to native Mercure protocol support; * extend PHP apps with Go, C, and C++ programming languages; * support the PHP programming language in any application written in Go (server, proxy, in-house development...). Specifically, FrankenPHP integrates the official PHP interpreter as a module for Go and Caddy, the popular next-generation web server that supports the latest web platform innovations in terms of performance, security, and DevOps: HTTP/3, compression with Zstandard, 103 Early Hints, automatic generation and renewal of HTTPS certificates, Encrypted Client Hello, structured logs, OpenMetrics/Prometheus metrics… Caddy is also co-maintained by Kévin and sponsored by Les-Tilleuls.coop. Thanks to its innovative architecture, FrankenPHP lets you install a complete PHP environment (interpreter, web server, extensions, etc.) optimized for performance and security, by downloading a standalone statically compiled executable or a Docker image. FrankenPHP also offers a performance-optimized mode called “worker mode”, which takes advantage of the capabilities of the Go programming language. When this optional mode is used, the PHP application will be able to retain in memory those elements that can be reused to process other HTTP requests instead of being completely reset to process each incoming HTTP request (“share nothing” model). Worker mode is especially useful for frameworks such as Symfony and Laravel that can prevent rebuilding their kernels and services again and again for nothing. Using this mode requires minimal adaptations to the code of modern PHP applications in line with good programming practice. The Laravel, Symfony and Yii frameworks already offer official integrations of FrankenPHP's worker mode, enabling worker mode to be activated without modifying the application code. According to an analysis carried out this summer by Sylius, the publisher of the eponymous e-commerce platform, the use of FrankenPHP's worker mode reduces the software's response times by 80%, while reducing by more than 6 the number of machines required to serve the same number of users. FrankenPHP is now a reliable, mature solution used in production for an ever-increasing number of projects. The project now has almost 8,000 stars on GitHub, has passed the symbolic 100-contributor mark, and is officially supported by numerous hosting providers, including Upsun, Laravel Cloud, and Clever Cloud. To get to this point, it was necessary to initiate close collaboration between the development teams of FrankenPHP, the PHP interpreter itself, the Caddy web server, and even the Go programming language. Today, we're proud to announce that, with the aim of intensifying this collaboration, enabling the project to gain momentum, and modernizing the entire PHP ecosystem, **the FrankenPHP project is now officially supported by the PHP Foundation**. In concrete terms, FrankenPHP's source code will be transferred to the PHP project's GitHub organization, and the PHP Foundation team will contribute to the maintenance and development of FrankenPHP to ensure its reliability, durability, and compatibility with the latest language innovations. Part of the FrankenPHP documentation will also be transferred to the PHP website. The governance of the project remains unchanged, and the current team of maintainers (Kévin Dunglas, Robert Landers, Alexander Stecher) will continue to be in charge of releases, as well as code reviews. They will be actively collaborating with the PHP Foundation team in charge of the language development. In addition to the support provided by the foundation, Les-Tilleuls.coop will continue to sponsor FrankenPHP (as well as PHP and Caddy) by providing developers and contributing financially. FrankenPHP is already promoted by Caddy as the official, modern solution for using PHP with this server. In the future, to simplify the PHP development experience (one-line installation of a complete development environment) and to promote a solution that, for projects requiring it, considerably improves the performance and efficiency of PHP applications, FrankenPHP may be highlighted on the PHP website as one of the ways to use the language (other SAPIs such as PHP-FPM will continue to be fully supported solutions). To find out more about FrankenPHP and the many new possibilities it offers, take a look at its documentation. To meet the software's authors and find out how it is used in production, don't miss the API Platform conference (by the same authors as FrankenPHP) taking place on September 18 and 19 in France (Lille). Also, join us online for **PHPverse on June 17** — a special event celebrating PHP’s 30th anniversary. Finally, to help keep the PHP ecosystem innovating, support the foundation! The PHP Foundation Les-Tilleuls.coop The Caddy team

As 2024 comes to a close, we at the PHP Foundation want to take a moment to thank everyone who has supported us this year. It’s been an incredible journey, and we couldn’t have done it without the amazing PHP community and our generous sponsors. ## A Year of Milestones In its third year, the PHP Foundation has achieved several milestones that have further strengthened the PHP ecosystem: first in a decade security audit, pie, numerous features and improvements for PHP 8.4, and much more to come next year! ## Celebrating Our Sponsors We owe a special thanks to our major sponsors who make our work possible: ### Platinum **Sovereign Tech Agency** **JetBrains** **Automattic** ### Gold **Laravel** **GoDaddy** **[ new! ✨]** ### Silver **Private Packagist** **Craft CMS** **Cybozu** **Tideways** **Zend by Perforce** **Symfony Corp** **Sentry** **Manychat** **[ new! ✨]** **Mercari Inc.** **Les-Tilleuls.coop** **pixiv Inc.** **Aternos GmbH** **CH Studio** Big thanks to newly joined major sponsors: **GoDaddy** and **Manychat**! Your contributions enable us to support developers, fund crucial projects, and ensure PHP is a modern and reliable choice for web development. If you are yet to decide on sponsoring the foundation, here you can find information on how to join us and why it matters. ## Wishing You Joyful Holidays ✨ To everyone in the PHP community, we wish you a joyful holiday season filled with warmth, happiness, and a well-deserved break. Thank you for your support, passion, and commitment to PHP. Here’s to a wonderful 2025! 🥂 Warm wishes, The PHP Foundation 🐘💜

FrankenPHP, a modern high-performance PHP application server created by Kévin Dunglas and sponsored by Les-Tilleuls.coop, is now officially supported by the PHP Foundation. FrankenPHP integrates PHP directly into Go and Caddy, simplifying deployment, improving performance, and reducing costs. It powers real-time features, supports advanced hosting scenarios, and offers a performance-boosting “worker mode” already integrated by Laravel, Symfony, and Yii. The PHP Foundation will actively contribute to FrankenPHP’s development and host its code on the official PHP GitHub, marking a major step toward modernizing the PHP ecosystem while keeping governance with the original maintainers. PHP is a programming language used by around 70% of websites and applications, and by key software and frameworks such as WordPress, Laravel, and Symfony. FrankenPHP offers a host of new features that allow to: * simplify the development of applications written in PHP; * drastically improve performance, while considerably reducing hosting costs (FinOps) and energy consumption (GreenOps); * facilitate deployment in production, whether on bare-metal servers or in cloud-native environments; * easily develop real-time features thanks to native Mercure protocol support; * extend PHP apps with Go, C, and C++ programming languages; * support the PHP programming language in any application written in Go (server, proxy, in-house development...). Specifically, FrankenPHP integrates the official PHP interpreter as a module for Go and Caddy, the popular next-generation web server that supports the latest web platform innovations in terms of performance, security, and DevOps: HTTP/3, compression with Zstandard, 103 Early Hints, automatic generation and renewal of HTTPS certificates, Encrypted Client Hello, structured logs, OpenMetrics/Prometheus metrics… Caddy is also co-maintained by Kévin and sponsored by Les-Tilleuls.coop. Thanks to its innovative architecture, FrankenPHP lets you install a complete PHP environment (interpreter, web server, extensions, etc.) optimized for performance and security, by downloading a standalone statically compiled executable or a Docker image. FrankenPHP also offers a performance-optimized mode called “worker mode”, which takes advantage of the capabilities of the Go programming language. When this optional mode is used, the PHP application will be able to retain in memory those elements that can be reused to process other HTTP requests instead of being completely reset to process each incoming HTTP request (“share nothing” model). Worker mode is especially useful for frameworks such as Symfony and Laravel that can prevent rebuilding their kernels and services again and again for nothing. Using this mode requires minimal adaptations to the code of modern PHP applications in line with good programming practice. The Laravel, Symfony and Yii frameworks already offer official integrations of FrankenPHP's worker mode, enabling worker mode to be activated without modifying the application code. According to an analysis carried out this summer by Sylius, the publisher of the eponymous e-commerce platform, the use of FrankenPHP's worker mode reduces the software's response times by 80%, while reducing by more than 6 the number of machines required to serve the same number of users. FrankenPHP is now a reliable, mature solution used in production for an ever-increasing number of projects. The project now has almost 8,000 stars on GitHub, has passed the symbolic 100-contributor mark, and is officially supported by numerous hosting providers, including Upsun, Laravel Cloud, and Clever Cloud. To get to this point, it was necessary to initiate close collaboration between the development teams of FrankenPHP, the PHP interpreter itself, the Caddy web server, and even the Go programming language. Today, we're proud to announce that, with the aim of intensifying this collaboration, enabling the project to gain momentum, and modernizing the entire PHP ecosystem, **the FrankenPHP project is now officially supported by the PHP Foundation**. In concrete terms, FrankenPHP's source code will be transferred to the PHP project's GitHub organization, and the PHP Foundation team will contribute to the maintenance and development of FrankenPHP to ensure its reliability, durability, and compatibility with the latest language innovations. Part of the FrankenPHP documentation will also be transferred to the PHP website. The governance of the project remains unchanged, and the current team of maintainers (Kévin Dunglas, Robert Landers, Alexander Stecher) will continue to be in charge of releases, as well as code reviews. They will be actively collaborating with the PHP Foundation team in charge of the language development. In addition to the support provided by the foundation, Les-Tilleuls.coop will continue to sponsor FrankenPHP (as well as PHP and Caddy) by providing developers and contributing financially. FrankenPHP is already promoted by Caddy as the official, modern solution for using PHP with this server. In the future, to simplify the PHP development experience (one-line installation of a complete development environment) and to promote a solution that, for projects requiring it, considerably improves the performance and efficiency of PHP applications, FrankenPHP may be highlighted on the PHP website as one of the ways to use the language (other SAPIs such as PHP-FPM will continue to be fully supported solutions). To find out more about FrankenPHP and the many new possibilities it offers, take a look at its documentation. To meet the software's authors and find out how it is used in production, don't miss the API Platform conference (by the same authors as FrankenPHP) taking place on September 18 and 19 in France (Lille). Also, join us online for **PHPverse on June 17** — a special event celebrating PHP’s 30th anniversary. Finally, to help keep the PHP ecosystem innovating, support the foundation! The PHP Foundation Les-Tilleuls.coop The Caddy team

## Executive Summary As of early 2025, The PHP Foundation comprises **8 volunteer board members** , **an Executive Director** sponsored by JetBrains, and **10 developers** paid part-time/full-time who contribute significantly to the PHP language and its extensions. In 2024, The PHP Foundation received **$683,550 in donations and investments** from organizations and individuals. The foundation’s primary focus in 2024 remained strengthening the maintenance of PHP core, housed in the php/php-src GitHub repository. This project is the home of the PHP language, where PHP’s interpreter is developed. Everyone who uses PHP benefits in one way or another from the work that is done in this repository. The 10 part-time and full-time developers contracted by The PHP Foundation were responsible for a substantial portion of the commits and reviews made to the PHP language. **Key achievements in 2024 included:** * Completion of projects funded by the Sovereign Tech Fund * Expansion of the development team * Increased contributions to PHP core * Enhanced community engagement and sponsor relations The foundation **plans to spend up to $900,000 in 2025** , including compensation and fees. We continue to seek additional sponsor contributions to sustain and expand these efforts in the coming years. ## The PHP Foundation Mission The PHP Foundation’s mission remains focused on ensuring the long-term prosperity of the PHP language. Our priorities continue to be: * Improving the language for users * Providing high-quality maintenance * Improving the project to retain current contributors and integrate new ones * Promoting the public image of PHP ## The PHP Foundation Sponsors In 2024, the following companies made major financial contributions (donating $12,000 or more): **Sovereign Tech Agency, JetBrains, Automattic, Laravel, GoDaddy.com, Craft CMS, Private Packagist, Cybozu, Tideways, Mercari Inc., pixiv Inc., Sentry, Manychat, Zend by Perforce, Les-Tilleuls.coop, CH Studio, Aternos GmbH.** Overall, 658 organizations and individuals sponsored the foundation in 2024 through on Open Collective and GitHub Sponsors. Here is what some of the prominent folks say. > “The PHP Foundation plays a vital role in ensuring the long-term sustainability and health of PHP. By supporting core development and fostering collaboration across the community, the Foundation helps keep PHP modern, stable, and thriving for years to come.” Taylor Otwell, Founder & CEO, Laravel > “At JetBrains, we’re proud to support the PHP Foundation and its commitment to strengthening PHP. It’s great to see how the Foundation’s achievements directly benefit the developer community we deeply care about, and we’re excited to be part of PHP’s ongoing success.” Artemy Pestretsov, Product Leader, PhpStorm at JetBrains > “At GoDaddy, we recognize that PHP is the backbone of the open web and the engine powering many of the sites we host. Our contribution to The PHP Foundation is a strategic investment in maintaining the secure, reliable, and innovative technology that drives our digital ecosystem.” Courtney Robertson, Open Source Developer Relations, GoDaddy > “PHP is absolutely vital to global business, enabling digital public spaces, human interaction, and commerce around the world. We’re proud to do our part by contributing to PHP’s continuous improvements through the PHP Foundation, and call on all other companies relying on PHP to join us.” Nils Adermann, Co-Founder, Composer, Private Packagist > “PHP is my favorite foundation. There I said it. Why? Their primary objective is to pay developers. You'd think that is obvious but most foundations do everything but that.” Chad Whitacre, Head of Open Source, Sentry ## Projects for The Sovereign Tech Agency Delivered Successfully The Sovereign Tech Agency (STA) supports the development, improvement, and maintenance of open digital infrastructure in the public interest. Its goal is to strengthen the open-source ecosystem sustainably, focusing on security, resilience, technological diversity, and the people behind the code. STF is funded by the German Federal Ministry for Economic Affairs and Climate Action (BMWK) and supported by the German Federal Agency for Disruptive Innovation GmbH (SPRIND). The Sovereign Tech Agency commissioned work on four major projects, all of which we successfully delivered. Here’s a brief overview of the results. ### PECL Overhaul The previous system for distributing PHP extensions, PECL/PEAR, is outdated, clumsy for users, and prone to supply-chain attacks, making it unreliable for average developers. This as a result leads to the creation of redundant tools and multiple security issues. We proposed to rewrite the PECL installer, replacing the messy code and the inefficient website. The result is **🥧PIE** **(PHP Installer for Extensions)** , a new tool that replaces PECL with a PHP-native toolchain that is easier to maintain and more secure. It relies on the packagist.org infrastructure which is also a native PHP ecosystem. Follow the progress of **PIE** here: https://github.com/php/pie. The tool has already gathered a group of contributors and was well received in the community: * Pie: new extension installer for PHP * PIE: The PHP’s Next Big Thing * Introducing PIE: The Modern PHP Extension Installer * PIE (PHP Installer for Extensions) We continue investing in PIE in 2025. ### Web Services Tool for PHP-FPM The Web Services Tool (WST) is a command-line application designed to test PHP-FPM integration across different web servers, environments, and configurations. Currently, the tool is hosted under a separate GitHub organization (wstool/wst), with plans to move it to the official PHP GitHub organization in the future. WST has already proven valuable for PHP-FPM development and testing, helping to identify and address complex issues that were previously untested in an automated way. Learn more in the introductory blog post. ### Security Audit We conducted the first external security audit of the PHP core source code in over a decade. The audit is organized in partnership with **OSTIF** and performed by **Quarkslab**. The public report is currently pending and will be published on The PHP Foundation website once available. ### Documentation Improvements We made multiple incremental improvements to the PHP documentation and also conducted a security review of the docs. Like the source code audit, this review was organized in partnership with **OSTIF** and performed by **Quarkslab**. As the scope here was too huge, we had to be smart and limit the review to certain most impactful pages. Additionally, a new Wasm-based PHP runner has been included allowing all code example blocks to be executed directly on the page thanks to Les-Tilleuls.coop. Further improvements have been made since then, by fixing more examples and including resources to make the XML extensions' examples work.. An auto-cleaner script has also been added that removes comments older than 1 year with a score of -5 or lower. This has removed around 2000 low-quality notes from the site. ### Infrastructure Update As part of The Sovereign Tech Bug Resilience Program, we partnered with Neighbourhoodie Software to overhaul the scripts powering parts of PHP’s web infrastructure, and also set up more appropriate back-ups. Previously scattered scripts have been consolidated into robust Ansible playbooks. The rollout is currently being planned, and will result in a much easier to maintain and restore the PHP project's infrastructure. In the future, all infrastructure will likely be managed through this. ## The PHP Foundation Staff ### Renewing contracts In 2023, we had a team of 6 developers. All of them demonstrated a high quality of work, and dedication to the mission of the foundation. We were happy to renew the contracts for 2024 as well as extend the total number of hours for developers requesting it. We aim to review the rates every year based on the available funding and priorities. ### Growing the Team As was mentioned in the previous transparency report, we aimed to extend the team. It did not happen in 2023 because one of the prospective developers could not join the team for personal reasons, and had to step down from PHP core development entirely. Again, this is the Bus Factor at its worst. However, we were able to extend the team starting with 2024. Initially, we offered the new developers 6-month trial contracts so that the developers and the Governing Board can evaluate the results and then decide whether to continue the engagements. The results were far beyond our expectations. All new developers David Carlier, James Titcumb, Saki Takamachi, and Shivam Mathur demonstrated dedication and brought high value results, and demonstrated value. ### Why didn’t we add more developers? In October 2024, following our usual process, we opened applications to expand or update our development team. We received many applications, including some from highly qualified candidates. However, we ultimately decided not to expand the team this time. **The main reason is simple: budget constraints.** Our funding from sponsorships determines how much we can afford, and we prioritize long-term stability over short-term expansion. Retaining the current team ensures we maintain the compound benefits of accumulated knowledge and experience. Growing the team temporarily, only to downsize later, would be counterproductive. If we secure additional funding throughout the year, we may revisit the decision to expand the team. ### The team as of 2025 Starting from January, we continue contracting 10 developers to work on PHP: * **Arnaud Le Blanc** @arnaud-lb * **David Carlier** @devnexen * **Derick Rethans** @derickr * **Gina Peter Banyard** @Girgias * **Ilija Tovilo** @iluuu1994 * **Jakub Zelenka** @bukka * **James Titcumb** @asgrim * **Máté Kocsis** @kocsismate * **Saki Takamachi** @SakiTakamachi * **Shivam Mathur** @shivammathur ## Retrospective: Goals of 2024 In the previous report, we outlined a few organizational and technical goals. Let’s look back and evaluate the results. ### Organization goals **Onboard new major sponsors ❌✅** We did have a few new and returning major sponsors, including Laravel, GoDaddy, Manychat. And of course we are happy about ongoing sponsorship from our founding members, and increased commitment from Automattic. **Explore strategic partnerships and marketing opportunities ✅** We did collaborate with the Sentry team on Open Source Pledge initiative **Further develop the Advisory Board initiative ❌** The Advisory Board played a big role in shaping the Hooks RFC. However, we have much more potential. In 2025, we’d like to revamp the AB to make it more useful and collaborative. **Grow the foundation's community ✅** The PHP Foundation Slack is an invite-only community, and its closed nature has helped keep it very productive. We gradually add more community leaders and developers, along with one-channel guests for specific tasks. We also maintain a public channel, **# php-internals**, which is mirrored on the PHP Community Discord server. ### Technical goals **Ongoing maintenance and development of the PHP core ✅** **Deliver the STF projects ✅** **Improve the quality of the ideas and RFCs coming from the foundation ✅** All of the RFCs from The PHP Foundation — even major ones like Hooks — passed the vote. We see that as a clear sign of the proposals’ quality. **Conduct research and surveys to define priorities ❌✅** We conducted quantitative research in collaboration with the PhpStorm team and JetBrains. However, we were unable to conduct a PHP community survey. Nevertheless, we supported Zend by Perforce PHP Landscape Survey. **Develop a high-level roadmap for PHP changes sponsored by the foundation ❌** The roadmap and vision need further development and discussion. We plan to announce a few strategic moves in the upcoming months. ## PHP Language Impact Every day, the PHP Foundation staff team contributes to the open-source repositories of the PHP GitHub organization. The foundation team contributes in many forms: filing issues, reviewing pull requests, participating in discussions on mailing lists, triaging issues, submitting RFC proposals. In this document, four categories of contributions are presented in more detail: commits to php-src, reviews of pull requests on php-src, submitted RFC documents, and documentation work. ### Commits to PHP The following chart summarizes the number of commits made to the php/php-src repository in 2024. | 2022 | 2023 | 2024 ---|---|---|--- Total by The PHP Foundation | 683 | 784 | 1976 Total other | 885 | 1588 | 3378 We’re happy to see not only an **increase in commits from PHP Foundation** developers but also a significant **boost in contributions from other developers** and the wider community. We consider this one of our biggest achievements and a strong sign of a thriving, **healthy ecosystem**. > Note that the number of commits does not fairly represent the level of effort or the scope of the work. However, it can demonstrate the foundation's relative level of contribution to the PHP core through an objective metric. ### Reviews The diagram summarizes the number of pull request reviews made in the php/php-src repository from January 1 to December 31, 2024. | 2022 | 2023 | 2024 ---|---|---|--- Total by The PHP Foundation | 283 | 702 | 1278 Total other | 551 | 416 | 866 ### RFCs Below are the RFC proposals authored or co-authored by The PHP Foundation developers in 2024 (date order). RFC | Proposed | Status ---|---|--- Property hooks | 2023-01-03 | Implemented Release cycle update | 2023-11-05 | Implemented Dedicated StreamBucket class | 2024-01-19 | Implemented Support object type in BCMath | 2024-03-24 | Implemented Correctly name the rounding mode and make it an Enum | 2024-04-21 | Implemented Asymmetric Visibility v2 | 2024-05-09 | Implemented Lazy Objects | 2024-06-03 | Implemented Property hook improvements | 2024-06-28 | Implemented Make the GMP class final | 2024-06-29 | Implemented Add bcdivmod to BCMath | 2024-06-30 | Implemented Fix up BCMath Number Class / Change GMP bool cast behavior | 2024-06-30 | Implemented Change Directory class to behave like a resource object | 2024-09-14 | Implemented PHP.net Analytics Collection | 2024-10-28 | Approved ### Generics Generics are one of the most requested PHP features, but also the hardest. In 2024, the Foundation funded exploratory research into how generics might be implemented. The result of that research is available in its own blog post. In short, there is potential to make it happen but still some significant performance-related issues to resolve. ### Release Maintenance Saki Takamachi, one of the Foundation developers, volunteered to be a release manager for PHP 8.4. The PHP Foundation supported such an initiative. Jakub Zelenka, another foundation developer, continued duty as a release manager for PHP 8.3. Also supported by the foundation. ### Security The PHP Foundation contributed significantly to the 4 security releases. As per PHP 8.1 changelog, most security issues were addressed by Niels Dossche (11), followed by the foundation developers Jakub Zelenka (6) and Arnaud Le Blanc (1). There has been additional work done in terms of reviews and release preparations. In addition, various documentation security issues were fixed by the foundation developers as result of the security audit. ## The PHP Foundation and the EU Cyber Resilience Act The PHP Foundation is now a founding member of the Cyber Resilience Act Working Group, giving us a key role in monitoring developments, representing PHP’s interests, and ensuring compliance with the regulation. Late last year, the group evolved into the Open Regulatory Compliance Working Group (ORCWG). Jakub Zelenka, the Foundation developer, is part of the FAQ task force. That allows us to play an advisory role and help prepare the PHP ecosystem for the regulations. For more details, see: * TechCrunch: Open Source Foundations Unite on Common Standards * Eclipse Foundation Announcement * ORCWG website: orcwg.org ### Open Source Pledge Collaboration with Sentry In 2024, Sentry launched the Open Source Pledge, with the aim of encouraging companies that rely on Open Source systems to help directly fund Open Source development. The PHP Foundation is also a supporter of this effort; contributing to Open Source is its entire purpose. The Foundation also welcomes sponsorships from companies and organizations that wish to support Open Source as part of their Pledge. ## The PHP Foundation brand & public channels The PHP Foundation represents a community of core PHP developers and advocates for the PHP programming language. The PHP Foundation used the channels listed below for public communication: * 12,546 Twitter followers https://twitter.com/thephpf * 18,337 LinkedIn page followers https://www.linkedin.com/company/phpfoundation * 1,060 Mastodon followers https://phpc.social/@thephpf * 1,029 Bluesky followers https://bsky.app/profile/thephpf.bsky.social PHP Foundation developers and board members gave talks at multiple conferences throughout the year: * Laracon EU – Roman Pronskiy * PHP UK Conference – Derick Rethans, Gina Banyard * International PHP Conference – Derick Rethans, Nils Adermann * FrOSCon – Sebastian Bergmann * php[tek] – Derick Rethans, Nils Adermann * DrupalCon Barcelona- Nils Adermann * betterCode(PHP) – Saki Takamachi, Sebastian Bergmann, Nils Adermann * ForumPHP – Gina P. Banyard, Derick Rethans, Nicolas Grekas * SymfonyCon – Nicolas Grekas, Nils Adermann * Various Symfony meetups in France and Germany - Nicolas Grekas * ConFoo — Derick Rethans, Nicolas Grekas * Dutch PHP Conference — Derick Rethans * phpDay — Derick Rethans, Gina Banyard * AFUP Days 2024 Lille — Gina Banyard ### Gina made it to OpenUK’s ‘New Year Honours List’ Gina Banyard, one of the Foundation's developers, was awarded an Honour by OpenUK, an Open Technology organization that recognizes "above and beyond" contributions to Open Source. Congratulations, Gina! ## Financial report In 2024, The PHP Foundation was financially backed by organizations and individuals with the goal of paying a competitive salary to as many core developers as possible. | 2021-2022 | 2023 | 2024 ---|---|---|--- Total donated | $ 712,484 | $ 478,767 | $ 683,550 Fees * | $ 90,273 | $ 60,098 | $ 83,110 Total received | $ 622,211 | $ 418,669 | $ 600,440 Paid to developers | $ 133,285 | $ 275,181 | $ 635,487 _* Fees include a 10% Open Source Collective fiscal host fee (dealing with contracts, expense reviews and payments, bank account management, official registrations and dealing with government requirements, open collective platform development etc), and 1-5% percent of payment processing fees, depending on the payment method used._ All incoming and outgoing transactions of The PHP Foundation are publicly available to view for anyone: https://opencollective.com/phpfoundation#category-BUDGET ## Goals for 2025 Our foremost mission remains the same: **maintain and develop the PHP language**. We’d like PHP to be the best platform for users and for businesses creating web applications and APIs. The main challenge for continuing the work of The PHP Foundation is to ensure sustainable sponsorship. From a technical standpoint, the goal is to ensure that foundation developers work on valuable tasks. ### Organization Goals * Secure funding to support core development and marketing initiatives. * Launch the "PHP 30" anniversary campaign in collaboration with JetBrains. * Consolidate and grow social media presence across multiple platforms. * Increase website traffic through improved documentation and resources. * Develop an Ambassador Program. * Begin preparation for the "PHP Next" marketing campaign to highlight PHP's modernization. * Modernize PHP's website with updated downloads page, documentation, and homepage. ### Technical Goals * Continue on-going maintenance and development of the PHP core. * Establish a working group for integrating modern HTTP server capabilities into PHP core. * Address key developer experience pain points, particularly for first-time users. ## Budget plan for 2025 In 2025, we adjusted the developers’ hours according to their availability, requests, and our budget restrictions. With this plan, we estimate our annual spending cap at approximately **$900,000** for developer compensation. Our collaboration with the OpenCollective platform has been positive, and we plan to continue operating under the umbrella of the Open Source Collective in 2025. This means that sponsorships we receive are reduced by 10% for Open Source Collective fees and 0-5% for payment processing fees. ## Outro The PHP language is a living entity and, as such, requires continuous support to address developer issues, resolve security vulnerabilities, and has to evolve to meet the needs of the future. Based on the strong third year of the foundation, we are excited to continue and multiply the efforts in the next years. With **your help**, we continue the mission to support, advance, and develop the PHP language. Join The PHP Foundation

At the PHP Foundation, we’re proud to be supported by companies that build amazing products and contribute back to the PHP ecosystem. Today we’d like to highlight Manychat — one of our Silver sponsors. Manychat is the world’s leading chat marketing platform, helping businesses connect with their customers on Instagram, WhatsApp, Facebook Messenger, and beyond. With over **1 billion conversations powered every year** across **170+ countries** , Manychat is a great example of how PHP scales and supports high-traffic applications around the world. ## Why PHP? Because Speed Wins In their recently published case study — _How Manychat Scaled to 1 Billion Conversations Using PHP_ — the Manychat team shares the story of how PHP helped them go from a tiny startup with just one developer to a platform supporting millions of users. > _“We could build right away — our only developer already knew PHP, so we skipped onboarding and got straight to work.”_ By choosing PHP, Manychat was able to build their MVP in just a few days and start learning from real users immediately. As they grew, they faced the familiar scaling challenges of high traffic, heavy workloads, and resource management. Their case study provides mentions architectural decisions they made — from using asynchronous request handling with NGINX + Lua, to optimizing background task processing with PHP-CLI workers, and managing database connections efficiently with PgBouncer. ## PHP at the Heart of a Global Platform Today Manychat’s platform continues to run on PHP, handling millions of API calls and conversations while keeping infrastructure costs under control. If you’re excited about building products that reach millions and love working with PHP at scale, check out the open positions at Manychat. They’re hiring PHP engineers! ## Supporting the Community Manychat isn’t just building with PHP — they’re giving back to the community. As a **Silver sponsor** of the PHP Foundation, they help us fund initiatives that keep PHP stable, modern, and accessible to millions of developers worldwide. In addition, Manychat is active in the tech community, hosting PHP meetups and events in **Barcelona** and **Amsterdam**. We love seeing our sponsors not only build great products but also foster connections between developers around the world. ## Read Their Story We encourage you to check out their full case study on scaling with PHP: 👉 _How Manychat Scaled to 1 Billion Conversations Using PHP_ **Thank you, Manychat, for your support!** 🐘💜 * * * > This post continues the blog series highlighting our amazing sponsors. Stay tuned as we spotlight the companies and individuals driving PHP forward – each one a vital part of our community’s success. Want to join the effort? Sponsor The PHP Foundation and help us power the web’s backbone!

PHP 8.4 is coming on 21 November this year. It includes a host of new functionality, but the biggest, in more ways than one, is Property hooks. Given the excitement around it, as well as its size, the PHP Foundation's Roman Pronsky asked me to write up a bit about the process we went through to produce this beast. What eventually became the twin RFCs of Property Hooks and Asymmetric Visibility is actually a very old discussion. We'll look back at the decade-plus saga that got us here, how Ilija Tovilo and I got sucked in, how the design came to be, and how we managed to get it across the finish line. Here's a teaser: It would not have happened without the PHP Foundation. ## Ancient history Ilija and I were not the first RFC to propose "property accessors," as they're called in most languages. In fact, our RFC was the fifth: 1. 2009: Property get/set syntax by Dennis Robinson. The core concepts and arguments behind it are all there, and haven't really changed in 15 years. It never went to a vote. 2. 2012: Property get/set syntax v1.2 by Clint Priest and Nikita Popov. It didn't pass the 2/3 threshold for a vote, but did pass 50%. 3. 2013: Property get/set syntax alternate typehinting syntax, by Nikita Popov. An alternate approach that proved very unpopular, failing 3 to 12. However, it included a shorthand syntax that looks suspiciously like what eventually became property types. 4. 2021: Property Accessors by Nikita Popov. More of a brainstorm of what property accessors could be, including specific use-case options like `lazy` or `guard`. It never went to a vote, but Nikita did note that "We could likely get 80% of the value of accessors by supporting read-only properties and 90% by also supporting private-write properties." (I don't fully agree, but much of the value is in private-write.) All of these attempts had a few things in common: * Pseudo-functions that live on properties and intercept get/set operations. * Asymmetric visibility * Interface properties ## A new team enters the arena Fast forward to the summer of 2022. Ilija Tovilo decided he wanted to take a swing at accessors next, and approached me for help. Ilija and I had already worked together on the Enums RFC, so we knew we worked well together. In part, that's because we have very different skill sets. Ilija is rapidly becoming one of the most PHP engine-knowledgeable people around and quite proficient at writing C code, but is, by his own admission, not the most proficient writer of English. I am a weirdo who enjoys language research, designing away edge cases, and can type fast enough to keep up with the Internals mailing list. We complement each other well. Illija is also fully funded by the PHP Foundation to work on the engine, without which this amount of work would have been impossible. I work on a volunteer basis, and as my employers allow. (Side note: As of this writing, I am between jobs. If you're looking for a highly-experienced PHP Staff/Principal Engineer with experience in design, architecture, and leading teams, please reach out and let's talk!) ## Research, then development With the initial goal of "making Nikita's proposal work-ish," I started digging into the research and design side. My initial brainstorming shows where our thoughts were at the time. In short: * There are two models of accessors: In untyped languages without visibility controls—like JavaScript and Python—accessors are methods with funny syntax. In typed languages with visibility controls—like C#, Swift, and Kotlin—accessors are enhancements to a defined property. As PHP is, let's face it, a typed language with visibility controls, that was clearly the model to follow (as had all previous RFCs). * Yes, we really would need asymmetric visibility, accessors, and interface properties. While technically separate features, they make the most sense in combination. * The whole scope would be huge, so we needed to break it up where we could. Splitting Asymmetric visibility off to its own RFC was the most natural place, which would be made easier by using Swift's `private(set)` style syntax. So in August of 2022 we put forward the first asymmetric visibility RFC. Given there was already a clear appetite for such functionality based on list discussions and on the recent `readonly` addition, which Nikita explicitly intended as a "junior asymmetric visibility," we expected some bikeshedding but overall a straightforward process. Boy were we wrong. ## Asymmetric support The Asymmetric Visibility RFC was far more contentious than we expected. Some people hated the idea. Some wouldn't accept anything but the C#-style syntax. We ran a poll of various different approaches, and our initial proposal (Swift-style placement and syntax) ended up winning by a slim margin, but disappointingly "the consensus position isn't your position, sorry" didn't really persuade anyone. Eventually, Asymmetric visibility finally went down in a 14:12 vote in January of 2023. RFCs need 2/3 majorities to pass, so 14:12, while a simple majority, isn't enough. ## Hooking it up The failure of asymmetric visibility was a blow to both of us. In most cases we didn't even know why the people who voted "no" did so, which made addressing their concerns guesswork. Had we just wasted our time? Would accessors even be acceptable? The current RFC process is very bad at providing that kind of actionable feedback. While no one from the Foundation mentioned it, we were also both acutely aware that Ilija had been working on paid time for a proposal that ended up failing. Nonetheless, we had split the RFC in two deliberately so that even if only one was successful there was still a benefit. We therefore turned our attention to the accessor part of the proposal (which included interface properties) and continued working. The model we developed was essentially a "direct port from Swift, with a few slight renames." The initial design included: * `get` - Totally takes over reading, and there's no physical property created. * `set` - Totally takes over writing, and there's no physical property created. * `beforeSet` - Intercepts the writing of a property but doesn't change the actual write itself. * `afterSet` - Called after the property is written, doesn't change the actual write itself. This is also when we changed the name from "accessors" to "hooks," which seemed a more accurate description given that model. This later ended up not making sense, but Ilija had already taken the time to rename everything in the patch, so it was too much work to change back. Sorry. The RFC text itself grew and grew. PHP is a very mature (read: complex) language, and so there were lots of nooks and crannies that we had to account for. Properties touch on almost everything: References, arrays, inheritance, final properties, interfaces, interaction with `readonly`, interaction with `__get`/`__set`, serialization, constructor property promotion, reflection... PHP is a big language, and we needed to think through and implement every possible edge case to avoid booby traps. ## Some very good Advice We finally had a working design and implementation by April 2023 or so, but were quite nervous about it. It was big, and we were both still smarting from the loss of asymmetric visibility. Roman suggested that he run it past the PHP Foundation's Advisory Board for feedback first before going to the list, which turned out to be the best thing we could do. The Board came back with mostly positive feedback; they liked the concept, the design, the detail... but having 4 separate hooks felt very clumsy to them. Especially with get/set wiping the backing property entirely and leaving the developer on their own. > **The PHP Foundation's Advisory Board** serves as a vital bridge between our major sponsors and the PHP development community. It's a Slack channel where we share early updates, insights, and ask for feedback. As well as receive insights and queries from sponsors' representatives. > > Companies interested in joining this influential group and directly contributing to the future of PHP can become members of the Advisory Board by contributing a minimum of $12,000 to The PHP Foundation as at least a Silver Sponsor. > > **Learn more about sponsorship opportunities.** > I don't have the original chat log, but that resulted in a brief exchange that went approximately like this: Roman: The Advisory Board says three different set-ish hooks are a problem Larry: Well, we kinda have to, because you can't access a property from within its own hook, that doesn't make sense. Ilija: Er, actually we could do that easily. Larry: Wait, what? That... how... why... Larry: *does some research* Larry: Well crap, that's exactly what Kotlin does. Why didn't we research Kotlin in the first place? Ilija: ¯\_(ツ)_/¯ Ilija: Well, I just switched it over to that. Looks nicer. And so there we were, with half as many syntaxes for the same functionality, and a feature name (hooks) that no longer made sense. Oh well. We finally made a public proposal at the start of May 2023. Initial feedback was quite positive, though there was some pushback, including around the syntax from people who wanted the Javascript/Python style (naturally). And the length. Oh, the length. If hooks isn't the longest RFC ever proposed, it's close. But as we reiterated many times, that's because the problem space itself is highly complex. Sadly, time was not on our side. Ilija was still working out some implementation edge cases and PHP 8.3’s feature-freeze was rapidly approaching. So in early July, almost exactly a year after we started working on it, we decided to postpone hooks until 8.4 to give such a large change enough time to settle in and get adjusted if needed. ## Take 2 After many distractions, we were able to bring the topic back up in February of 2024, with the intent to bring it to a vote quickly, in March. (We were so naive.) There was a lot more discussion this time around, though a lot of it was re-hashing edge cases we'd already addressed. We also spent a considerable amount of time talking with the Foundation's developer team. They, by and large, represent the most experienced developers of PHP Internals today, and were an invaluable resource. That we could talk to them in real time via the Foundation's private chat also helped, as that's a far easier way to handle back-and-forth than a mailing list. There were a few significant changes we did end up making in response to feedback, from both the list and the Foundation team. Most importantly, Ilija managed to make array properties work, which had been a challenge due to references. Once again, being able to attack the problem from two directions (design and ergonomics from me, implementation from Ilija) let us improve the overall experience dramatically. ## Down to the wire Even then, with all the positive feedback, it wasn't clear to us if it would pass. Many people on the list had expressed support, but a lot of them were non-voters. Others had expressed essentially "fearful support"; They liked the idea, couldn't find fault with the implementation, but were concerned about just how big and complex the feature was. Still others, for various reasons, suggested moving certain sub-features to a separate, future RFC. Which is often code for "I don't like this part, but I don't want to vote against the RFC because of it, so please let me vote against it separately." We explained, repeatedly, that this was already the slimmed down, partial version. The other part was asymmetric visibility. After a lot of discussion and with a lot of trepidation, we called the vote in mid-April of 2024. It passed 42:2. I don't understand PHP Internals at times. ## Asymmetric Visibility 2: The Wrath of Ilija Several people pointed out that hooks without asymmetric visibility had significant holes in it. They were right, which is why we'd originally proposed that first. We had decided that if hooks pass, we would take a second swing at asymmetric visibility. So we did. The only actionable feedback we'd gotten the first time around was that without support for combining `readonly` and asymmetric visibility, the RFC felt "incomplete." We went through a few variations on how to address that before landing on the final solution: Change `readonly` from being implicitly `private(set)` to implicitly `protected(set)`. Otherwise, the discussion was mostly a retread of the year before. We were still stressing out about this one, too. It hadn't passed before, why would it now? However, this time it passed 24:7 at the start of August 2024. Looking at the results, while there were two people who changed from a No to a Yes, the biggest change from the first vote was simply who voted. Most of the previous No votes... didn't vote this time. But entirely new people showed up to vote yes. Showing up to vote matters, folks. ## On to the next adventure 25 months after the process started, PHP now joins the cadre of languages with robust, flexible properties that can do more than just hold dumb values. It's been a wild ride, and at many points a needlessly stressful one. The end result, though, is a host of powerful new features that make PHP 8.4 the most exciting PHP release in several years. Really, they're the best thing since enums... I hope this tale is a useful insight for folks into how the sausage is made. Now go enjoy interface properties, hooks, and asymmetric visibility. Or enjoy not using hooks, but having the option to, which eliminates a lot of code. Both work.

We are thrilled to announce that after a year of hard work, dedication, and collaboration, **PHP 8.4** is officially here! Thanks to the tireless efforts of the PHP Foundation members, the core PHP development team, and an incredible community of contributors, this upcoming version brings major new features and syntax, performance and security enhancements, and a healthy amount of deprecations. ## A Year of Hard Work and Collaboration The PHP Foundation financially supports ten PHP core developers. The PHP Foundation members, along with a total of **115 contributors** , have made over **2,600 commits** since PHP 8.3 until PHP 8.4.0 release. PHP 8.4 includes changes from **36 RFCs**. There have also been numerous mailing list discussions and RFCs that were withdrawn, declined, or are still under discussion. Since PHP 8.0, PHP 8.4 received the highest number of RFCs, and PHP 8.4 brings the changes such as property hooks and asymmetric visibility that received significant community involvement and refinement. ## What PHP 8.4 Brings PHP 8.4 brings numerous new features and improvements to PHP. We covered some of them in our previous post as well, but they are mentioned here as well, for more complete picture. As we also covered in PHP Core Roundup #19, Property Hooks and Asymmetric Visibility are two of the highlighted features in PHP 8.4 * * * ### PHP 8.4 supports Property Hooks! In PHP 8.4, it is possible for a class to declare class properties with "hooks", that get executed when the property is accessed or set, and the hooks can access the object context. Property hooks open up a wide range of use cases that allow classes to declare virtual properties that enable expressive and intuitive APIs, make code readable and simple and avoid boilerplate code. class User { public string $emailAddress { set { if (!filter_var($value, FILTER_VALIDATE_EMAIL)) { throw new ValueError('emailAddress property must be a valid email address'); } $this->emailAddress = $value; } } } $user = new User(); $user->emailAddress = '[email protected]'; // Allowed $user->emailAddress = 'not an email address'; // Throws ValueError Larry Garfield wrote in PHP 8.4: How Property Hooks Happened about how he and Ilija Tovilo 💜 brought Property Hooks to PHP. ### Asymmetric Visibility PHP 8.4 introduces asymmetric visibility, allowing different access levels for getting and setting class properties. This feature is useful when you want to expose a property for reading but not writing. class User { public private(set) int $userId; public function __construct() { $this->userId = 42; } } $user = new User(); echo $user->userId; // 42 $user->userId = 16; // Error: Cannot modify private(set) property ### Lazy Objects PHP 8.4 brings support for Lazy Objects. Using the Reflection API, it is possible to create class instances in PHP 8.4 that they are initialized only if needed. The Lazy Objects documentation provides detailed examples and use cases. ### HTML5-compliant parser in DOM Extension PHP 8.4 upgrades the DOM extension with HTML5-compliant parsing. The new `Dom\HTMLDocument` and `Dom\XMLDocument` classes replace libxml2, which previously lacked HTML5 support. These updates improve DOM spec compliance and add features like CSS selector support. ### BCMath adds operator-overloaded `BcMath\Number` class The BCMath extension now includes the `BcMath\Number` class, enabling operator overloading for arithmetic operations. use BcMath\Number; $num1 = new Number('22'); $num2 = new Number('7'); $num3 = new Number('100'); $result = ($num1 / $num2) + $num1 - $num2; echo $result; // 18.1428571428 You can now use standard operators (`+`, `-`, `/`) with `BcMath\Number` objects, which also support all `bc*` functions. These objects are immutable and implement the `Stringable` interface, so they can be used in string contexts like `echo $num`. ### New Functions * `array_find`, `array_find_key`, `array_any`, and `array_all` * `bcdivmod`, `bcround`, `bcceil`, and `bcfloor` * `mb_trim`, `mb_ltrim`, and `mb_rtrim` * `mb_ucfirst` and `mb_lcfirst` * `grapheme_str_split` * `fpow` * `http_get_last_response_headers` and `http_clear_last_response_headers` ### PDO Driver-Specific Subclasses The PDO Driver-specific subclasses RFC is implemented in PHP 8.4. Previously, it was voted for PHP 8.3 but was not implemented in PHP 8.3 before its feature-freeze. PHP 8.4 now adds `Pdo\Mysql`, `Pdo\Pgsql`, `Pdo\Sqlite`, `Pdo\DbLib`, and `Pdo\Firebird` classes that extend the `PDO` class. Driver-specific methods, properties, and constants are now available in the driver-specific subclass. Driver-specific sub classes also allow APIs to be more expressive and restrictive by allowing the functions and methods only to accept/return driver-specific sub-classes. ### `AEGIS-128L` and `AEGIS256` support in Sodium extension **AEGIS** is an AES-based family of authenticated encryption algorithms that is faster than AES-GCM. The Sodium extension in PHP 8.4 supports `AEGIS-128L` and `AEGIS256` encryption algorithms if the Sodium extension is compiled with `libsodium` 1.0.19 or later. Apart from the new features, PHP 8.4 also updates several underlying dependencies and datasets, as well as unbundling three extensions: ### Updated dependencies * The Curl extension now requires libcurl 7.61.0 or later, and even capable of making HTTP/3 requests if it is compiled with a supporting TLS library. * The PCRE extension ships with PCRE 10.44, which provides support for Unicode 15 characters and character blocks, improved Regular Expression syntax, and performance improvements on certain systems. * OpenSSL extension now requires OpenSSL 1.1.1 or later, with improved support for OpenSSL 3.x series. It can now support Curve25519 and Curve448 based keys. Further, OpenSSL can be compiled to provide Argon2 password hashing on OpenSSL 3.2+ on PHP NTS builds. * To compile PHP as an Apache module (`mod_php`), PHP 8.4 drops support for the EOL Apache 2.0 and 2.2 series. The minimum required Apache version is now 2.4. * The zlib extension now requires zlib version 1.2.11 at minimum. ### Unbundled Extensions IMAP, Pspell, OCI8, and PDO_OCI8 extensions are unbundled from the PHP core, and are now available as PECL extensions, for which PIE might help to install easily. ### Updated PHP Icon on Windows PHP 8.4 also brings a minor, yet _very_ overdue change to the PHP icon on Windows executables: | ---|--- | Old Icon | New Icon ## Looking Ahead: PHP 8.4 and Beyond PHP 8.4 is the first major new PHP releases since the adoption of the new PHP maintenance policy. PHP 8.4, along with all current active PHP versions, will receive two years of active support and two years of security fixes. What this means is that PHP 8.4 will receive bug fixes until the end of 2026 and security fixes until the end of 2028. We just announced the pre-release of PIE - PHP Installer for Extensions. PIE will significantly improve the workflow of downloading and compiling PHP extensions. PHP 8.5 (in the `master` branch) is currently under active development, and we already have RFCs such as Support Closures in constant expressions in voting phase, and Add RFC3986 and WHATWG compliant URI parsing support under discussion. ## Get Ready to Upgrade PHP 8.4.1 is now a tagged release on PHP's GitHub repository. Compiled binaries and container images are available for: * Debian and Ubuntu-based Linux distros from Ondrej Sury's repositories. * Fedora/RHEL/Rocky/Alma Linux from Remi's repositories. * MacOS on MacPorts and Homebrew shivammathur/homebrew-php tap. * Windows on windows.php.net. * Docker and Podman Docker Hub * * * ## Support PHP Foundation At The PHP Foundation, we support, promote, and advance the PHP language. We financially support ten PHP core developers to contribute to the PHP project. You can help support PHP Foundation on OpenCollective or via GitHub Sponsors. A big thanks to all our sponsors — PHP Foundation is all of us! Follow us on Twitter/X @ThePHPF, Mastodon, LinkedIn, and Bluesky to get the latest updates from the Foundation. 💜️ 🐘 > PHP Roundup is prepared by Ayesh Karunaratne from **PHP.Watch** , a source for PHP News, Articles, Upcoming Changes, and more.