This Week in PHP Internals | Nov 12, 2026

PECL, the old home of PHP extensions, now has a proposed shutdown date. In the first draft, that date was the end of 2029. Six days later, after one misread word, it's the end of 2027. And the person who was misread is okay with it.

Hello world, it's Thursday, November 12, 2026, and here's what happened This Week in PHP Internals. 18 stories this week, so let's get into it. But first,

This week's episode is sponsored by… us! Artisan Build has some availability coming up. It wouldn't be me personally, all of my client time is already fully allocated, but we have 6 senior dev days per week available, starting basically right now, ongoing. Our rate is twelve hundred US dollars a day, and for longer engagements, that rate is negotiable. If that sounds like a fit, head to artisan.build/start.

Sunset PECL (01:01)

This week's top story: PECL, the extension repository that PIE is replacing, now has a proposed shutdown date. James Titcumb, who wrote the 2025 RFC that adopted PIE, opened the follow-up it called for. A banner goes up on January 4th, 2027. On June 30th, the site goes read-only, so nobody can log in or upload a release. Then come four brownouts, from 3 hours up to 3 days, and on December 31st, 2027, PECL shuts down.

Jakub Zelenka asked him to note that PIE also ships as a standalone binary, for older PHP versions, and Tim Düsterhus says the plan makes sense now that Docker's PHP 8.6 images drop PECL.

But the first draft ran to the end of 2029, with two and a half years read-only. Rowan Tommins pointed to the risk of freezing a package that turns out to be vulnerable. He wrote: "In the current environment, two and a half years seems a long time to serve something nobody can patch."

Derick Rethans suggested shortening it by a year. James cut it to one year overall, with vulnerable releases removed by hand if needed. Derick replied: "Although I didn't say 'to a year' but 'by a year', I am still okay with your suggestion." So PECL's end date moved up two whole years. There's no vote date yet.

Links: Sunset PECL RFC · James Titcumb opens the discussion · Rowan Tommins on serving packages nobody can patch · Derick Rethans · Derick Rethans, "by a year" · The timeline shortened to one year · James Titcumb's follow-up · The 2025 RFC that adopted PIE

Scope Defaults (02:37)

Larry Garfield says one default in the Scope RFC could keep him from supporting it. Frode Børli's RFC gives each unit of work, like a request, its own scope, and a new scope starts with empty superglobals.

In version 0.9.5, Frode kept that. A server creates the scopes, he says, and if a new one copied its creator's arrays, one the server missed would leak into the next request.

Côme Chilliet asked how more state could ever follow the scope later without breaking code. Larry's point is that anyone can create a scope, anywhere. He wrote: "This is a landmine large enough that it would keep me from supporting this RFC, which I otherwise quite like."

About an hour later, Frode replied. He wrote: "Thanks for pressing on this; I'd rather fix it in the RFC than find it in the vote." He plans to add a scope that starts as a copy of its creator's request arrays, locale and timezone, and asked which should be the default.

He also asked the list to choose between two plans: opting in to each piece of state with a bitmask, or designing it all in one RFC, alongside Kévin Dunglas's request hooks. Larry wants a shallow clone by default, and the full picture designed up front. He counts 21 pieces of state, which would mean 21 flags to opt into.

Links: Scope RFC · Larry Garfield: "a landmine" · Frode Børli's two plans · Frode Børli, follow-up

Context Managers (04:09)

Context managers are back, and this time they're a generator. Larry Garfield and Arnaud Le Blanc's first RFC never went to a vote, and the wiki now lists it as obsolete. Larry wrote: "It basically swaps the two-method approach in favor of 'it's a generator, you're welcome.'"

A using block runs the generator up to its yield, and the yielded value becomes the block's variable. When the block ends, even on an exception, the generator picks up after the yield, so the cleanup lives in one place. A second yield throws an error.

Most of the replies were about the arrow. Stephen Reay, Lazare Inepologlou and David Maye would rather use as, which they say fits PHP's existing syntax better. Larry says version 1 used as, until people took it to mean the left side gets used as the variable. He doesn't mind as himself. And Côme Chilliet asked why the block ends with a semicolon. Larry says using is an expression, like match. Arnaud's implementation is still a partial draft.

Links: Context Managers v2 RFC · Larry Garfield's announcement · Draft implementation

Request Hooks (05:24)

Kévin Dunglas's request hooks are now an RFC, targeting PHP 8.7. Florian Engelhardt asked whether it's intended that, in FrankenPHP, a worker's lifecycle starts with a request end and finishes with a request begin.

Kévin says it's intended. The first end cleans up the dummy request that boots the worker, and the last begin lets code after the loop still write output. Florian asked for that sequence in the RFC. He wrote: "Otherwise, I like that we could have an explicit hook to detect requests handled inside a worker!"

Version 0.2 spells it out. After a question on LinkedIn, a failing hook now tells the server to end the script, and session_start refuses to run between two requests.

Links: Request lifecycle hooks RFC · Kévin Dunglas opens the discussion · The lifecycle, explained · Version 0.2

Io Terminal (06:14)

Io\Terminal was due to go to a vote today. Pratik Bhujel postponed it after two reviews. Tim Düsterhus sent eight points, and said his main concern was the lack of examples, especially for how raw mode leases work.

Frode Børli, who maintains the phasync/tui terminal library, switched it to the pull request, and its tests behave the same. He wrote: "That part of the RFC works, and it is exactly what userland cannot do without spawning stty, using FFI, or Windows-specific tricks." But he asked to cut the RFC down to raw mode and terminal size. Libraries already decode keys, he says, and readKey has no modifiers.

Pratik shipped two revisions, with examples, NoDiscard on enableRawMode, and TerminalSize renamed to Dimensions. But he's keeping the read methods, for the many small scripts that just want "press a key" or "enter password". A new vote needs a fresh notice first.

Links: Io\Terminal RFC · Vote postponed · Frode Børli ports phasync/tui · Pull request

CSV Types (07:25)

PHP's proposed CSV extension now spells out what it will write. Ignace Nyamagana Butera asked for a supported types section, and Damian Jóźwiak found the implementation didn't match the RFC. It just cast fields to plain strings, like fputcsv, so an array became the word Array.

Version 1.3 writes a backed enum's value, writes false as zero instead of an empty field, and throws a TypeError for arrays, resources and pure enums.

Then Ignace pushed back on converting any object that has a string method. He wrote: "This is somewhat of an anti-pattern because it relies on a generic string representation of an object rather than an explicit serialization contract." Damian agreed. Version 1.4 throws on implicit __toString conversions too, and leaves a dedicated conversion interface for later. Frode Børli also suggested a small format object and separate encoder and decoder classes, and hasn't had a reply yet.

Links: CSV Extension RFC · Supported types · Damian Jóźwiak on the types · No implicit __toString() · Version 1.4

OPcache Dedup (08:35)

Run 80 WordPress sites from one PHP-FPM master, and OPcache stores a separate copy of the same code for each of them. A new proposal would let them share it.

OPcache keys scripts by path, so every copy of an app is cached on its own, even when its functions compile to the same opcodes. With a new opt-in setting, opcache.enable_dedup, a function whose opcodes match a block already in shared memory just points to that block. File names, errors and Reflection don't change, and it switches itself off when the JIT is available.

On a load test of 80 WordPress sites, its author reports, OPcache memory fell by 46.5%, with CPU per request within noise. After 11 days in production on 52 pools, it's down 43%, with zero worker crashes. Its author asks whether this needs an RFC, or just a pull request.

Links: The proposal (opcache.enable_dedup) · Case study · Patch

Exec Check (09:37)

Linux can now refuse to run files that aren't approved to execute, but a PHP file still runs. Alexander Mikhalitsyn wants to close that gap.

Since Linux 6.14, an interpreter can ask the kernel whether a file could be executed, and two security bits tell it to enforce the answer. He wrote: "Today a system can forbid running an unknown binary, but php /tmp/payload.php or an include of an uploaded file still works: the interpreter is the loophole."

His patch checks each file before compiling it, but only enforces the answer when those bits are set, so nothing changes by default, and an OPcache hit costs nothing. He ran phpBB under it. Generated code, like a framework's compiled container, has to be built at deploy time and marked executable. He's asking whether this needs an RFC.

Links: Pre-RFC: honour Linux AT_EXECVE_CHECK · Linux kernel docs

Quick Hits (10:38)

Quick hits. PHP 8.6.0 is due next Thursday, November 19th, after one extra release candidate. Matteo Beccati, one of the release managers, says the fix in October's security releases broke the ABI in 8.6 only, so extensions must be rebuilt.

Links: PHP 8.6.0RC6 · PHP 8.6.0RC5

Weilin Du's vote to let ini_get_all accept extension names in any case is at 18 to 0, with 3 abstentions. It closes November 16th.

Links: Case-insensitive extension names in ini_get_all() RFC

On 32-bit x86, 10 ** -2 doesn't equal 0.01. A contributor has four pull requests open to fix results like that, and asked whether PHP can require SSE2. Hans Henrik Bergan replied "Hell yes", since CPUs without it are nearly 30 years old.

Links: Floating point on 32-bit x86 · php-src PR 25362

Artem Ukrainskiy's Str\Matcher and Str\Replacer are now an RFC. Larry Garfield isn't opposed, but says it "feels very niche".

Links: Str\Matcher and Str\Replacer RFC · Larry Garfield's reply

Mirco Babin sent eight comments on PASSWORD_BCRYPT_WRAP, including OWASP's preference for Argon2, and Andrey Andreev replied that Argon2 isn't supported out of the box.

Links: Mirco Babin's comments · Andrey Andreev's reply

Otar Chekurishvili's JSON comments RFC now answers Jakub Zelenka's parser concern, and a new vote notice comes after the cooldown.

Links: JSON comments v1.1 · JSON comments RFC

A reviewer of Time\Instant still wants a cheap way to read the Unix timestamp.

Links: Time\Instant review

Tim agreed to Máté Kocsis's narrower value types for query parameters, to unblock the RFC.

Links: Tim Düsterhus on query parameters

Côme Chilliet said "Yes please!" to SSRF protection in curl, and Xavier Leune got karma to write the RFC.

Links: Côme Chilliet on curl SSRF protection · Xavier Leune's karma request

And a developer asked whether PHP's JIT would take a LoongArch64 backend, before writing thousands of lines of assembler.

Links: LoongArch64 JIT backend

TL;DR (12:38)

So that's the week. PECL has a proposed shutdown date, December 31st, 2027, two years sooner than the first draft. Larry called empty new scopes a landmine, and Frode plans to add one that copies its creator. Context managers came back as a generator, request hooks became an RFC, and the Io\Terminal vote is on hold. PHP 8.6 ships next week. Links below.

The PHP Foundation funds more than half of ongoing php-src commits, so if you use the language, maybe consider donating at opencollective.com/phpfoundation — or try guilting your employer into it.

If you found this useful, a like or a comment helps more people find it. And if you missed last week's episode, where FrankenPHP's creator wants PHP's engine to know when a request ends, that's a good one to watch next. And if you'd like to work with us, start at artisan.build/start. We're Artisan Build. See you next week.