The PHP Podcast 2026.06.17

PHP Podcast – June 17, 2026 Hosts: Sara Golemon & Holly Schilling | Guests: Paul Reinheimer & Sean Coates Eric and John are still locked in the basement. Sara is literally on a boat in Spain. Normal show, totally normal. Sara Broadcasts from a Harbor in A Coruña Sara is joining this week’s show from a marina in A Coruña, northwest Spain — in the Galicia region, where they speak Galician (not quite Spanish, not quite Portuguese). It’s 1am local time and the boat is visibly rocking on camera. Holly is holding down the fort from Chicago. This is what Sara calls pirate radio, except one of the pirates is actually on a boat. Meet the Guests: Paul Reinheimer & Sean Coates Paul Reinheimer and Sean Coates are PHP veterans from an earlier era — both were closely involved with PHP Architect around 2005–2010, back when Sara was already a PHP core contributor and the community was small enough to fit in one bar. Paul now runs Wonder Proxy, a service that lets you test your website’s behavior from locations around the world (checking GDPR banners, geo-targeted content, checkout flows, etc.), and is also building a startup called StudioWorks — business management software for creative studios, with an invoicing product and a proposals product in development. Sean is based in Montreal and has been spending time at a local hackerspace called Food Lab, where he got pulled into MeshTastic and MeshCore mesh networking, and is now surrounded by vintage computers, including a PDP-11 and five-and-a-quarter-inch floppy disks. The Quarter-Million-Line Commit Paul committed 250,000 lines of code directly to Wonder Proxy’s repo without a PR last week — and he’s not particularly sorry about it. The context: it was a pre-generated SQLite amalgamation file (all of SQLite compiled into a single C file), which Wonder Proxy is now checking in as a pinned static dependency rather than regenerating each build. Paul’s argument is unanswerable: you cannot meaningfully review 250,000 lines of generated C code in a PR. If there’s something malicious in there and you’re good with C, you could hide it in parameterized defines and no one would see it. The right approach, which Paul landed on, was creating a separate package with its own CI — and including the command to regenerate the amalgamation so reviewers can verify the output themselves, not just stare at the diff. Measuring Wrong — Sean’s Rant Sean has been ranting about this for 10–15 years and it hasn’t gotten less true: companies systematically measure things that make them look good and avoid measuring things that make them look bad. A marketing team adds a spin-to-win wheel to the homepage and celebrates their 1% sales increase. Nobody measures how many people found the wheel so obnoxious they immediately left. Cookie and GDPR banners are the same story — they go up, they’re never removed, and the conversion impact is never tracked because nobody wants to report bad news up the chain. Sean’s broader point: an epidemic of motivated measurement is a big part of why the web is as bad as it is. PHP in 2026 vs. PHP Then — What’s Still Working Paul’s honest take: the LAMP stack still works great. In 2004 you could build a productive web application with Linux, Apache, MySQL, and PHP — and you still can today. The fundamental approach is the same. Having since done Ruby at Stripe and other languages elsewhere, Paul keeps coming back to how much sense the PHP model makes to him. The longevity is the feature, not a bug. Wonder Proxy’s web app — built in server-side Swift using the Hummingbird framework — returns pages in under 50 milliseconds almost always and under 30 most of the time, with almost no client-side JavaScript. Server round trips are fast. The web doesn’t have to be seven seconds. Swift Concurrency and What PHP Could Learn Sara asked Sean — who has used Swift on the server for StudioWorks — what he’d want to see in PHP’s threading model. His answer: anything the compiler can enforce beats anything you have to remember yourself. Swift’s concurrency model has the compiler reject code that would allow a thread to trample on a sendable object after it’s been sent off. You find out about threading mistakes at compile time, not when corrupt data shows up in production. Sean’s verdict: an early warning system for threading problems is 10,000 times more valuable than discovering them too late. PHP’s async/await path is cooperative task switching (not true threading), which avoids some of these issues but can still deadlock if someone forgets to hand off control. Composer, require_once, and Supply Chain Security The chat raised whether anyone still uses require_once in the PSR-4 world. Sara’s answer: PHP.net does — it doesn’t use Composer at all, because the site needs to be framework and library agnostic. Grep for require_once across typical vendor dependencies and you’ll find around 100 instances still in the wild, mostly inside packages like Doctrine. The supply chain security conversation from there: Composer’s lock file pins to specific hashes, which is what you want — but a lot of projects don’t commit their lock file, and pinning to a version tag isn’t enough because tags can be updated if someone takes over a GitHub account. To really be safe, pin to a specific commit hash. It’s a pain to maintain, but it’s much harder to fake. The PHP Foundation — The Biggest Change in PHP Paul called out the PHP Foundation as the single biggest change in PHP since he and Sean were actively involved. Having an organization that can receive money from individual supporters and use it to fund core PHP work has been talked about since before PHP had package management. The foundation now has over 1,000 individual supporters — including Rasmus Lerdorf himself, which Sara found funny. Paul and Wonder Proxy support it financially; Wonder Proxy also holds a private Packagist account as an indirect way to fund Composer development. Sara works directly with the foundation on PHP core. Elizabeth Barron (from last week’s show) is doing exceptional work moving it forward. PHP.net Redesign and the Dark Mode Problem Sara copped to a php.net rabbit hole: she tried to implement dark mode for the site and succeeded everywhere except code samples. PHP’s built-in highlight_string() function has hard-coded colors that assume a light background, and there’s no way to override them. Sara wrote the patch to make the colors configurable at the internals level, then realized it should actually be a separate PHP project, then lost track of caring about it because it became yak shaving. On the redesign side: the foundation ran a competition to redesign the releases page (the per-version page with changelogs and download links), and the results look much better. The downloads page has been getting more beginner-friendly content — how to actually get PHP running, not just a reference manual. There are homepage mockups being iterated on as well. What Talk Would You Give? Sara asked both guests what conference talk they’d give if they were speaking today. Paul: marketing for developers. Too many developers believe “if you build it, they will come,” and AI is making this worse — the barrier to shipping something that looks professional has dropped so far that the noise floor is rising fast. Hollywood knows to spend as much on marketing as on production. Paul doesn’t claim to be good at marketing, but he thinks someone should be giving this talk at every developer conference. Sean: reliable deployment and supply chain integrity — specifically how to actually control the path from git to production without sneaking in vulnerabilities. Containers have helped, but there’s still a lot of infrastructure that fetches things at build or request time that is genuinely dangerous. PHP Tek 2027 The PHP Tek 2027 website is live at phptek.io. No date confirmed on air, but the site is up and people should keep an eye on it. Links from the show: Wonder Proxy — Test your website from around the world PHP Tek 2027 — phptek.io The PHP Foundation — Support PHP development PHP Architect Discord Guest Hosts: Sara Golemon Currently sailing in the Atlantic (broadcasting from A Coruña, Spain) PHP core contributor; code contributor via the Curl project (which means she technically has code on Mars) Holly Schilling Primary mobile developer; built the PHP Tek 2026 conference app Based near Chicago, IL Guests: Paul Reinheimer Founder, Wonder Proxy — test your website’s geo-targeted behavior from 300+ global locations Founder, StudioWorks — business management tools for creative studios (invoicing & proposals) Former PHP Architect team member; wrote a book on PHP and APIs Sean Coates Based in Montreal; regular at the Food Lab hackerspace MeshTastic/MeshCore mesh networking enthusiast; vintage computer collector (PDP-11 era) Former PHP Architect team member and longtime PHP community contributor Streams: Youtube Channel Twitch Connect & Hire PHP Architect Website Twitter/X Mastodon Hire PHP Developers Looking to hire PHP developers? Email [email protected] – Joe and the team are available for consulting, infrastructure work, Ansible playbooks, and code review. Partner This podcast is made a little better thanks to our partners Displace   Infrastructure Management, Simplified Automate Kubernetes deployments across any cloud provider or bare metal with a single command. Deploy, manage, and scale your infrastructure with ease. https://displace.tech/     PHPScore Put Your Technical Debt on Autopay with PHPScore     CodeRabbit   Cut code review time & bugs in half instantly with CodeRabbit.   Music Provided by Epidemic Sound https://www.epidemicsound.com/ Join Us Live Next Week Youtube Channel Got feedback? Join us on Discord at discord.phparch.com The post The PHP Podcast 2026.06.17 appeared first on PHP Architect.