Software Development, Testing & Open Source

Reliably detecting flaky tests and tolerating them in a controlled way, code coverage through the lens of your classes, branch and path coverage made visible, and a filter by test size: I walk you through what is new in PHPUnit 13.3.

The JIT is not switched on in any default installation.

Germany is spending €108 million to move its federal websites onto a PHP application; in 2025, The PHP Foundation received $730,534 in funding.

AFUP asked me what happens to PHPUnit if I stop, why there has been a new major version every year since 2017, and where I learned to think about testing.

OPcache is called a cache, but it does more than keep bytecode around: fifteen passes sit between the compiler and the executor and rebuild it.

Which compiler built your PHP binary is a performance decision: until PHP 8.5, a PHP built with Clang was up to 44 % slower than one built with GCC, depending on the benchmark.

A guide for PHP project maintainers, from the PHP Foundation Ecosystem Security Team.

Nobody decides whether a language is modern.

How does PHP in 2026 compare with the current ideas about designing modern languages?

A car manufacturer lists an Android botnet in its open source attribution.

A security vulnerability in PHPCSUtils revealed an eval() call in a static analysis tool.

My favourite kind of bug fix only adds a new regression test and leaves every existing test untouched.

2025 and 2026 proved to be a stress test for the supply chains of all package ecosystems.

Five of the best television series I have ever seen are about the gap between what people want to achieve and what institutions allow them.

Selecting exactly the tests you want, finer control over the order they run in, faster and clearer output when they fail, and more expressive test doubles: I walk you through what is new in PHPUnit 13.2.

Merging code coverage data from parallel CI jobs has long been fragile and error-prone.

On every run, PHPUnit knows how long each test took, how much memory it used, and why it failed.

How fast is your test suite, and what vulnerabilities does an LLM agent therefore fail to detect?

Slow tests destroy flow, kill TDD, and erode trust until nobody runs the suite.

For every vulnerability we find in production, there is a test that, had it existed, would have prevented it.

Why do some bugs feel like a short detective story, while others feel like a never-ending thriller?

Not every problem requires new code.

We protect what exists.

A walk through the GitHub Actions weaknesses in PHPUnit's workflows, how each one could have been exploited, and what was changed to close them.

Three days in Vienna, three days of ComoCamp: my report on inspiring workshops, exciting open space sessions, and the uniquely open, collaborative atmosphere.

Closures as data providers, richer Open Test Reporting, custom issue trigger resolvers, and significant changes to code coverage: I walk you through the changes.

Technical debt is not malice, it is context.

"It feels slow" is not a diagnosis.

Composer 2.9 moved security advisory enforcement from an opt-in third-party package into the resolver itself.

In a world with endless possibilities for code to be wrong, one approach alone is not enough to make our software truly robust.

This practical deep dive into the philosophy behind "security through chaos" shows that security does not come from perfect foresight, but from surviving chaos.

Testing, code reviews and documentation are all essential prerequisites that constrain the autonomy of AI, thereby safeguarding human agency in software development.

Pair, pull, or post-push?

An AI coding agent implemented a complex software metric in 15 minutes.

The any() matcher is deprecated.

I explain how PHPUnit 13's parameter set matchers finally solve the problem that made upgrading to PHPUnit 10 such a challenge.

Replay Testing leverages the memory of your event sourcing system to test new versions with real history and shows which oracles truly inspire confidence in your changes.

Event Storming, DDD, CQRS, and Event Sourcing are intertwined: the tests not only check the events, but also become living documentation and a bridge between technical expertise and code.

A classic database only stores the "now" and forgets history.

One test, hundreds of inputs, and an automatic edge case search.

Shrinking is the unsung hero of property-based testing.

We only test what we think of.

With phpc.social and phpc.tv, the PHP community is building its own donation-funded online spaces in the Fediverse – free from algorithms and fascist tech bros.

Does PHP really need generics?

PHP tests Laravel, Symfony, PHPUnit, and more every night.

Self-sabotaging mock objects?

I take a break from my weekly articles and invite you to a free online event where I will present the latest improvements to PHPUnit.

Your PHP project has no tests and an upgrade is pending?

Your tests are successful.

Know the differences between data transfer objects and value objects and understand why immutability helps with testing.