The PHP Podcast 2026.05.14

🎙️ PHP Podcast – May 14, 2026

Hosts: Eric Van Johnson & John Congdon

Another fun episode of the PHP Podcast! Here’s what we covered:

🎙️ PHP Tek Is Four Days Away
The countdown clock is basically ticking in real time — PHP Tek 2026 in Chicago is just four days and ten hours out as this episode begins. Eric flies Friday, John flies Saturday, and the team descends on the venue Sunday to get the trailer unloaded, the booth assembled, and everything tested before the conference kicks off. The conference magazines — ordered three weeks ago and still showing “printing” on Tuesday — pulled through at the last minute and are set to arrive at the venue tomorrow. That’s cutting it close, but it counts.

🎫 Win a Free PHP Tek Ticket — Live on Air
John put a full conference ticket up for grabs: DM him on any social platform, and he’d draw a winner on the live stream. The caveat? You had to be watching live — audio listeners are out of luck on this one. The lucky winner drawn on air was Jeffrey Davidson, who will now be at PHP Tek. Eric offered to even bring him to the team’s Saturday minor league baseball game if he flies in early enough. Jeffrey gets a hand-printed sticker name badge, but he’ll have a badge.

👕 New PHP Architect Conference Merch
Fresh shirts are coming to the PHP Tek booth courtesy of Clayton Kendall, who is producing the apparel. The new design goes with a smaller logo placement — a more subtle, wearable-anywhere look compared to the big bold prints. If you’re headed to Chicago, swing by the PHP Architect table and see what’s there.

📱 Holly’s Conference App Gets a Vendor Mode
The PHP Tek attendee app built by Holly (developed by CodeLorax) has been upgraded ahead of the conference. What started as a schedule browser with conflict detection and push notifications has now merged with a vendor lead scanning tool. Attendees can log in by scanning the QR code on their badge, and vendors can scan attendee badges to capture leads — all in a privacy-preserving way that doesn’t expose raw contact data. Eric’s wife Bek figured out the app entirely on her own without being told anything, which remains one of the best usability endorsements you can give.

🤫 Something Big Is Happening in the PHP Community
Eric teased something he can’t officially talk about yet — a community acquisition that’s still working through the legal and DNS transfer process. A new droplet has been created. Joe has already figured out what it is. Eric is too excited not to bring it up but too responsible to spill the details before it’s official. The plan is to announce after PHP Tek. If you want to know early, apparently getting Joe drunk at the conference is your best strategy.

🤖 Grok AI Exploited via Morse Code in Bank Transactions
A video from the Dave’s Garage YouTube channel surfaced a genuinely unsettling AI exploit: someone used a Grok-powered AI banking agent and embedded hidden instructions inside transaction memo fields — written in Morse code. The agent decoded the dots and dashes, interpreted them as instructions, and followed them, ultimately losing somewhere between $154,000 and $200,000 in crypto transfers. This is prompt injection in its most creative and alarming form yet. The attack surface for AI agents hooked into real financial systems is not theoretical — it’s happening.

⚠️ TanStack Hit by NPM Supply Chain Attack
The TanStack ecosystem — the popular query, router, and table libraries — was hit by a supply chain attack via GitHub Actions cache poisoning. The attack vector was a forked pull request: a malicious fork can trigger GitHub Actions workflows and potentially inject poisoned artifacts into the build cache, which then get picked up by the legitimate package. Simon Hamp from NativePHP caught it and raised the alarm in the PHP Architect Discord. It’s a good reminder that the supply chain attack surface extends well beyond just what’s in your `composer.json` or `package.json` — your CI pipeline’s caching behavior matters too.

💼 PHP Tek Job Fair — Wednesday Afternoon
There will be a job fair at PHP Tek this year, scheduled for Wednesday afternoon. At least one confirmed hiring manager will be there. If you’re looking for PHP work, or if you’re a company looking for PHP talent, this is worth planning around. Eric and John both see it as a natural fit for the conference — the PHP community is tight-knit enough that a job fair actually means something.

🛁 Eric’s Birthday Spa Day in Palm Springs
Eric’s wife Bek surprised him with a birthday spa day in Palm Springs. It was his first massage ever, and he paired it with a mineral soak in the natural springs. He came away thoroughly convinced — the combination of the mineral water and a proper massage left him feeling better than he expected, and he’s already thinking about going back. Beck planned the whole thing, and Eric was appropriately grateful.

💆 John’s First Couples Massage
John has now also had his first couples massage, and it did not go quietly. He opted for deep tissue — which means the therapist was working hard — and his wife, in the room next door, was apparently convinced something was wrong based on the sounds coming through the wall. John described it as the kind of massage where you’re not entirely sure if you’re being helped or attacked, and the answer turns out to be both. He’d do it again.

⚾ PHP Architect Becomes Padres Season Ticket Holders
Eric and John are now official San Diego Padres season ticket holders — their first year in the program. As first-timers, they’re at the very bottom of the seniority ladder, which means they were among the last to pick seats. John blames Eric for not signing up years ago. There’s an upcoming Wednesday day game against the Dodgers with available tickets if anyone in San Diego wants them — reach out to John.

Links from the show:

Host:

Eric Van Johnson

John Congdon

Streams:

- Youtube Channel
- Twitch

📬 Connect & Hire

Looking to hire PHP developers? Email support@phparch.com – Joe and the team are available for consulting, infrastructure work, Ansible playbooks, and code review.

Partner

This podcast is made a little better thanks to our partners

Displace

Infrastructure Management, Simplified
Automate Kubernetes deployments across any cloud provider or bare metal with a single command. Deploy, manage, and scale your infrastructure with ease.
https://displace.tech/

PHPScore