🎙️ PHP Podcast – October 15, 2026

Hosts: Joe Ferguson & Holly Schilling

Longhorn PHP kicks off, agentic commerce gets scary, bots keep scanning, and a Cold War satellite schematic proves software is harder than hardware.

🧦 Swag, Longhorn PHP, and “Am I Even a PHP Developer?”
Joe opened by confessing he found a JavaScript bug in the swag store cart while ordering socks and a hoodie — the curse of being a developer who can only ever see the bugs. Holly joked that Sara got bumped from the show for refusing to wear swag, while Eric apparently bought one of everything in the store, including a Peanuts-style team picture card from PHP Tech.

The conversation turned to Longhorn PHP 2026, which kicked off with a tutorial day and runs through the main talk day on Friday. Holly is presenting remotely after travel plans fell through, giving a talk on her pet peeve: websites that get “packaged up” and shipped as apps instead of being built as real native applications.

That led into a heartfelt riff on imposter syndrome. Holly admitted she’s spent years insisting she’s “not really a PHP developer” despite submitting RFCs, speaking at conferences, and having an elephpant named after her. Joe shared his own years at a Python startup where he felt like a fraud for only writing PHP nights and weekends. The takeaway: showing up in community spaces — Discord, social media, GitHub, conferences — is all it takes to belong.

🛒 Agentic Commerce and Single-Use Card Security
Joe highlighted a Community Corner episode with Scott Keck-Warren and Paul Conroy on agentic commerce — the slightly terrifying idea of your Claude agent going out shopping on your behalf. Holly was especially wary of trusting Gemini for shopping advice given Google’s long history of steering how people search and buy.

Much of the underlying tech, they noted, lives in Stripe and resembles Apple Pay-style single-use card numbers: time-limited, amount-limited tokens that protect the real source card. Holly drew on her experience at a buy-now-pay-later company (now branded FlexPay) doing one-time code generation, where even 15-minute-lived card numbers required full PCI compliance, certificate pinning, HMAC, encryption at rest, and constant audits across every layer from mobile SDK to backend.

🤖 Bots, Scrapers, and Cloudflare to the Rescue
A Discord listener (ducknizzle) asked what everyone uses to kill bot and scanner traffic on public sites. Joe’s pessimistic answer: block ranges, sometimes entire countries, and ultimately just put it behind Cloudflare and let specialists deal with it — the same way you’d pay someone to host email rather than running it yourself.

Holly praised Cloudflare Pages for static content, calling it free and “it just works” with zero bandwidth worries, though WordPress makes things more complicated. Joe talked about his work-in-progress effort to standardize robots.txt across php.net properties, while acknowledging it only helps the well-behaved crawlers — malicious scrapers and AI training bots will simply ignore it. Holly estimated AI scrapers now outnumber legitimate bots roughly 10 to 1, and both lamented how the internet has lost some of its earlier friendliness.

🔐 How the PHP Security Team Handles Your Reports
Joe showcased a PHP Foundation blog post describing how the security team triages reports, sharing insight from his new role as a release manager. Release managers get advance heads-up on security releases, which follow extra processes to handle disclosures responsibly.

He explained that every report is read, triaged, and prioritized — someone in Discord recently got confirmation their advisory was “in the backlog.” The sobering reality is that the greater PHP security team is only one or two humans, reflecting the open-source nature of the project. The team can now issue its own CVEs rather than waiting on GitHub, so fixes and packager updates can ship as fast as possible. Joe noted serious, wild remote-code-execution-level vulnerabilities remain rare, especially this early in the 8.6 cycle, which just branched from master.

🎨 New PHP News Site, Design, and php.net’s Redesign
Joe demoed a new PHP ecosystem news site from Eric Barnes (Laravel News) and Matt Stauffer (Titan) in collaboration with the PHP Foundation — a modern aggregator reminiscent of the old Planet PHP days, complete with RFC coverage, a newsletter, topic sections, and a slick automatic dark mode toggle. Holly, admitting she has no eye for design herself, loved how well it was executed.

That sparked a running theme of developer respect for design as a discipline neither host feels competent in. Joe mentioned a php.net redesign in progress — mock-ups are available in the PHPC Discord’s PHP Foundation Ambassador Marketing subgroup, though it’s still a work in progress and not yet mobile friendly. Both admitted feeling like outsiders in design meetings the way non-developers feel in dev meetings. Joe shared Anthropic’s guidance to tell Claude what you *don’t* want for front-end work, to which he replied that as a developer, he often doesn’t even know what he doesn’t want.

🛰️ A Satellite Schematic vs. a Million Lines of Code
Holly launched into a favorite tangent, inspired by Apple releasing its home hub device years after the hardware was ready and pundits asking why the software took so long. Working on her own project with 16 encryption keys across five servers, she had to draw diagrams just to keep the key exchanges straight.

She then described a treasured artifact: a 3-by-9-foot schematic of an entire FSC-78 Bravo-mod satellite terminal from her Army SATCOM days at Fort Detrich — the whole Cold War-grade, anti-jamming system fitting on roughly 65 letter-sized pages. Contrast that with Margaret Hamilton’s famous photo beside the Apollo code printouts: around a million lines, a scale that’s routine in modern projects. Her point: software complexity dwarfs even elaborate hardware, and developers rarely give themselves credit for it — leaky abstractions, uncaught exceptions, and endless edge cases don’t plague hardware the way they plague code.

The discussion wrapped with fault tolerance stories: Joe discovered a three-node Elasticsearch staging cluster where failover had never been enabled (and only one node was taking all the traffic), and Holly recalled a satellite timing setup with redundant cesium sources where the only part that kept failing monthly was the single non-redundant box joining them together. Fault tolerance, they agreed, is important.

Links from the show:

• PHP Tech 2027 — Chicago, April 27–29, tickets & CFP open
• Join us in Discord
• PHP Arch Swag Store
• PHP Foundation — How the Security Team Handles Your Reports
• Community Corner Podcast: Agentic Commerce with Paul Conroy
• 2027 State of Open Source Survey (Perforce / OpenLogic / Zend)
• PHP Architect Consulting

Host:

Joe Ferguson

• Mastodon: @joepferguson@phpc.social
• PHPArch.me: @svpernova09

Sara Golemon

• Mastodon: @pollita@phpc.social

Holly Schilling

• Mastodon: @TheCodeLorax@tech.lgbt

Streams:

• • Youtube Channel
  • Twitch

📬 Connect & Hire

Looking to hire PHP developers? Email support@phparch.com – Joe and the team are available for consulting, infrastructure work, Ansible playbooks, and code review.

Partner

This podcast is made a little better thanks to our partners

OurCVEs

Your security posture, on autopilot with OurCVEs

CodeRabbit

Cut code review time & bugs in half instantly with CodeRabbit.

PHP Architect Consulting

Your PHP codebase deserves a partner, not a contractor. PHP Architect provides long-term technical partnerships for organizations that need senior-level PHP expertise that you can depend on. Learn more.

Music Provided by Epidemic Sound

https://www.epidemicsound.com/

🎯 Join Us Live Next Week

Youtube Channel

Got feedback? Join us on Discord at discord.phparch.com