🎙️ PHP Podcast – October 29, 2026

Hosts: Joe Ferguson, Sara Golemon & Holly Schilling

Patrick Stewart has passed. Tailscale handed out root. The PHP RCE patch landed. And MediaWiki contributer Brooke Vibber tells us how Wikipedia survives celebrity deaths, 500 languages, and Apple’s file system.

☕ Patrick Stewart, Cache Stampedes, and the Michael Jackson Outage
The crew opened on the sad news of Patrick Stewart’s passing. That segued directly into special guest Brooke Vibber recounting a very real MediaWiki war story from the early days.

Back in 2009, when Michael Jackson died, so many people tried to edit the Wikipedia article simultaneously that the entire system fell over. Each save triggered a full re-render, link table updates, and layers of other work — and with a thousand of those happening at once, it destroyed everything.

The emergency fix was a hack that served stale cached data to anyone viewing the Michael Jackson page, which instantly brought the site back online. The proper fix came later: a pressure valve for high-concurrency situations, a textbook cache-stampede problem they should have anticipated but didn’t catch until real planetary-scale load exposed it. Since fixing it correctly, they’ve never had a repeat — even for later celebrity deaths.

🔐 Tailscale SSH Root and the PHP RCE Patch
The team covered Tailscale’s security adventure where the built-in SSH functionality let someone already on a node in your tailnet get root on any server running it. Because it requires network access first, it wasn’t catastrophic, and Tailscale patched it quickly — though Holly cheerfully admitted to not updating her family game servers.

Talk turned to the big PHP RCE vulnerability. Joe, as a release manager, actually got early access to the patch and noted it was massive — lots of files touched. The Foundation blog explained the bug was found in the 2024 security audit, but the security team struggled not with *how* to fix it but how to fix it *best*, producing competing implementations with different tradeoffs while it remained only a theoretical exploit.

Sara underlined that memory-corruption RCEs like this — where a bailout leaves data somewhere it shouldn’t be, eventually turning into bytecode or binary — are extremely hard to pull off, depending on architecture and memory layout. Despite claims of in-the-wild exploitation, most were retracted, and performance impact of the fix turned out to be negligible. Wikimedia’s own response was to simply shut down all user-generated cloud services code until the patch was installed — sometimes the biggest circuit breaker is the best security.

🐘 HHVM, PHP 7, and the Phantom PHP 6
Brooke walked through Wikimedia’s journey with HHVM, which gave a solid 2x improvement over PHP 5 when Sara’s team at Facebook was pitching it. But once PHP 7 arrived — borrowing many of HHVM’s performance ideas — the gap closed, performance got more consistent and less spiky, and the extra complexity of running HHVM plus the pressure to adopt Hack stopped being worthwhile.

Sara took partial credit for grabbing the clever bits out of HHVM and getting them into PHP 7, all without a JIT (that didn’t arrive until PHP 8). Wikimedia stuck with mainline PHP for broader compatibility and because they’d written their entire codebase in PHP and had no desire to switch to Hack.

Naturally, the conversation detoured into the legend of PHP 6. Sara confirmed the last version of PHP 6 lives on in a Git tag — something like an experimental first Unicode attempt — and it will generally compile, just don’t expect performance, since it runs about a third the speed of PHP 7. Holly floated secretly shipping PHP 8.6 as the PHP 6 branch, and Sara noted that re-adding Register Globals would be trivially easy and really ought to be an April Fool’s joke someday.

🌍 500 Languages, Unicode, and the Localization Cache
Brooke revealed MediaWiki is quite possibly the most localized software in the world, supporting roughly 500 human languages — real languages with assigned ISO codes, not Klingon (though that might exist too). The system uses fallback chains, so a reader in a former Soviet country might fall back to Russian before English, and it can even dynamically convert between scripts like Serbian Cyrillic and Latin, or Chinese traditional and simplified.

The infrastructure runs across roughly 2,200–2,500 Kubernetes-hosted application servers in data centers in Virginia and Texas (with a smaller caching center in San Francisco). Every MediaWiki update is packaged into an image with the pre-compiled localization cache and atomically rolled out across all nodes.

Brooke worked on a patch to move the localization cache from a disk-backed database to an in-memory one built from PHP array literals, letting OPcache deduplicate all the strings automatically. In isolated testing it should yield several percent throughput improvement — which, at Wikipedia’s traffic volume, translates to tens or hundreds of thousands of dollars of equipment saved.

📜 The Esperanto Unicode Origin Story
In one of the nerdiest stories the show has ever aired, Brooke explained how they first got involved in Wikipedia development back in 2001 — through localization support, while learning Esperanto for fun. (Bonus trivia: there’s a 1966 horror film, *Incubus*, starring William Shatner entirely in Esperanto, with pronunciation so notorious that Esperanto conventions turn it into a drinking game.)

Because the early wikis ran 8-bit Latin-1, Esperanto’s accented characters didn’t work. So Brooke patched the open-source code to use UTF-8 for the Esperanto edition — doing Unicode before UTF-8 was the universal standard. As MediaWiki (built by Magnus Manske) took over, every new language wiki went straight to Unicode, and eventually English Wikipedia was converted too, using on-demand dynamic conversion of old Latin-1 revisions to minimize downtime.

That led into a gleeful MySQL gripe session: early MySQL 3 had no transactions and no Unicode, so Wikimedia stored UTF-8 in binary fields and managed their own collations. When MySQL 4 “added Unicode,” the fine print revealed it only supported the Basic Multilingual Plane — useless for the rare CJK characters an encyclopedia must store.

🍎 Normalization Forms and Cursing Apple
Brooke saved the best horror story for the end: Unicode normalization. An “é” can be stored as a single precomposed character or as “e” plus a combining accent — and macOS on HFS stored file names the second way while everyone else used the first. The result was Mac users uploading images whose filenames wouldn’t match when others tried to link them.

Since a compatible ICU library couldn’t be guaranteed, Brooke wrote a pure-PHP fallback that validated UTF-8 *and* normalized it to the precomposed form, so every way you type a name links the same way. Brooke cursed the Unicode Foundation many times — but cursed Apple a lot more, since everything else did the right thing by default.

The group agreed the Intl extension (which provides exactly this normalization) is one of the few things that really should be installed by default — Wikipedia requires it outright now. They closed with a quick nod to Holly’s pet project on scalar extension functions for strings and a final push for the PHP Tech CFP, open through October 31.

Links from the show:

• PHP Tech 2027 — Chicago, April 27–29; CFP & early bird tickets at phptek.io (CFP closes Oct 31)
• Brooke Vibber — brooke.vibber.net
• MediaWiki — the engine that runs Wikipedia
• Join us live in Discord

Hosts:

Joe Ferguson

• Mastodon: @joepferguson@phpc.social
• PHPArch.me: @svpernova09

Sara Golemon

• Mastodon: @pollita@phpc.social

Holly Schilling

• Mastodon: @TheCodeLorax@tech.lgbt

Brooke Vibber

• Mastodon: @bvibber@wikis.world
• Web: brooke.vibber.net

Streams:

• • Youtube Channel
  • Twitch
  • Esperanto
  • Unicode

📬 Connect & Hire

Looking to hire PHP developers? Email support@phparch.com – Joe and the team are available for consulting, infrastructure work, Ansible playbooks, and code review.

Partner

This podcast is made a little better thanks to our partners

OurCVEs

Your security posture, on autopilot with OurCVEs

CodeRabbit

Cut code review time & bugs in half instantly with CodeRabbit.

PHP Architect Consulting

Your PHP codebase deserves a partner, not a contractor. PHP Architect provides long-term technical partnerships for organizations that need senior-level PHP expertise that you can depend on. Learn more.

Music Provided by Epidemic Sound

https://www.epidemicsound.com/

🎯 Join Us Live Next Week

Youtube Channel

Got feedback? Join us on Discord at discord.phparch.com