🎙️ PHP Podcast – November 5, 2026

Hosts: Eric Van Johnson & Joe Ferguson (John Congdon)

Two months, a dozen new stream buttons, and a 6 AM crypto-mining emergency. Eric falls in love with a developer-only social network, the PHP2Shell CVE tests the team, and PHP Tek season kicks off. Welcome to the Boss Level.

🔴 Back After Two Months — and Everything Is On Fire (Audio-Wise)
After nearly two months off the air, Eric and John opened the Boss Level episode the only way they know how: with a full-blown audio meltdown. Eric was on the wrong mic, and as usual, his connection kept cutting in and out while the crew wrestled with a fresh stack of stream widgets, pop-up reactions, and survey overlays nobody fully understood.

Once they got the sound working, they reintroduced the show. This is the monthly “Boss Level” episode where the two people behind PHP Architect pull back the curtain on the magazine, the conference, and the consulting business — with a little more candor than usual, since, as Eric put it, John can’t fire him and he can’t fire John.

💀 Leaked AWS Keys and a 6 AM Bitcoin-Mining Nightmare
John’s week started at 6:10 AM with pager alerts about a Lambda function failing to post to Slack. What looked like a trivial memory leak turned out to be something far worse: a leaked AWS key with permission to spin up instances. An attacker had launched 32x and 64x large machines in every single region to mine Bitcoin.

The team rallied — four or five people each terminating instances region by region — and disabled the compromised key before new instances could spawn. Using AI tools to dig through the logs, they discovered the key had first been quietly tested back in September, likely by whoever was selling it to prove it was valid before putting it on the market. Identifying and rectifying took about 20 minutes, but it was not a fun morning.

🐚 /Dev/Null: A Social Network Built for Developers in a Day
Eric gushed about /dev/null, a brand-new developer-centric social network built on Laravel in roughly a day or two by Nuno, Brent, Matthew, and Pauline Voss. Everything about it is geared to developers: the main feed is “the log,” posting is “making a commit,” your VIM bindings work inside it, and sign-up ties directly to your GitHub account to pull in your profile. He’s begging the creators to keep the walled garden intact and not make it easier for the “normies.”

He also highlighted a TUI built by Wendell (a Laravel employee and PHP Architect columnist) that mirrors the web app so closely it’s become Eric’s home for DevNull right inside his Tmux setup. That led into a tour of his terminal-centric workflow — one Tmux session per project (a trick from Jess Archer), panes for Claude, nvim, and dev servers, lazygit for commits — and why he quietly retired PHPStorm earlier this year in favor of nvim and the terminal. Pauline, a fantastic conference speaker known for Git talks, has even started livestreaming on Twitch following the build.

🎤 PHP Tech 2027: Call for Speakers Closed, Evaluation Begins
The call for speakers has closed, and talk evaluation is underway. John is changing the process this year so reviewers judge fewer talks at a time — one smaller track took him about three minutes. Anyone in the community, ideally planning to attend, can reach out to John on Discord to get added and help pick what gets presented. You rank three anonymized talks side by side, with the title doing most of the heavy lifting since that’s what attendees see on the website.

Eric reminded listeners that submitting multiple talks improves their odds of being selected when narrowing the final list. Speakers with more than one accepted talk get priority since they’re the biggest bang for the buck. This year’s third track rotates: a JavaScript day, a Laravel day, and a DevOps day. John noted it was exactly that deployment knowledge gap that first drew him to PHP Tech back in 2010, when he had no idea how to actually deploy an application. All the details live at phptek.io.

🛡️ The PHP-to-Shell CVE and Why a DevOps Person Matters
PHP had a rough couple of weeks due to a major “PHP2shell” CVE. Joe, a release manager for the upcoming PHP 8.6, had sensed something was brewing and started preparing rollout plans before the details dropped. When it hit, the team patched nearly everything across their clients within 24 hours, with only a couple of third-party-dependent servers trailing. Eric and John reflected that after 14 years of running their consulting arm (the DiegoDev Group, now PHP Architect Consulting), finally having a dedicated DevOps person has made the difference between night and day.

The fallout rippled outward: NativePHP published a candid write-up about having to issue its first-ever security advisory, since a PHP vulnerability affects anything that compiles PHP into a mobile app. The hosts wondered how projects like NativePHP can get into the “consortium” that receives early patch access alongside the big distros. They also pushed back on the “PHP is dead” crowd — this was a memory bug that has lived in the code for 20 years and affects roughly 70% of the web, but memory bugs happen in every language, from Node to npm. The silver lining: a visible spike in PHP Foundation financial contributions, with Eric clarifying that the Foundation funds internal developers but doesn’t dictate PHP’s direction.

🐘 Git Workflows, SVN War Stories, and the Specialization of Developers
The conversation wandered into deployment history — FTP and rsync in the SVN/CVS days — and Eric’s war stories from a Java/WebSphere enterprise shop where developers had no idea where their apps were even hosted. His takeaway: developers today are extremely specialized, and you shouldn’t be surprised when a brilliant Java dev can’t navigate a command line.

Eric defended his fork-based Git workflow: a single clean “upstream” repo that only deploys to servers, with everyone forking into their own private GitHub account and sending back only clean, deployment-ready code, essentially the open-source model. The chat gave him grief, including jabs about failing at Git worktrees, which Eric conceded he understands in principle but finds painful in a PHP workflow with its multiple Composer and npm installs and environment files.

Links from the show:

• PHP Tech 2027 — Call for speakers closed; register now
• PHP Architect Consulting
• store.phparch.com — PHP Architect merch & elephants
• PHP Foundation Office Hours (streamed on our channel)
• Dev-Null.sh
• PHP 8.6.0 RC5 available for testing
• Linux Kernel TCP Flaw
• PHP 8.6’s soft feature freeze
• PHP Foundation Community Hour Podcast
• NativePHP first security advisories

Host:

Eric Van Johnson

• /dev/null: @ericvanjohsnon
• X: @shocm
• Mastodon: @eric@phparch.social
• Bluesky: @ericvanjohnson.bsky.social
• PHPArch.me: @eric

John Congdon

• /dev/null: @johncongdon
• X: @johncongdon
• Mastodon: @john@phparch.social
• Bluesky: @johncongdon.bsky.social
• PHPArch.me: @john

Streams:

• • Youtube Channel
  • Twitch

📬 Connect & Hire

Looking to hire PHP developers? Email support@phparch.com – Joe and the team are available for consulting, infrastructure work, Ansible playbooks, and code review.

Partner

This podcast is made a little better thanks to our partners

OurCVEs

Your security posture, on autopilot with OurCVEs

CodeRabbit

Cut code review time & bugs in half instantly with CodeRabbit.

PHP Architect Consulting

Your PHP codebase deserves a partner, not a contractor
PHP Architect provides long-term technical partnerships for organizations that need senior-level PHP expertise that you can depend on.
https://www.phparch.com/consulting/

Music Provided by Epidemic Sound

https://www.epidemicsound.com/

🎯 Join Us Live Next Week

Youtube Channel

Got feedback? Join us on Discord at discord.phparch.com