<p><strong>TLDR:</strong> WordPress 7.0 is sitting in an extended RC cycle while the core team works out the architecture for real-time collaboration. PhpStorm 2026.1 landed with solid Laravel 13 and Livewire support plus a built-in MCP server. Symfony pushed maintenance releases across all three active branches. Laravel had a busy week with a new Cloud CLI, Activitylog v5, and a handful of 13.3.0 additions worth knowing about.</p>
<hr>
<h2>WordPress 7.0 release delayed</h2>
<p>The WordPress 7.0 release is paused while the team finalizes the architecture for real-time collaboration primitives. The sticking point is whether to use a custom database table for sync data — right now content changes land in postmeta and presence data goes into transients, which is a write-heavy setup that’ll stress hosts running HTTP polling. Pre-release builds are paused until April 17th, with a revised schedule due April 22nd. The feature ships opt-in, and plugins using metaboxes won’t get real-time collaboration until they migrate to Gutenberg APIs.</p>
<h2>PhpStorm 2026.1 released</h2>
<p>JetBrains shipped PhpStorm 2026.1 with Laravel 13, Livewire, and Filament support, a new Route Search UI, and better Eloquent method handling. The built-in MCP server now exposes IDE actions to agents like Claude Code and Windsurf, and there’s a Laravel Idea MCP integration available. PHP 8.5 pipe operator quick-fixes and improved generics inference are in too. On the practical side: Git worktree support, terminal completion for Git/Docker/kubectl, native Wayland on Linux, and automatic exclusion of framework-generated directories from indexing. Code With Me is being sunset after this release.</p>
<h2>Symfony 6.4.36, 7.4.8, and 8.0.8 released</h2>
<p>All three active Symfony branches got maintenance releases this week. The shared fixes across versions include a memory leak in TraceableEventDispatcher for long-running processes, a performance regression in OutputFormatter, duplicate pending messages in Redis transport with batch handlers, and a compatibility fix for Relay extension 0.21.0. If you’re running long-lived Symfony processes — workers, daemons, anything using Messenger — the TraceableEventDispatcher fix alone is worth the upgrade.</p>
<h2>Laravel Cloud CLI and 13.3.0</h2>
<p>Laravel released an open-source Cloud CLI built with Laravel Zero, covering deployments, environment and database management, domain controls, remote command execution, and JSON output for CI pipelines. Auth uses browser-based OAuth with token support for non-interactive environments. Separately, Laravel 13.3.0 adds a <code>#[UnitTest]</code> attribute that skips full framework booting for individual test methods, variadic argument support for Eloquent attributes like <code>#[Fillable]</code>, a new <code>BatchStarted</code> event for job batch lifecycle monitoring, and memory usage reporting in verbose queue worker output.</p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>Spatie Laravel Activitylog v5:</strong> Requires PHP 8.4 and Laravel 12 minimum. Replaces separate <code>LogsActivity</code> and <code>CausesActivity</code> traits with a unified <code>HasActivity</code> trait, adds activity buffering for bulk inserts, and moves model change tracking to a dedicated <code>attribute_changes</code> column instead of the <code>properties</code> JSON column.</li>
<li><strong>PHPUnit 12.3:</strong> Two new features from training course collaborations — test suite-specific bootstrap scripts and a <code>#[TestDoxFormatter]</code> attribute for fully customized TestDox output using data provider data.</li>
<li><strong>CVE-2025-1220:</strong> Null byte bypass in PHP’s <code>fsockopen()</code> allowlists enables SSRF across PHP 8.1–8.4. PHP sees the full hostname string including the null byte, but the C networking layer truncates at it and connects to the actual IP. Patches are available; mitigate by stripping null bytes from input and validating resolved IPs.</li>
<li><strong>PAO by Nuno Maduro:</strong> Detects AI agent environments (Claude Code, Cursor, Devin, Gemini CLI) and replaces verbose test output with compact JSON — reportedly ~20 tokens regardless of test suite size, down from thousands for large Pest suites.</li>
<li><strong>PHP Debugger extension:</strong> A fork of Xdebug that strips everything except step debugging. Benchmarks show dramatically lower idle overhead (+12.9% vs Xdebug’s +661.6% on a synthetic test). Drop-in replacement, works with PhpStorm and VS Code without reconfiguration.</li>
<li><strong>Symfony Docker updates:</strong> Sandboxed Claude Code integration running in autonomous mode with a firewall allowlist, native Dev Containers support, pre-configured Xdebug that works with FrankenPHP worker mode, and hot reloading for PHP, Twig, JS, and CSS.</li>
<li><strong>Symfony AI Store guide:</strong> Hands-on walkthrough of building a RAG system in Symfony 7.4 using <code>symfony/ai-store</code> with PostgreSQL/pgvector, covering ingestion, similarity search, and decoupling ingestion via Messenger.</li>
<li><strong>Symfony TUI component:</strong> Experimental component bringing retained-mode, DOM-like architecture to PHP CLI using PHP 8.4 Fibers and the Revolt event loop — reactive terminal UIs with a widget tree and CSS-like styling.</li>
<li><strong>Jane PHP v7.11.0:</strong> Now supports JSON Schema 2020-12 and OpenAPI 3.1, with more accurate PHP model generation and native nullable typing aligned with OpenAPI 3.1’s JSON Schema convergence.</li>
<li><strong>ACF PRO 6.8:</strong> Integrates with WordPress 6.9’s Abilities API for AI tool access to ACF data, adds automatic <a href="http://Schema.org" target="_blank" rel="noopener nofollow">Schema.org</a> structured data generation across 867 types, and ships new WP-CLI commands for ACF JSON management in CI/CD.</li>
<li><strong>Monsta FTP RCE (CVE-2025-34299):</strong> Pre-authenticated RCE in a PHP-based web FTP client with at least 5,000 internet-exposed instances. Patched in version 2.11.3. The exploit tricks the app into connecting to an attacker-controlled SFTP server and writing a malicious PHP file to an arbitrary path.</li>
<li><strong><code>Can I PHP?</code>:</strong> A caniuse.com-style reference covering PHP feature additions and deprecations from 5.6 through 8.5, including the upcoming pipe operator and URI extension.</li>
</ul>


Laravel, WordPress, and PHP ecosystem updates.

PHP Digest

A roundup of major PHP ecosystem news: WordPress 7.0 is delayed while the team finalizes real-time collaboration architecture (postmeta/transients write-heavy concerns). PhpStorm 2026.1 ships with Laravel 13, Livewire, Filament support, a built-in MCP server for AI agents, and PHP 8.5 features. Symfony released maintenance patches across 6.4, 7.4, and 8.0 branches fixing a TraceableEventDispatcher memory leak and Redis transport bugs. Laravel added a Cloud CLI (built on Laravel Zero), a #[UnitTest] attribute for lightweight tests, variadic Eloquent attributes, and BatchStarted events. Notable extras include Spatie Activitylog v5, PHPUnit 12.3, a null-byte SSRF CVE in fsockopen (CVE-2025-1220), a lightweight Xdebug fork with dramatically lower overhead, and a Symfony TUI component using PHP 8.4 Fibers.

WordPress 7.0 delayed for real-time collab, PhpStorm 2026.1 ships MCP and Laravel 13 support