For the past few months I've been working on JumPHP, an open-source framework for writing 90s-style 2D games in plain PHP.

https://github.com/davidnurdin/jumPhp

The idea is simple: you write your game once, in PHP, and the same code runs in three places.

- On the desktop: a native window with sound, using PHP 8.3 and the SDL2 extensions.

- In the browser: PHP 8.3 and SDL2 are compiled to WebAssembly, so the game is a plain static web page. PHP runs on the player's machine; you don't need a PHP server, any static host works.

- On phones: the browser build ships with touch controls (floating joystick, buttons, fullscreen and landscape lock).

What it's for

- Platformers, shoot 'em ups, brick breakers, adventure games, puzzle games.

- Porting old games whose source code is available. Many C games from the 80s and 90s translate to PHP surprisingly well.

- Learning game programming with a language you already know, without switching to JavaScript, C# or Lua.

- Small multiplayer games you can share with a link.

What's in the box

- Scenes, sprites and animations, a camera, menus and HUD helpers, bitmap and TTF fonts.

- Saves (stored in IndexedDB in the browser), options and translations.

- Online multiplayer through a small relay server: rooms, 4-letter codes, quick match. The same code works on desktop and in the browser.

- A single CLI, bin/jumphp, that runs everything in Docker: PHP, Composer, Emscripten, tests, headless screenshots, browser builds, deployment. You only need Docker on your machine.

- An AGENTS.md that documents the whole contract, so you can also build a game with an LLM coding agent. Most of the games below were made that way, with me reviewing, testing and fixing.

The constraints are few: never block the frame (no sleep()), remember that integers are 32-bit in the browser, and use the engine's network layer instead of raw sockets.

What I've built with it so far

- Pong (bundled with the engine): against the computer, two players on one keyboard, or online. It's the reference game for the networking layer.

- Breakout (bundled with the engine): three lives, a new wall every level.

- Invaders: waves of aliens, shields, a bonus saucer. https://github.com/davidnurdin/php-invaders

- Moktar, a 1991 French DOS platformer, ported from OpenTitus (the open-source C engine for the game). Everything is PHP, down to the original file formats and an AdLib/OPL2 FM synth emulator that renders the original soundtrack. Play: https://moktar.mimichat.fr, code: https://github.com/davidnurdin/moktarPhp

- Sapiens, a 1986 prehistoric adventure game by Didier and Olivier Guillion. Its C sources were released under GPL v3 in 2018, and the port follows them function by function: a first-person 3D landscape, side-view fights, dialogues with the tribes, flint knapping. I also decoded the music files of the 1996 version (an undocumented Harmony Assistant format) to play the soundtrack with its original sampled instruments. Play: https://sapiens.mimichat.fr, code: https://github.com/davidnurdin/sapiensPhp

- Sonic PHP, a fan remake of the Master System game built on the same PHP + SDL2 + WebAssembly stack. It runs at 60 fps and has online multiplayer for up to 6 players (race, flag, rings, deathmatch). Play: https://sonic.mimichat.fr, code: https://github.com/davidnurdin/sonicGamePhp

Getting started

git clone https://github.com/davidnurdin/jumPhp

cd jumPhp

bin/jumphp new mygame "MY GAME"

bin/jumphp install mygame

bin/jumphp run mygame # desktop window

bin/jumphp build mygame # browser build

The new game starts from a small platformer skeleton you can replace bit by bit.

Feedback is welcome, especially from people who try to build something with it. And if you could bring back one old game in PHP, which one would it be?

Hey folks,

I am new here but old PHP user and I think its time to give some more love to the PHP community.

I recently created a video and also wrote a blogpost about using Grafana with PHP for bringing observability to your applications.

It is purely focused on using open source tools integrations. (No AI or agents involved).

Here is the link to the video:
https://www.youtube.com/watch?v=SEN5wfb2gDY

The video description also contains the link to the GitHub repo. and also to the blogpost (English and German versions).

I hope it will be helpful!! 🙂

pdo_duckdb is my PDO driver for DuckDB, the in-process analytical database. 0.9.0 bundles DuckDB 2.0.0 GA in every prebuilt binary. The last version I posted here was 0.5.0, so this covers 0.6.0 through 0.9.0, starting with what changes for your code when you move to 2.0.

What breaks on 2.0

• New files are unreadable by 1.5. 2.0 writes storage version 69, and 1.5 reads only 64 to 68 (IO Error: Trying to read a database file with version number 69). Existing 1.5 files keep their format. If a 1.5 process shares a new file, open it with new PDO('duckdb:/data/shared.duckdb;storage_compatibility_version=v1.5.6').
• Any failed statement aborts the transaction. Inside beginTransaction(), a parser or catalog error now aborts it too, and every later statement fails. On either version, commit() on an aborted transaction returns true and keeps nothing, so call rollBack() after a failure or set default_transaction_invalidation_policy=SYNTACTIC_ERRORS_DO_NOT_INVALIDATE.
• Integer division by zero throws. 1 // 0 raises instead of returning NULL. Wrap it in TRY(...) or set error_on_division_by_zero=false.
• x -> x + 1 lambdas are rejected. Write lambda x: x + 1, which also works on 1.5.
• The PEG parser is the default, and it numbers parameters differently: $1_0 is parameter 10 under PEG and parameter 1 under the legacy parser. ? and :name are portable.

Source builds still work against DuckDB 1.5.3 and newer. configure detects 2.0 from duckdb_v2.h, since the 2.0 headers still report C API 1.5.6.

New in 0.9.0

• PDO::DUCKDB_ATTR_NATIVE_STRUCTURES, an opt-in that fetches LIST, ARRAY, STRUCT, MAP, UNION, JSON and VARIANT as lossless PHP values instead of canonical strings.
• VARIANT fetching, top-level and nested, and Appender input for it from arrays and objects.
• Two PDO connections to the same file could lose writes and see stale reads. Equivalent paths now share one DuckDB instance, and transactions stay per connection.
• Prebuilts for PHP 8.2 to 8.6 (8.6 as development builds) on Linux glibc and musl, macOS arm64, and Windows x64. They need PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12+, the October security releases; older patches build from source.

Security fixes since 0.5.0

0.8.0 carries the fixes from a security scan of the driver this month. An unclosed Appender in a reference cycle could read its PDO connection after gc_collect_cycles() or shutdown freed it. Hitting memory_limit during column setup could leave uninitialized type handles that were destroyed later. Earlier, 0.6.0 and 0.7.0 rejected DECIMAL types outside DuckDB's width and scale limits, a falsy force_mbedtls_unsafe that crashed the process, LOB binds over 64 MB, and Appender rows nested deeper than 128 levels.

pie install iliaal/pdo_duckdb

https://github.com/iliaal/pdo_duckdb

If you run DuckDB from PHP, I'd like to hear which 2.0 change hits your code first.

I've been working on Encryption-tool, an open-source PHP project focused on encrypted file packaging, authenticated encryption, and reliable decryption.

I'm currently working on hardening the implementation and stabilizing the file format before releasing a dependable version. Areas of focus include input validation, package integrity, safe file restoration, error handling, and testing encryption/decryption behavior with corrupted or malformed data.

The project uses Argon2id for password-based key derivation and XChaCha20-Poly1305 for authenticated encryption.

I'd be interested in constructive feedback on the implementation, testing strategy, and design of encrypted file formats.

GitHub: https://github.com/ElmanCod110/Encryption-tool

Hi,

I've made a demo of sonic the hedgedog in full php ( https://davidnurdin.github.io/php-wasm-sdl/ ) , it execute a php interpreter in the navigator to play with the open source game (https://github.com/davidnurdin/sonicGamePhp) , what do you think about that ? thanks

David

TL;DR for the first 26 hours the page was a static html page being served by php. After the challenger author was informed that if there is no php code php doesn't execute, the author added a phpversion() script.

After this became exploitable it took 2 hours for someone to hack the server and steal the bitcoin.

Excerpt translated from German:

In connection with the global security vulnerability in the PHP programming language, TCS Camping is warning around 15,000 customers: the provider of "Camping.Care", the booking system used by TCS, has been hit by a data theft. As the TCS confirmed […], fraudsters were able to steal customer and booking information.

1) I want use ports but not working: mydomain.com:101/index.html

2) This does work: mydomain.com/php56/index.html

So dev and production environments match want to avoid that subfolder.

--------httpd.conf for #2:------------------------

<VirtualHost *:80>
    <Directory /var/www/html>
        Options Indexes FollowSymLinks
        AllowOverride None
        Require all granted
    </Directory>

    <Location /php82>
        ProxyPass "unix:/run/php/php8.2-fpm.sock|fcgi://localhost/var/www/html/php82"
    </Location>

    <Location /php56>
        ProxyPass "unix:/run/php/php5.6-fpm.sock|fcgi://localhost/var/www/html/php56"
    </Location>
</VirtualHost>

--------httpd.conf for #1:------------------------

<VirtualHost *:80>
    <Directory /var/www/html>
        Options Indexes FollowSymLinks
        AllowOverride None
        Require all granted
    </Directory>

    <Location /php82>
        ProxyPass "unix:/run/php/php8.2-fpm.sock|fcgi://localhost/var/www/html/php82"
    </Location>
</VirtualHost>

<VirtualHost *:101>
    <Directory /var/www/html/php56>
        Options Indexes FollowSymLinks
        AllowOverride None
        Require all granted
    </Directory>

    ProxyPass "unix:/run/php/php5.6-fpm.sock|fcgi://localhost/var/www/html/php56"
</VirtualHost>

EDIT: Added Listen 101 and didn't fix anything. See comment with text "AH00526" for details on error from running "apachectl configtest"

https://stealmybitcoin.com/

Okay,

I love PHP, I'm using it 3 years ago.

and I believe it's a very good language, and the web won't be exist without it.

But, why I feel there is a very little opportunities php jobs in the market?

- Does the problem in the language itself?

- Is the cause of other tech stack available in the market now (e.g. nodejs).

- Does the AI is the real cause? (the yucky trend 🤢nowadays)

- The mindset 🤯🧠 of CEOs is the cause?

--------------

if all of this talk is not true, so how to find a PHP jobs?

especially (Remote)!

On 21 October 2026, the PHP project shipped emergency fixes for two flaws, tracked as CVE-2026-109618 and CVE-2026-109619, and nicknamed PHP2Shell. Together, the two CVEs give remote code execution on a web server with no login at all. Within hours, honeypots recorded successful exploitation, and Cloudflare logged millions of attempts.

I made an interactive, hands-on lab exercise on this security vulnerability. The goal is to give software engineers (especially those unfamiliar with PHP) a general overview of the attack vector and the mitigation steps. You’ll send HTTP requests as an attacker to exploit the vulnerability, then switch roles to the defender’s side and try to patch the vulnerability.

I did my best to highlight all the details, but if you notice any issues or inconsistencies, please let me know!

https://ransomleak.com/exercises/php2shell-rce/

With the recent PHP vulnerability, I've been wondering if there's anything I should do as a regular user. Specifically, should I be changing my passwords or taking any other precautions?

Also, is signing up for Have I Been Pwned enough to stay informed about data breaches and leaked passwords?

I've heard that some people also use Google's built-in Password Manager, which can notify you if any of your saved passwords have been compromised. However, I'm not really comfortable with the idea of storing all my passwords with Google.

What do you guys recommend? Is HIBP enough, or are there any other steps worth taking?

Or am I overthinking this, and should I just leave things as they are for now and wait for notifications from HIBP or emails from any affected services?

Thanks!

Static analysis, formatters, typed properties, enums, readonly classes, attributes, Pest or PHPUnit, mutation testing, there’s a lot to choose from.

• Which single tool or feature changed your day-to-day work the most?
• What did you adopt that turned out not to be worth the effort?
• How did you introduce it into an existing codebase without a huge rewrite?
• What would you add first to a legacy project today?

Examples with before and after (bugs caught, review time saved) help most.

Hey folks. I have been building Carve, a modern lightweight markup language for content that outgrows Markdown (and Djot). For humans and agents working on the same docs.

After many months of specs and coding, it should finally be stable enough now.
PHP 8.2+, zero runtime dependencies, PHPStan level 9.

composer require markup-carve/carve-php

What it looks like

/italic/  *bold*  _underline_  =highlight=

{#fig-sun}
![A sunset](sun.jpg)
^ Figure #: A sunset

See </#fig-sun> for the colors.

Unlike Markdown, *text* is bold and /text/ is italic. The figure gets its number, and the reference becomes a link reading "Figure 1".

Tables with merged cells and captions, footnotes, admonitions and definition lists are part of the core language. Diagram fences are an optional extension; without a renderer, they remain code blocks.
For example, ^ makes “Team” span two rows, while > right-aligns Seats and Price:

|= Plan |=> Seats |=> Price |
| Team | 25 | $49 |
| ^ | 50 | $89 |

Personally, I like and use this a lot, as I (or agents) don't need to fall back to HTML anywhere anymore.

Task lists - and they can track more than open and done:

- [x] Draft the API guide (done)
- [ ] Drop the old endpoint example (open)
- [!] Migration notes need an API decision (blocked)
- [/] Finish the screenshots (in progress)

to name a few.

I wrote a post about some of the killer features and things other markup can't do (written with the PHP library - source markup of that blog post linked at the bottom).
But for more context also check out the other articles.

Why it might be interesting for your PHP app

• Intuitive for non-techies. Feature-rich for power-users (like technical bloggers).
• Safe for web-based user content. Pasted HTML renders as text, and safe mode also escapes or strips raw HTML blocks and removes event handlers and javascript: links. Profiles control which features each role may use. That said: Use sanitizers on top just in case.
• One source, several outputs. The same document renders to HTML (with a static mode for print/PDF), Markdown, plain text or terminal output from one AST, and the same markup writes reveal.js slide decks.
• Works with rich-text editors. Documents convert to and from Tiptap/ProseMirror on the server, no Node needed.
• Migration path. Import existing Markdown, HTML, Djot or BBCode. The migration CLI can report conversion losses for review.
• Tooling. Formatter, linter, and editor support for PhpStorm, VS Code and others, plus a language and MCP server.

Some small facts or wins along the way:

• Conversion fidelity: in 66 pandoc round-trip probes, Carve (via the pandoc-carve bridge) brings back 64 unchanged; Markdown manages 46, HTML 44, DOCX 23 (pandoc-format-fidelity). In other words: Its the textual format that can best keep structural content.
• Hardened: fuzzed, and nesting is capped so hostile input cannot exhaust the server. You don't want 50s loading time on some `[[[[[[[[[` input or alike.

Framework packages

• Laravel: markup-carve/laravel-carve (Blade directives, validation rule, render cache)
• Filament: jeffersongoncalves/filament-carve (community; editor field with preview, infolist entry, table column)
• Symfony: markup-carve/symfony-carve (bundle with Twig filters)
• CakePHP: markup-carve/cakephp-carve (helper, .crv views, validation, ORM behavior, commands)
• Tempest: markup-carve/tempest-carve (safe-by-default view component)
• WordPress: Carve Markup plugin (posts, comments, live preview)
• Shopware: markup-carve/shopware-carve (6.6/6.7: Twig filters, CMS elements, product and category fields, mail templates)

Live demos: Laravel, Symfony, CakePHP, Tempest.

Not just PHP

There are also JavaScript and Rust engines, with Python, Ruby, Go and WebAssembly bindings on top of the Rust one.

I built it for documents that need more structure than I could comfortably write in Markdown. Without HTML workarounds and especially without inline HTML everywhere possible. And for online usage with a fair amount of native features. If you work with user-written content, I would especially like to hear what you think about this, or if there is something I missed.

Thinking about some next major topics I would like to get some feedback on:

• Should it be more "djot"-like with simpler block structure? It sure would make the parser simpler. Humans usually prefer the MD style I assume.
• Are some of the new language features making it too complicated? Overloading concise tables with inline alignment - or the `+` continuation operator to make human input easier?

Links

• Spec & Playground: https://github.com/markup-carve/carve
• PHP engine: https://github.com/markup-carve/carve-php
• PHP sandbox: https://sandbox.dereuromark.de/sandbox/carve
• Awesome list / ecosystem: https://github.com/markup-carve/awesome-carve