iiinova — where your digital self keeps evolving

Reposted by Alexandre Daubois

AFUP @afup.org · 31/08/2026

Sécurité de l'interpréteur PHP, rapports de faille, Ecosystem Security Team... Dans l'interview du jour, @alexdaubois.bsky.social parle de son rôle à la PHP Foundation et pourquoi l'humain reste indispensable face aux rapports de sécurité. Lisez-la, venez l'écouter au Forum PHP 2026. buff.ly/B4qXBU9

031

Alexandre Daubois @alexdaubois.bsky.social · 18/07/2026

If you’re using Vulcain, update now! New security release is here 🔐

010

Reposted by Alexandre Daubois

Les-Tilleuls.coop @les-tilleuls.coop · 15/07/2026

Une immense fierté pour notre coopérative : en complément de ses fonctions de CTO chez nous, @alexdaubois.bsky.social a rejoint @thephpf.bsky.social en tant que développeur contractuel spécialisé en sécurité. Découvrez notre communiqué : les-tilleuls.coop/blog/securit...

les-tilleuls.coop

Sécurité PHP : Alexandre Daubois rejoint la PHP Foundation pour renforcer le cœur du langage | Les-Tilleuls.coop

Face à l'afflux de rapports de sécurité IA, notre CTO Alexandre Daubois rejoint la PHP Foundation pour renforcer l'équipe de core dev.

051

Reposted by Alexandre Daubois

The PHP Foundation @thephpf.bsky.social · 14/07/2026

To further prioritize the handling of security reports for the PHP language, we are thrilled to add @alexdaubois.bsky.social as a part-time addition to our team of contractors. Alex brings a wealth of experience. Welcome, Alex! thephp.foundation/blog/2026/0...

thephp.foundation

Welcoming Alexandre Daubois to The PHP Foundation

Alexandre Daubois joins The PHP Foundation as a part-time security contractor.

082

Reposted by Alexandre Daubois

Les-Tilleuls.coop @les-tilleuls.coop · 09/07/2026

Un autre événement à ne pas manquer cet automne : nous serons les 8 et 9 octobre prochains au #ForumPHP en tant que sponsor Argent ! Retrouvez-nous sur notre stand ainsi que sur scène avec les interventions de @soyuka.me, @alexdaubois.bsky.social et @dunglas.dev. Vous y serez ?

021

Alexandre Daubois @alexdaubois.bsky.social · 07/07/2026

Très heureux d'annoncer ma participation au #ForumPHP 2026 🇫🇷🐘 Je serai présent début octobre a l’évènement de @afup.org pour vous montrer ce qui se passe au sein de l'Ecosystem Security Team de @thephpf.bsky.social que j'ai eu la chance de rejoindre day one 💜 👉 event.afup.org/forum-php-20...

032

Reposted by Alexandre Daubois

Antoine Bluchet @soyuka @soyuka.me · 27/06/2026

@dunglas.dev and I just published a preprint on exposing Hypermedia APIs to LLM agents via a Dynamic Gateway Architecture Thanks @p20n.w3c.social.ap.brid.gy for depositing this work hal.science/hal-05630480

hal.science

Making sure you're not a bot!

174

Alexandre Daubois @alexdaubois.bsky.social · 05/06/2026

OPcache doesn't just cache opcodes. It runs a real compiler optimizer on them. SSA form, dead code elimination, type inference. Yes, in #PHP 👇

110

Alexandre Daubois @alexdaubois.bsky.social · 04/06/2026

ZTS (Zend Thread Safety): the #PHP layer most devs never see. In ZTS mode, every global becomes thread-local. Each thread gets its own executor, compiler, module globals. Full isolation. FPM doesn't need it: direct C globals, fastest path. FrankenPHP does: it runs PHP inside Go threads. 🧵

200

Alexandre Daubois @alexdaubois.bsky.social · 03/06/2026

Generators vs Fibers in #PHP: both suspend execution, totally different mechanism. Generator: saves ONE execute_data frame. Yield pauses it, ->next() resumes. One level deep. Fiber: saves the ENTIRE call stack. Generator, stackless coroutine. Fiber, stackful coroutine.

022

Alexandre Daubois @alexdaubois.bsky.social · 02/06/2026

#PHP has inline caches and almost nobody knows 👀 $obj->name: first access does a hash lookup. But the engine stores the result offset in a "cache slot" embedded in the opcode. Next time, same class? Direct read. No lookup. Works for methods, constants, type checks too.

020

Alexandre Daubois @alexdaubois.bsky.social · 01/06/2026

Traits in #PHP aren't delegated. They're literally memcpy'd into the class. The engine copies each zend_function entry into the consuming class's function_table. "insteadof" picks the winner. "as" creates an alias to the same oparray. After resolution? The trait is gone. Zero runtime cost.

010

Alexandre Daubois @alexdaubois.bsky.social · 31/05/2026

Let's have a look at this #PHP RFC: Friends, by Daniel Scherzer. A class could grant select OTHER classes access to its private and protected members, without making anything public. Let's see what's actually on the table. 🧵

100

Alexandre Daubois @alexdaubois.bsky.social · 30/05/2026

#PHP type juggling auth bypass: if ($input == $hash) with a hash starting "0e" + digits: PHP reads it as 0 (scientific notation). MD5("240610708") = "0e462097..." = 0. MD5("QNKCDZO") = "0e830400..." = 0. 0 == 0: auth bypassed. Fix: === or hash_equals(). Never == for security.

121

Reposted by Alexandre Daubois

Les-Tilleuls.coop @les-tilleuls.coop · 29/05/2026

Moins d'une semaine avant notre API Platform Meetup à Lyon ! Au programme : 🎙️Alexandre Noziere avec "Marier API Platform et un ORM non-Doctrine : le bridge Propel de Thelia 3" 🎙️ @alexdaubois.bsky.social avec le sujet "FrankenPHP: Le Serveur PHP Sous Stéroïdes" www.meetup.com/fr-fr/api-pl...

meetup.com

API Platform Meetup @Lyon, jeu. 4 juin 2026, 19:00 | Meetup

Rejoignez-nous pour une soirée exclusive dédiée à **API Platform**. En compagnie de nos experts, venez découvrir les dernières avancées de l'écosystème et la façon dont il

011

Alexandre Daubois @alexdaubois.bsky.social · 29/05/2026

Timing attacks: === stops at first different byte. Attacker measures response time to guess secrets char by char. hash_equals() compares ALL bytes. Constant time. Go: crypto/subtle.ConstantTimeCompare() Comparing secrets with ===? You leak info through time.

000

Reposted by Alexandre Daubois

Les-Tilleuls.coop @les-tilleuls.coop · 28/05/2026

Retrouvez-nous ce soir dans nos locaux de Lyon pour l'Apéro Web mensuel ! Au programme : échanges passionnants et des talks par @alexdaubois.bsky.social et Alexis Guerre. On a hâte de vous accueillir ! Inscriptions ici : www.meetup.com/fr-FR/apero-...

meetup.com

Apéro Web Lyon - Mai 2026, jeu. 28 mai 2026, 19:00 | Meetup

📢 Fin **mai,** nous aborderons la cybersécurité sur 2 sujets, chaleureusement accueillis par **Les-Tilleuls.coop** ! L'événement est toujours **gratuit, sur place ou sur

011

Alexandre Daubois @alexdaubois.bsky.social · 28/05/2026

PHP compiles your code in 2 passes. And honestly, most devs never look past "it just runs". Here's what really happens between your file and the VM 👇

110

Alexandre Daubois @alexdaubois.bsky.social · 27/05/2026

$GLOBALS used to introduce aliasing complexity in the engine. Because it could reference local variables, Zend had to handle indirect entries (IS_INDIRECT) in certain array access paths. #PHP 8.1 restricted $GLOBALS writes, removing that edge case and simplifying hot paths.

021

Alexandre Daubois @alexdaubois.bsky.social · 26/05/2026

#PHP fibers don't use threads: they use stack swapping. Fiber::suspend() saves the current C stack and VM state, then jumps back to the parent. Fiber::resume() restores everything and continues exactly where you left off. Revolt and Amp are built entirely on this primitive.

000

Alexandre Daubois @alexdaubois.bsky.social · 25/05/2026

#Golang's scheduler has a magic number: 61. Every 61 goroutine schedules, the runtime checks the global queue instead of the local one. Why 61? It's prime, so it never aligns with any other periodic check. If it were 64, you'd get pathological starvation patterns, and 61 breaks every harmonic.

030

Alexandre Daubois @alexdaubois.bsky.social · 24/05/2026

One underrated attack vector is your lockfile. 🔐 composer.lock, package-lock.json, go.sum... They all pin versions, but the upstream registry can still ship a malicious 1.2.3 if a maintainer's account gets compromised. 🧵

220

Alexandre Daubois @alexdaubois.bsky.social · 23/05/2026

unserialize() in #PHP isn't just "unsafe with user input." It's a remote code execution primitive. Here's the full attack chain 👇

102

Alexandre Daubois @alexdaubois.bsky.social · 22/05/2026

Here we go for the third talk of the week! This time at home, in Lyon, France 🇫🇷 for the @afup.org Day. Jetlag's going to hit hard but it's an event you can't miss. We'll talk about #JsonPath in #PHP!

122

Alexandre Daubois @alexdaubois.bsky.social · 21/05/2026

Thank you so much for having me #PHPTek @phparch.com! First talk in the USA for me, and I'm getting back in September in San Francisco 🇺🇸 Had a blast to talk about #FrankenPHP, cybersecurity and meeting people from @thephpf.bsky.social and the ecosystem 🐘💜

022

Reposted by Alexandre Daubois

GromNaN @jerome.tamarelle.net · 20/05/2026

A huge thank you to @fabien.potencier.org @nicolasgrekas.bsky.social @alexdaubois.bsky.social @jderusse.bsky.social @javiereguiluz.bsky.social and all the #Symfony Core Team involved in triaging the security reports, fixing the bugs, reviewing the PRs and releasing the patched versions.

072

Reposted by Alexandre Daubois

Fabien Potencier @fabien.potencier.org · 20/05/2026

During the last few weeks, the #Symfony core team has been hard at work fixing a long list of vulnerabilities for both #Symfony and #Twig. Today, we're publishing that work in the biggest security patch releases ever. Bare with us and wish us luck 🍀

32915

Alexandre Daubois @alexdaubois.bsky.social · 20/05/2026

#PHP attributes look like decorators... end of the resemblance 😄 Attributes are pure metadata, stored in the class definition. They do *nothing* on their own. A framework must call ReflectionClass::getAttributes() and instantiate them to make anything happen. 🧵

100

Alexandre Daubois @alexdaubois.bsky.social · 19/05/2026

Named arguments in #PHP 8.0+ are resolved at compile time. Not runtime. The compiler maps argument names to parameter positions in the function signature. The opcodes use positional slots. $name → position #2 → SEND_VAL to slot #2. One exception... 🧵

121

Alexandre Daubois @alexdaubois.bsky.social · 18/05/2026

It's been quite some time since I visited the US! 🇺🇸 Finishing up details for my talks at @phptek (phptek.io). Let's talk about #FrankenPHP and #cybersecurity! See you tomorrow 🥳

020

Alexandre Daubois @alexdaubois.bsky.social · 17/05/2026

#PHP strings aren't C "char*". They're zend_string. A zend_string carries a GC header (8 bytes on 64-bit) + cached hash (8 bytes) + length (8 bytes) + the actual bytes inline at the end of the struct. The hash is computed ONCE on first use and cached forever. Every subsequent hash lookup is free.

010

Alexandre Daubois @alexdaubois.bsky.social · 16/05/2026

It's been an incredible experience to be part of the selection committee of the @apiplatform Conference. 🕷️ This year we'll be full of #PHP, #FrankenPHP and APIPlatform talks. Let's push the boundaries: expect topics rarely shown at conferences! Full lineup 👉 api-platform.com/fr/con/2026/

000

Alexandre Daubois @alexdaubois.bsky.social · 15/05/2026

The . (concat) operator in #PHP doesn't create a new string every time. If the left operand is a temporary with refcount=1, PHP *REALLOCS* it in place. "a" . "b" . "c" . "d" → in the best case, one allocation + three reallocs. Not four allocations. The engine tries hard to avoid copying.

010

Alexandre Daubois @alexdaubois.bsky.social · 14/05/2026

#PHP's cycle collector doesn't run on every unset(). When a refcount decreases but doesn't hit 0, the zval MAY be a cycle root. It goes into a "root buffer". When the buffer hits 10,000 entries, the collector runs. That's the threshold. 10,000 potential roots. 🧵

100

Alexandre Daubois @alexdaubois.bsky.social · 13/05/2026

New #PHP RFC dropped: Bound-Erased Generic Types, by Seifeddine Gmati (@azjezz). And everybody's talking about it! Generics in PHP, for real this time? Sort of. Let's look at what it actually proposes, and what it deliberately doesn't. 🧵

130

Alexandre Daubois @alexdaubois.bsky.social · 12/05/2026

I'm absolutely thrilled to be back at @les-tilleuls.coop's #APIPlatformCon this year again! 🕷️ Let's make observability pleasant: "Observe FrankenPHP: DX Serving Performance"! If you follow me for some time, you know what we're going to deep-dive into 😉🔥 👉 api-platform.com/fr/con/2026/

022

Alexandre Daubois @alexdaubois.bsky.social · 11/05/2026

When you write `class Dog extends Animal`, #PHP doesn't create dynamic lookups. At compile time, every method from Animal is COPIED into Dog's function_table. Dog doesn't have a pointer to Animal's methods. It HAS the methods. 🧵

110

Alexandre Daubois @alexdaubois.bsky.social · 10/05/2026

OPcache doesn't just cache opcodes, it optimizes them. It builds an SSA (Static Single Assignment) form of your code, like a real compiler! Then it runs optimization passes: constant propagation, dead code elimination, type inference... Your PHP code is kind of rewritten every time!

021

Alexandre Daubois @alexdaubois.bsky.social · 09/05/2026

#PHP integers are not "just ints": they're zend_long, a platform-dependent C type. 64-bit system, 64-bit signed integer. But what if it overflows? Well, PHP silently converts to float. No exception, no error. So PHP_INT_MAX + 1 is a float: not a crash, not a wrap-around.

000

Alexandre Daubois @alexdaubois.bsky.social · 08/05/2026

#PHP exceptions don't use C setjmp/longjmp anymore since PHP 7. When an exception is thrown, the engine sets a flag on the execute_data and RETURNS to the VM dispatcher. The dispatcher checks the flag, walks the try/catch table, finds the matching catch block, and jumps to it. 🧵

121

Alexandre Daubois @alexdaubois.bsky.social · 07/05/2026

When you write `use ($x)`, #PHP copies the zval into the closure's scope. When you write `use (&$x)`, it wraps $x in a zend_reference and shares it. Closures don't "see" the parent scope: they carry their snapshot. No hidden pointer to the parent frame: it might be gone when the closure runs.

020

Reposted by Alexandre Daubois

Les-Tilleuls.coop @les-tilleuls.coop · 06/05/2026

We're really excited to travel to Chicago mid-May to speak at PHP Tek, one of the biggest PHP conferences in the world. Make sure to attend @alexdaubois.bsky.social talks scheduled. Who's coming?

041

Alexandre Daubois @alexdaubois.bsky.social · 06/05/2026

I can't wait to get back to the USA to give 2 talks about #PHP! Let's meet in 2 weeks in Chicago for @phptek 🚀

000

Alexandre Daubois @alexdaubois.bsky.social · 06/05/2026

In #PHP, references are a SEPARATE type: IS_REFERENCE. $a = 1 → zval { type: IS_LONG, value: 1 } $b = &$a → both point to a zend_reference { refcount: 2, value: zval{1} } The reference is a wrapper AROUND the value. Not a flag on the value. This is why PHP 7+ became faster... 🧵

110

Alexandre Daubois @alexdaubois.bsky.social · 05/05/2026

Every local variable in a #PHP function is a "Compiled Variable." At compile time, $a, $b, $name... each gets a fixed integer slot in the stack frame. Accessing $a = reading slot #0 from a C array. It's O(1). That's why local variables are the fastest storage in PHP. They're array indexes!

020

Alexandre Daubois @alexdaubois.bsky.social · 04/05/2026

When you call $obj->method() in #PHP, here's what the engine does: 1. Read $obj's class entry (zend_class_entry*) 2. Look up "method" in the class's function_table 3. If not found, check parent classes walking the inheritance chain 🧵

120

Alexandre Daubois @alexdaubois.bsky.social · 03/05/2026

Ember isn't just a TUI for Caddy/#PHP apps: • ember status: one-line health check, exit code 0 if OK • ember --json --once: JSON snapshot for CI pipelines • ember --daemon --expose :9191: headless sidecar that serves #Prometheus metrics • ember diff before.json after.json: compare across deploys

000

Alexandre Daubois @alexdaubois.bsky.social · 02/05/2026

#PHP's VM has 3 dispatch modes you can choose. CALL: each handler is a C function. The VM calls them one by one. SWITCH: one giant switch(opcode) in a loop. Classic interpreter. GOTO: computed goto. Each handler jumps directly to the next. Default is HYBRID: goto for hot paths, call for the rest.

000

Alexandre Daubois @alexdaubois.bsky.social · 01/05/2026

The Zend VM of #PHP doesn't have one ADD handler. It has DOZENS. ZEND_ADD_LONG_NO_OVERFLOW, ZEND_ADD_DOUBLE... At compile time, the engine picks the most specific handler for your operand types. $a + $b with two known integers is a direct C addition. Thousands of specialized handlers.

000

Alexandre Daubois @alexdaubois.bsky.social · 30/04/2026

#PHP's foreach doesn't copy your array... Well, not anymore 😄 In PHP 7+, foreach creates an internal iterator (HashPosition) on the array. It walks arData linearly. Copy-on-write protects you: if you modify the array inside the loop, THEN it copies. No modification? No copy, zero overhead.

020