PHP digest — 14 October 2026

Six developments: a Laravel release, three Symfony maintenance releases, details of Symfony 8.2's attribute-based workflows, a status fix on the IntlRelativeDateTimeFormatter RFC page, a PHP security team report on how it handles vulnerability reports, and support windows that end within 90 days. The Laravel release is from 13 October; it appeared in the daily package collection at 04:01 UTC on 14 October and was not covered before. The Symfony and RFC items were added at about 10:02 UTC; the last two at about 16:05 UTC.

Laravel 13.36: queue and Mercure broadcasting changes

laravel/framework v13.36.0 was tagged on 13 October (13:22 UTC); Packagist lists require_php: ^8.3. Selected changes, checked in the pull requests or the tagged source:

• The framework's own config/queue.php gains the background connection that the application skeleton already had. Before this, apps without their own queue config, or that published it with php artisan config:publish queue, got "The [background] queue connection has not been configured" (#61917).
• Queue workers can flush sticky database connections between jobs. The opt-in is the static Worker::$flushStickyConnections property, which is false by default in the v13.36.0 source. The PR says a long-running worker that ran one writing job could otherwise keep reading from the write connection (#61915).
• With the FrankenPHP built-in Mercure hub (no url configured), resolving the broadcaster no longer crashes Artisan commands outside FrankenPHP; broadcasting there throws a BroadcastException asking for a url. Events that target only Mercure connections are now broadcast synchronously by default. A new async option restores queueing and requires a url (#61977). This changes default behavior for Mercure broadcasts.
• Rule builder objects are added for the remaining validation rules, so rules can be built with IDE autocompletion instead of strings (#61833). The final class and method names were not checked.
• Mail Markdown now escapes inline Markdown in user input properly (#61755, titled "Prevent escaping from bypassing protection"). No GitHub security advisory for this change was listed on the laravel/framework advisories page when checked at about 04:02 UTC, so this wiki does not treat it as a security fix.

The release also has many queue, Eloquent, Redis and notification fixes. Some entries are 12.x backports; whether a 12.x release includes them was not checked.

Symfony 8.1.9, 7.4.21 and 6.4.48 maintenance releases

Symfony published 8.1.9, 7.4.21 and 6.4.48 on 14 October. Their changelogs list 156, 134 and 95 entries, most of them bug fixes. Some fixes that appear in all three branches:

• Clock: new DatePoint(), and a DatePoint built from a reference in the hour that repeats when daylight saving time ends, were one hour off (#66708, #66833).
• Security: the session's security token is no longer copied into logs (#66629).
• ExpressionLanguage: the depth of the parsed node tree is now bounded (#66723), and evaluated and compiled expressions no longer give different results in some cases (#66727).
• Messenger: decoded messages carrying non-sendable stamps are rejected, and the stamps of unserialized envelopes are validated (#66509).
• BrowserKit: cookie parsing and path matching are fixed (#66182).

None of the three posts labels a change as a security fix or links an advisory, and no Symfony security advisory post was collected. This digest does not treat these changes as security fixes.

Symfony 8.2: attribute-based workflows in detail

The 11 October digest noted that workflows defined with PHP attributes had been merged into the 8.2 branch. A post on 14 October describes the API (#61935, by Grégoire Pineau). #[AsWorkflow(supports: Task::class)] on an autoconfigured service class defines a state machine by default, or a workflow with type: WorkflowType::Workflow. Its name comes from the class name without the Workflow suffix. Each transition is a class constant with a #[Transition(from: …, to: …)] attribute, and the attribute can be repeated to give several transitions the same name. Places are inferred from the transitions, and the first one is the initial place. from, to and initialMarking also accept string-backed enum cases. With places: TaskStatus::class, every case is a place and using any other place is an error. An optional WorkflowTrait exposes can()/apply() on the class. Listener attributes such as #[AsGuardListener] inside the class do not need a workflow argument. Symfony 8.2 is not released.

IntlRelativeDateTimeFormatter RFC page now says "Voting"

An edit to the IntlRelativeDateTimeFormatter RFC at 07:02 UTC changed its header to Status: Voting. Until then it had said Under Discussion, although the poll opened on 7 October and the official index already listed the RFC as voting. The vote (2/3 majority, ends 22 October 00:00 UTC) showed 18 yes, 0 no and 0 abstain at about 10:02 UTC. That is an interim count, not a result. See the RFC page.

PHP security team describes how it handles reports

In a PHP Foundation blog post on 14 October, Alexandre Daubois of the PHP security team, which triages php-src reports, says that since 1 July the team has published 15 CVEs and closed 106 reports as not vulnerabilities, duplicates or not reproducible. The PHP Group is a CVE Numbering Authority for php-src and assigns its own CVE IDs, so advisories do not wait on GitHub's advisory review queue. The post says there is still a backlog. It asks reporters to use the GitHub security advisory form, not public issues, and to send a minimal script, the PHP version or commit, OS, configure flags, sanitizer output and the attacker-controlled impact. The security classification policy excludes, among others, malicious valid PHP code, unsanitized input passed to functions such as mysqli_query(), FFI, open_basedir bypasses, non-standard builds and the built-in web server. AI-assisted reports are accepted if the reporter has reproduced them on a PHP build. The team uses AI tools to validate and sort reports, but people set the severity and write or review every patch. The figures are the team's own and were not checked against the advisory list.

Support windows ending within 90 days

Checked against the publishers on 14 October (see PHP support windows and Laravel and Symfony support windows):

• PHP 8.2 security support ends on 31 December 2026, so the branch reaches end of life. On the same day PHP 8.4 leaves active support and gets security fixes only, until 31 December 2028.
• Symfony 6.4 (long-term support) stops getting bug fixes in November 2026; security fixes continue until November 2027.

Drupal's 10.6 and 11.3 branches also end within this window according to the collected endoflife.date records (16 December 2026). drupal.org could not be reached to confirm this, so the date is not verified here.

Coverage

At 04:01 UTC all 43 sources were collected successfully. At 10:01 UTC the 24 due feed and index sources were collected successfully; the 19 daily package and adoption sources were not due and keep their 04:01 UTC data. health --fail-stale reports all 43 ok and none stale. The official RFC index records are unchanged (951 entries); end_pear_endorsement and reldateformatter are still voting. No new internals messages were collected after 21:08 UTC on 13 October. The daily download counts were collected but not compared, because no baseline comparison has been defined.

At 16:01 UTC, after the source catalog grew to 56, all 56 sources were collected successfully and health reports none stale. The new release feeds surfaced earlier releases (Psalm 6.20.0 and 7.0.0-rc2 on 9 October, PIE 1.5.2 on 8 October) that were not inspected and are not reported as new here. Laravel 12.70.0 (13 October) lists three 12.x backports (#61838, #61871, #61822); their effects were not checked. The first security-advisory collection has no high or critical record published after 8 September. The RFC index and its voting entries are unchanged, and no new internals messages were collected. A SymfonyCon talk announcement was skipped. drupal.org returned a proxy 403 when inspected.

At 22:01 UTC the 31 due feed, release and index sources were collected successfully; the 25 daily sources were not due and keep their 16:01 UTC data. None of the collected sources had a new or changed record, the RFC index is unchanged, and this edition gained no new items.