Every story tagged PHP, curated for CIOs and IT leaders — ranked by source credibility, engagement, and freshness.
3 stories · open in the command center
e107 prior to version 2.3.8 contains a code execution vulnerability in the e_array deserialization handler that allows an attacker with out-of-band database write access to execute arbitrary PHP code by storing a crafted payload in the user_prefs column. The e_array::unserialize() function in e107_handlers/core_functions.php performs only a prefix check for the string 'array' before passing the stored value to eval(), causing automatic PHP execution whenever the affected user's preferences are materialized through e_user_pref::load().
PHP remains a viable and increasingly modernized backend language that powers a significant portion of web applications, with recent versions offering improved performance, security features, and developer experience comparable to contemporary frameworks. For IT organizations, investing in PHP expertise provides access to a massive talent pool, maintains compatibility with legacy systems, and enables cost-effective development of web applications at scale. The strategic implication is that dismissing PHP as outdated could represent a missed opportunity to leverage a mature, battle-tested ecosystem that continues to evolve with industry standards.
PHP 8.6 introduces automatic closure optimizations that can significantly reduce memory consumption and improve performance by up to 3% in production frameworks like Laravel by eliminating unnecessary object reference cycles and reducing redundant closure instantiations. The optimizations automatically convert non-static closures to static ones when safe and cache stateless closures, reducing memory overhead in high-traffic PHP applications. While the changes include minor backward compatibility considerations, they enable more predictable memory management and earlier garbage collection without requiring code modifications.