Quarterly Progress Report - Q2 2026  🔗 **Source:** [Quarterly Progress Report - Q2 2026](https://thephp.foundation/blog/2026/07/21/quarterly-report-q2-2026/) > [!note]+ Document Notes > --- > tags: ["php", "open-source-sustainability", "software-security", "language-maintenance", "developer-infrastructure", "foundation-governance"] > author: "Elizabeth Barron" > source: "The PHP Foundation" > reference: "https://thephp.foundation/blog/2026/07/21/quarterly-report-q2-2026/" > date_created: "2026-07-22" > --- > # 🏷️ Quarterly Progress Report - Q2 2026 > ## 🧭 Table of Contents > - References > - Summary > - Main Content and Notes > - References > - Paraphrase > - Newsletter > - Action Items > - Hypotheses > - Methodology > - Questions > - Future Research > - Implications > - Learning Styles Assessment > - Accessibility Assessment > - DEIB Assessment > - Logical Validity > - DARVO Analysis > - Conclusion > - Refactor Appendix > - Template Library > ## 🔗 References > - [Quarterly Progress Report - Q2 2026](https://thephp.foundation/blog/2026/07/21/quarterly-report-q2-2026/) > - [PHP Foundation core developers](https://thephp.foundation/structure/#Core%20Developers) > - [AF_PACKET raw-buffer pull request](https://github.com/php/php-src/pull/21631) > - [STF hook dependency pull request](https://github.com/php/php-src/pull/22538) > - [Follow-up improvements for ext/uri RFC](https://wiki.php.net/rfc/uri_followup) > - [Query parameter RFC](https://wiki.php.net/rfc/query_params) > - [PHP Ecosystem Security Team](https://thephp.foundation/blog/2026/05/18/announcing-ecosystem-security-team/) > - [PHP Foundation board minutes](https://github.com/ThePHPF/foundation/tree/main/board%20minutes) > ## 📝 Summary > **What happened:** The PHP Foundation published its first quarterly contractor report. It describes work by a 13-person core team across eight countries, plus foundation leadership. Q2 work covered engine correctness, sockets, streams, TLS, Windows builds, extension installation, URI APIs, security triage, package audits, php.net infrastructure, contributor tools, and public governance. > **Why it matters:** PHP maintenance is distributed systems work in both the technical and organizational senses. Small engine fixes, build updates, package audits, infrastructure migrations, and contributor support combine to keep a language used by a large share of the web dependable. > **Stakeholders:** PHP core developers, package maintainers, WordPress contributors, hosting companies, plugin and theme authors, enterprise engineering teams, security researchers, sponsors, and end users whose sites depend on supported PHP versions. > **Risks:** The report is selective and self-reported. Several projects remain experimental or target a version after PHP 8.6. Security work must balance transparency with responsible disclosure. Part-time staffing and broad scope can create capacity and continuity pressure. > **Bottom line:** The strongest result is not one feature. It is a maintenance portfolio that joins core correctness, ecosystem security, release infrastructure, and clearer governance. WordPress teams should turn this visibility into earlier compatibility testing and better coordination with PHP maintainers. > ## 📖 Main Content > ### 1. Maintenance work becomes visible > The Foundation says future reports will summarize contractor work each quarter. It also states that routine review, bug fixing, and triage continue outside the highlighted projects. This distinction matters because visible features rarely represent the full cost of language stewardship. > ### 2. Engine correctness and performance remain active research areas > Work addressed error-handler and destructor bugs, type-checking duplication, string allocation in `ext/phar`, stream architecture, and an experimental 8-byte `zval`. The `zval` experiment could affect memory use across PHP, but the report correctly labels it early-stage work. > ### 3. New system APIs expand PHP's reach > `AF_PACKET` support lets privileged PHP processes interact with Linux packet sockets. Stream error APIs, polling, TLS session resumption, PSK support, and cryptographic status exposure strengthen network and systems programming paths. These capabilities carry clear permission and threat-model requirements. > ### 4. Release infrastructure is part of language safety > The php.net CDN migration, Visual Studio 2026 support, dependency updates, Windows crash fixes, and continued PECL build work show that language delivery is inseparable from infrastructure. A secure source tree is not enough if release channels or binary dependencies fall behind. > ### 5. Testing data improved > The report says `gcovr` accuracy rose from about 54 percent to 71 percent. The important change is not only a larger number; it is a more trustworthy map of what has and has not been exercised. Coverage still measures execution, not behavioral correctness. > ### 6. Extension distribution is moving toward Composer-like workflows > PIE 1.5 work adds multiple-extension installation, unattended selection, no-op reinstalls, lock-file installation, provider API support, and security maintenance. Aligning extension management with familiar dependency workflows can reduce operational friction, but adoption and rollback behavior need field evidence. > ### 7. Language and API proposals continue in parallel > URI Builder work is landing, while query-parameter and UUID ideas remain at proposal or proof-of-concept stages. The report distinguishes accepted work from pending votes and experiments, which helps readers avoid treating all listed items as shipped features. > ### 8. Ecosystem security extends beyond php-src > The new PHP Ecosystem Security Team reportedly scanned more than 500 widely used Composer packages and shared more than 100 fixes with maintainers. This shifts part of the security model from waiting for reports toward coordinated discovery and repair across dependencies. > ### 9. Governance and communication are treated as project infrastructure > Leadership launched an ambassador program, advisory-board meetings, a State of PHP survey, a revived newsletter, and published governing-board minutes. These moves create more feedback channels and make some decisions easier to inspect. > ### 🗒️ Notes > - The report covers 13 contractors in eight countries, most working part-time. > - It explicitly says the list is selective and excludes much routine maintenance. > - Several technical claims link to pull requests or RFCs, but not every accomplishment has a direct evidence link. > - One parser experiment was paused, an important example of reporting stopped work instead of only wins. > - Family leave is acknowledged without framing absence as a performance problem. > - The phrase “safe by design” for raw packet access depends on correct capability management and deserves a narrower claim. > - Counts for package scans and fixes are useful, but severity, validation, disclosure timing, and downstream adoption are not reported. > ## 📚 References > - The quarterly report is the primary source for staffing, project status, and activity claims. > - Linked php-src pull requests and PHP RFC pages provide stronger technical evidence for specific work. > - Foundation board minutes provide governance records, but independent adoption and outcome data remain outside this report. > - Security claims should be checked against advisories and maintainer confirmations when disclosure permits. > ## 🗣️ Paraphrase > 1. The Foundation plans to make contractor work easier to follow through quarterly reporting. > 2. The team is geographically distributed, mostly part-time, and responsible for routine maintenance that the report does not enumerate. > 3. Several developers worked on engine bugs, memory use, type checks, streams, and future language behavior. > 4. New low-level socket and TLS features widen what PHP can do in controlled system environments. > 5. The project migrated php.net delivery infrastructure and kept Windows toolchains and dependencies current. > 6. Better coverage reporting gives maintainers a clearer view of test gaps, though it does not prove correctness. > 7. PIE is adding extension-management behavior that resembles modern dependency tools. > 8. URI improvements are accepted, while query parameters, UUIDs, and smaller values remain proposals or experiments. > 9. A new ecosystem security group scanned widely used Composer packages and worked privately with maint Our [team of core developers](https://thephp.foundation/structure/#Core%20Developers) works very hard to strengthen and improve the PHP language. In an effort to improve the way we communicate this work, from now on, we will be posting quarterly updates regarding their individual projects and efforts. Our core team consists of 13 people, distributed across 8 countries. Most of our contractors work part-time for The PHP Foundation and have other ventures aside from working on the PHP core. Also, this report is not meant to be a comprehensive list of everything our contractors shipped, but a high-level summary of their most impactful work. In addition to our regular efforts around sustaining PHP through routine tasks like code reviews, bug fixes, issue triage and other maintenance work that we expect from all our developers, we want to highlight these particular efforts: ##### Arnaud Le Blanc Arnaud worked out a general solution to two long-standing sources of engine bugs tied to error handlers and destructors, in collaboration with Ilija Tovilo (one of Arnaud's fixes builds on an earlier attempt made by him). The forthcoming RFC will add a fix for a related third bug source, all targeting a version after PHP 8.6. On the STF project, he's stepped back from I/O hooks and shifted with Jakub Zelenka to [a dependency of hooks](https://github.com/php/php-src/pull/22538), also targeting a version after PHP 8.6. ##### David Carlier David shipped [`AF_PACKET` raw buffer support](https://github.com/php/php-src/pull/21631) in PHP's sockets extension, so PHP can now work with low-level Linux packet sockets directly instead of shelling out or resorting to FFI. This PR closes a real gap with C, Python, Go, and Rust, and opens up native packet capture and injection for PHP. It's also safe by design, since like every other language it needs a privileged account (`CAP_NET_RAW/root`) to use, so it doesn't widen the attack surface for ordinary code. ##### Derick Rethans Derick spent many hours investigating, trialing, and planning, and was able to complete a migration of the whole php.net infrastructure to a new CDN provider (more details on this are coming in a separate announcement). ##### Gina Banyard Gina worked on `ext/phar` to cut unnecessary string allocations and improve its clarity, and investigated unifying PHP's type-checking code to remove redundant return-type checks (tied to her interface-only generic types proposal), both of which reduce duplication and improve performance and maintainability. She also explored replacing the `get_constructor()` object handler with an attribute, which would make constructors more predictable and could eventually let `new MyClass(...)` be used as a callable. This is a small but long-requested ergonomics win. In parallel, she's been preparing the mass deprecation RFC for PHP 8.6, investigating how often objects get treated as arrays, and keeping up with PR reviews and older bug fixes to prevent technical debt from piling up ahead of the next release. On top of the engineering work, she represented the project publicly: preparing and giving a talk at UNSOUND (her first academic conference), along with other conference talks and an opinion blog post, helping raise the project's visibility outside its usual community. ##### Ilija Tovilo Ilija focused on ongoing security and regular issue handling and triage, work that keeps critical bugs from piling up and gets exploitable issues fixed before they reach users. He also continued work on the STF stream project, a core I/O abstraction where improvements pay off across many parts of the engine at once. In addition, he experimented with an 8-byte `zval` representation, which is a potentially high-leverage change, since `zval` is the fundamental value representation used throughout the engine, meaning a smaller size could meaningfully cut memory footprint and improve performance broadly. This is in the very early stages of experimentation. Finally, he drove improvements to `gcovr` accuracy from roughly 54% to 71%, giving the team a far more trustworthy picture of what's actually tested and better ability to catch under-tested code early. ##### Jakub Zelenka Jakub delivered several major new PHP core APIs, including a new stream errors API, an internal and userspace polling API (Io\Poll), and significant OpenSSL/TLS enhancements such as configurable session resumption, PSK support, and crypto status exposure. He also patched a security vulnerability in the FPM status endpoint and fixed a number of memory leaks and long-standing stream bugs. Together these changes strengthened PHP's streams, I/O, and TLS capabilities. ##### James Titcumb For the last few months, the PIE team has been hard at work on new features for the upcoming 1.5 release with several new key features. There's been a lot of background work to align the PIE interactions with Composer, which has allowed them to build several new requested features, including being able to install multiple extensions at once, adding a `--select` flag for unattended PIE installs for PHP projects, making re-installing an already installed extension a no-op, and being able to install locked extensions for a target PHP install with a new `pie install --from-lock` flag. Additionally, they have added support for some of the old PECL placeholder replacements, updated PIE to use the providers API, and kept up with maintenance of the 1.4.x series, bug-fixes, and security fixes for GitHub Security Advisories reported by the community. ##### Joe Watkins Joe's work has centered on experimenting with ideas that improve the PHP language and experience for contributors. His latest experiment was creating a multi-engine parser that would feed into a larger framework for mapping and connecting the PHP core code across repos, documentation, and eventually issues, PR comments, and other pieces of contextual information, which would help new contributors understand the context, evolution, and functionality of the PHP core codebase. This project was recently put on hold in lieu of other priorities, but is available on [GitHub](https://github.com/krakjoe/phathom). ##### Máté Kocsis Thanks to Máté's work, the ['Followup improvements for ext/uri' RFC](https://wiki.php.net/rfc/uri_followup) was accepted, and most of the work is already implemented. Once all changes land, it will become possible to build URIs and URLs via the new Builder classes, and some other, more advanced use cases will be better supported. Additionally, there is another RFC that has a fairly complete proposed implementation, which could revolutionize how query parameters are handled in PHP: <https://wiki.php.net/rfc/query_params>. Voting is not yet open for this RFC but it should be open in the next quarter. Finally, Máté was also experimenting with UUIDs (UUID v7 more specifically) and created a proof-of-concept implementation for a new extension. Work on this will continue after the pending URI proposals are wrapped up. ##### Saki Takamachi Saki was responsible for various bug fixes and code reviews and is currently out for family leave. ##### Shivam Mathur Shivam added support for the new Visual Studio 2026 (VS18) toolchain across PHP's Windows build infrastructure and dependency stack, laying the groundwork the ecosystem needs ahead of PHP 8.6. He strengthened the security and stability of official Windows builds by updating and testing critical dependencies (OpenSSL, curl, SQLite, Apache, ICU, and libssh2), effectively closing off known vulnerabilities that could otherwise affect every Windows install. Shivam also resolved Windows-specific PGO and ZTS crashes, directly improving reliability for Windows users on currently supported versions. And lastly, he also maintained and improved php-windows-builder, keeping Windows binaries flowing for new PECL extension releases and keeping the platform from falling behind Linux/macOS in build support. ##### Volker Dusch Volker founded the [PHP Ecosystem Security Team](https://thephp.foundation/blog/2026/05/18/announcing-ecosystem-security-team/), a new effort to help PHP project maintainers find, fix, and handle security vulnerabilities. This is important because many maintainers, especially of smaller projects, lack the time or expertise to catch these issues themselves, leaving gaps that affect the wider ecosystem. Toward that end, he scanned over 500 of the most-used Composer packages and nearly every major framework, sharing 100+ fixes directly with maintainers, which translates into concrete, shipped security improvements across a large swath of the PHP ecosystem rather than just one project. He also worked alongside maintainers to help grow the team and support projects through specific security incidents (projects with a security need are encouraged to reach out). ##### Alexandre Daubois Our 13th contractor, Alexandre Daubois, is brand new to the team, so we won't have updates to share until the next quarterly report. ##### The PHP Foundation Leadership In addition to our team of developers, The Foundation's Executive Director (that's me!) and Director of Fundraising (Ben Marks) have also been hard at work making progress on our goals. Q2 focused on getting a lay of the land through a listening tour, creating and kicking off implementation of a strategy plan for the rest of the year, and onboarding new contractors, sponsors, and Board members. We launched the PHP Ambassador program, quarterly Advisory Board meetings, the State of PHP Survey, revived the monthly newsletter, and began publishing [minutes](https://github.com/ThePHPF/foundation/tree/main/board%20minutes) from the Governing Board meetings. We continue to focus on increasing Foundation transparency and collaboration with the community, and expanding our mission to include other initiatives besides PHP core language development. We are happy to share these updates with you, and if you have any questions about what any of our contractors are working on, you can connect with us in The PHP Foundation Discord channel on the [PHPC server](https://phpc.chat/). * Elizabeth Barron, Quarterly Progress Report - Q2 2026, thephp.foundation, 01ky561nqvfshbrdrqfwebgwr2.