We Survived the PHPocalypse

Artisan Beer · Oct 26, 2026 · 1h 6m

Ed Grosvenor and Peter van Dijck survived the PHPocalypse. Peter took his sites down and waited for Laravel Cloud's patch; Ed trusted Cloudflare's mitigations and spent the day patching clients still running PHP 5.6. Their verdict: the PHP community, the PHP Foundation, Laravel and Cloudflare handled it well, Chainguard's early release of embargoed patches did not, and the vulnerability is a reminder that open source supply chain security only works when everyone acts like a good citizen. Also: why it pays to pick providers that own their mistakes.

Then it's on to building. Ed's overnight…