open-source lover, creator of staabm/phpstan-dba, extensive freetime @phpstan, @rectorphp and #phpunit contributor #sabredav, #amphp, #redaxo

germany
Joined December 2011
You might know depending on configuration #xDebug beeing loaded can considerably slow down things Therefore popular tools auto-restart themselves Recently we learned #pcov can have similar impact. Todays #phpstan release therefore also disarms it
1
121
Set session.upload_progress.enabled=0 till next PHP release to block an unlikely RCE vector (CVE-2026-115560). Already recommended for CVE-2026-109619 Wed, keep disabled. Only apps with non-default serialize_handler switching it to "php" at runtime can be affected. #php #phpc
49
895
149
2,815
391,149
If all the govs shutting down servers for a PHP update, all the hosters & enterprises terrified by the vuln, gave $100k, or just $50k a year to the PHP Foundation, things could look very differently. Go, make your employer sponsor *today* thephp.foundation/sponsor/ #php #phpc @ThePHPF
3
117
12
248
15,764
We're excited to welcome @sentry to our sponsor program as part of their investment in open source infrastructure! We rely on responsible businesses like @sentry to maintain and operate the infrastructure behind the PHP ecosystem. Join them: packagist.org/sponsor/
6
58
1,852
The #php2shell panic got the severity right and most of the details wrong. It's a 9.2, not a 10.0, and the session.upload_progress flag you were told to switch off belongs to the other CVE. I went through the rumors against the advisory and the diff: daubois.dev/blog/cve-2026-10…
2
28
4
145
57,935
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2. PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
344
4,176
1,253
18,613
7,043,154
#phpstan 2.3.x added new dependency tracking APIs which allow custom extensions/rules to declare values/files they depend on. todays #phpstandba 0.5 release uses the new APIs, which allows us to re-analyze only code depending on the database schema when it changes.
1
4
1,496
For the best experience you should install #phpstan using #composer! when downloading the phpstan.phar with curl/wget or via package managers like e.g. homebrew or phive, chances are high you will miss necessary PHPStan Turbo files. Analysis will be a lot slower without Turbo!
1
2
178
I wanted to stop controllers calling external services, however deep in the call graph. So I built a PHPStan extension: mark external calls as 'slow', forbid 'slow' in controllers, and let it flag violations. Probably has many other uses too. github.com/DaveLiddament/php…
3
6
26
1,194
For the best experience you should install #phpstan using #composer! when downloading the phpstan.phar with curl/wget or via package managers like e.g. homebrew or phive, chances are high you will miss necessary PHPStan Turbo files. Analysis will be a lot slower without Turbo!
1
2
178
Same performance, smaller package PHPStan 2.3.0 was chonky! It weighed 104 MB when downloaded and 268 MB after being unzipped in your vendor/. I just released PHPStan 2.3.1 that weighs just under 28 MB when downloaded and 87 MB unzipped. While preserving all the Turbo binaries.
10
10
162
6,254
PHPStan analysing the WordPress codebase took 60.51 seconds back in december. With PHPStan 2.3 + Turbo: 7.93 seconds. That’s the kind of dev improvement I get excited about💪
3
3
21
846
#phpstan recently started erroring about assertEmpty() and assertNotEmpty() #PHPUnit assertions, when phpstan-strict-rules are enabled (because these forbidd empty()). Just released autofixers for phpstan-phpunit for the most common cases.
2
5
415
markus staab | @[email protected] retweeted
Replying to @OndrejMirtes
PHPStan 2.3.0 made our PHP Quality run’s analysis step 66% faster, dropping from 3m42s to 1m16s — roughly 3× faster. That’s the PHPStan step in hosted CI on PHP 8.4, comparing versions 2.2.6 and 2.3.0 New run github.com/capell-app/capell… 2.2.6 baseline github.com/capell-app/capell…
1
3
108
Great to see WordPress being used as an example of the huge performance improvements in the PHPStan 2.3.0 release: where it used to take 60 seconds to analyze the entire codebase uncached, now it takes just 8 seconds! – at Portland, OR
3
1
18
678
after upgrade to phpstan 2.3.0 · repo timings: 112.35s → 76.04s · 32.3% faster
PHPStan 2.3.0 is out with massive leap in performance, generics improvements, detecting unused variables, improved closure type inference, inferring static variable types from assignments, and engine rewrite!
1
2
71
Replying to @OndrejMirtes
Just benchmarked before / after and upgraded. Thanks for the speed improvements!
2
3
268
🚀 #PHPStan 2.3.0 is out and up to 7.5× faster than ten months ago. Analysing the #WordPress codebase dropped from 60.5s in December 2025 to 7.9s on an M1 Pro MacBook #PHP #staticanalysis #opensource ⚡ PHPStan Turbo reimplements hot parts of the analyser in #Cpp, forks workers instead of spawning them and registers an #OPcache optimizer pass that strips runtime type checks. Turbo now makes PHPStan almost 60% faster. The .so/.dll files ship inside the #Composer package and are enabled automatically 💾 Warm result cache on #Drupal: no changes 1.6s, 10 changed files 2.8s, 10% of the project 6.2s, full run 22s. Composer dependency updates and #Symfony DI container changes no longer wipe the whole cache. New extension APIs let custom extensions describe precisely which files to invalidate. Monorepos with Composer path repositories and scanDirectories/scanFiles setups are now handled properly 🧬 Generics: bidirectional type narrowing analyses code around new Collection(...) multiple times and infers the template type from how the object is used. Scalars are no longer generalized (1 stays 1, not int). Closes 17 issues at a 1-3% performance cost. Funded by the #SovereignTechFund 🔍 Unused variable detection with five core rules: variable.unused, assign.unused, assign.overwritten, assign.redundant and the data-flow based assign.unusedFlow. It also covers array offsets never read, foreach keys and values, ++/-- results, catch variables, closure use variables and unused parameters of functions and private methods 🧠 The same engine infers closure types from usages without any PHPDocs, including by-reference variables, and infers static variable types from assignments instead of falling back to mixed 🏗️ Under the hood: a single-pass inside-out engine rewrite replaces three separate AST traversals. Code like $a = [$b = 1, $b + 1] now infers as array{1, 2}. Extension APIs stay compatible; the new features require bleeding edge 🔌 Released alongside: phpstan-strict-rules, phpstan-symfony and phpstan-phpunit 2.1.0 🌐 phpstan.org/blog/phpstan-2-3…
1
1
109
Tried PHPStan 2.3.0 on our Laravel 13 project: cold analysis dropped from 40.86s to 17.88s with Turbo enabled — 2.29× faster! Same code/config, up to 6 workers. Thanks for the release! ** switched PHP 8.4 ZTS → NTS to enable Turbo. Warm cache: ~1.6s in both.
PHPStan 2.3.0 is out with massive leap in performance, generics improvements, detecting unused variables, improved closure type inference, inferring static variable types from assignments, and engine rewrite!
2
4
1
11
859