Do you need help with #PHPStan in some form?
I have plenty of experience in contributing changes to PHPStan core, or implementing custom extensions.
staabm.github.io/2024/01/01/…
plz RT
markus staab | @[email protected] retweeted
markus staab | @[email protected] retweeted
If all the govs shutting down servers for a PHP update, all the hosters & enterprises terrified by the vuln, gave $100k, or just $50k a year to the PHP Foundation, things could look very differently. Go, make your employer sponsor *today* thephp.foundation/sponsor/ #php #phpc @ThePHPF
markus staab | @[email protected] retweeted
We're excited to welcome @sentry to our sponsor program as part of their investment in open source infrastructure! We rely on responsible businesses like @sentry to maintain and operate the infrastructure behind the PHP ecosystem. Join them: packagist.org/sponsor/
markus staab | @[email protected] retweeted
The #php2shell panic got the severity right and most of the details wrong. It's a 9.2, not a 10.0, and the session.upload_progress flag you were told to switch off belongs to the other CVE. I went through the rumors against the advisory and the diff: daubois.dev/blog/cve-2026-10…
markus staab | @[email protected] retweeted
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.
PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
anyone using the #composer/#xdebug-handler and want to give this PR a try?
the idea/question is, whether/when pcntl_exec is more efficient than running/wiring up a subprocess
would be great this could be tested in more applications
github.com/composer/xdebug-h…
#phpstan 2.3.x added new dependency tracking APIs which allow custom extensions/rules to declare values/files they depend on.
todays #phpstandba 0.5 release uses the new APIs, which allows us to re-analyze only code depending on the database schema when it changes.
markus staab | @[email protected] retweeted
markus staab | @[email protected] retweeted
I wanted to stop controllers calling external services, however deep in the call graph.
So I built a PHPStan extension: mark external calls as 'slow', forbid 'slow' in controllers, and let it flag violations. Probably has many other uses too.
github.com/DaveLiddament/php…
markus staab | @[email protected] retweeted
Same performance, smaller package
PHPStan 2.3.0 was chonky! It weighed 104 MB when downloaded and 268 MB after being unzipped in your vendor/.
I just released PHPStan 2.3.1 that weighs just under 28 MB when downloaded and 87 MB unzipped. While preserving all the Turbo binaries.
markus staab | @[email protected] retweeted
PHPStan analysing the WordPress codebase took 60.51 seconds back in december.
With PHPStan 2.3 + Turbo: 7.93 seconds.
That’s the kind of dev improvement I get excited about💪
markus staab | @[email protected] retweeted
Replying to @OndrejMirtes
PHPStan 2.3.0 made our PHP Quality run’s analysis step 66% faster, dropping from 3m42s to 1m16s — roughly 3× faster.
That’s the PHPStan step in hosted CI on PHP 8.4, comparing versions 2.2.6 and 2.3.0
New run
github.com/capell-app/capell…
2.2.6 baseline
github.com/capell-app/capell…
markus staab | @[email protected] retweeted
Great to see WordPress being used as an example of the huge performance improvements in the PHPStan 2.3.0 release: where it used to take 60 seconds to analyze the entire codebase uncached, now it takes just 8 seconds! – at Portland, OR
New release: PHPStan 2.3.0 github.com/phpstan/phpstan/r… #phpstan
markus staab | @[email protected] retweeted
after upgrade to phpstan 2.3.0
· repo timings: 112.35s → 76.04s
· 32.3% faster
markus staab | @[email protected] retweeted
Replying to @OndrejMirtes
Just benchmarked before / after and upgraded. Thanks for the speed improvements!
markus staab | @[email protected] retweeted
🚀 #PHPStan 2.3.0 is out and up to 7.5× faster than ten months ago. Analysing the #WordPress codebase dropped from 60.5s in December 2025 to 7.9s on an M1 Pro MacBook #PHP #staticanalysis #opensource
⚡ PHPStan Turbo reimplements hot parts of the analyser in #Cpp, forks workers instead of spawning them and registers an #OPcache optimizer pass that strips runtime type checks. Turbo now makes PHPStan almost 60% faster. The .so/.dll files ship inside the #Composer package and are enabled automatically
💾 Warm result cache on #Drupal: no changes 1.6s, 10 changed files 2.8s, 10% of the project 6.2s, full run 22s. Composer dependency updates and #Symfony DI container changes no longer wipe the whole cache. New extension APIs let custom extensions describe precisely which files to invalidate. Monorepos with Composer path repositories and scanDirectories/scanFiles setups are now handled properly
🧬 Generics: bidirectional type narrowing analyses code around new Collection(...) multiple times and infers the template type from how the object is used. Scalars are no longer generalized (1 stays 1, not int). Closes 17 issues at a 1-3% performance cost. Funded by the #SovereignTechFund
🔍 Unused variable detection with five core rules: variable.unused, assign.unused, assign.overwritten, assign.redundant and the data-flow based assign.unusedFlow. It also covers array offsets never read, foreach keys and values, ++/-- results, catch variables, closure use variables and unused parameters of functions and private methods
🧠 The same engine infers closure types from usages without any PHPDocs, including by-reference variables, and infers static variable types from assignments instead of falling back to mixed
🏗️ Under the hood: a single-pass inside-out engine rewrite replaces three separate AST traversals. Code like $a = [$b = 1, $b + 1] now infers as array{1, 2}. Extension APIs stay compatible; the new features require bleeding edge
🔌 Released alongside: phpstan-strict-rules, phpstan-symfony and phpstan-phpunit 2.1.0
🌐 phpstan.org/blog/phpstan-2-3…
markus staab | @[email protected] retweeted
Tried PHPStan 2.3.0 on our Laravel 13 project: cold analysis dropped from 40.86s to 17.88s with Turbo enabled — 2.29× faster! Same code/config, up to 6 workers.
Thanks for the release!
** switched PHP 8.4 ZTS → NTS to enable Turbo. Warm cache: ~1.6s in both.



















