Engineer having fun. CTO of https://xitter.cf/t.co/gAvCQCcNHM. Lead of Yii framework. Member of PHP-FIG. Organizer of IT conferences. Coffee enthusiast.
Earth
Joined November 2008
- Tweets10.2K
- Following631
- Followers5.3K
- Likes1.6K
Pinned Tweet
Will solve complicated problems of virtually any level: tracking stolen money in blockhains, selecting database engine for specific needs, troubleshooting, making systems stable, improving performance, scaling systems, audit etc. High rates.
Alexander Makarov retweeted
We have posted more information about today's security releases, including the sequence of events that led to the discovery, how the PHP security team is improving their processes, and what we need from you to continue this critical work. #php #security thephp.foundation/blog/2026/…
A story behind #PHP vulnerabilities from reporter: calif.io/php2shell/
I love Hugo, ran a blog on it for some time, and it inspired me to create YiiPress. I wanted "templates in PHP" but also "can I make it faster in PHP?"
Finally benchmarked it properly. The answer is "yes, it is faster."
yiipress.yiiframework.com/
Alexander Makarov retweeted
PDO::prepare() does not prepare anything on the server by default in #PHP. 🔐
mysql_driver.c sets H->buffered = H->emulate_prepare = 1. PDO builds the final SQL itself, client side, and sends ONE query.
That isn't automatically a hole: the emulation escapes according to the connection charset.
That's why charset=utf8mb4 in the DSN is a security setting, not a cosmetic one.
ALT One line of C from php-src ext/pdo_mysql/mysql_driver.c showing that buffered mode and prepared statement emulation are both enabled by default.
Alexander Makarov retweeted
We've got a new website: yiiframework.com/. Enjoy!
🎁 samdark/sitemap 3.1.0. Unlike other sitemap packages, this one is memory-efficient and fast.
This release adds support for image sitemaps.
github.com/samdark/sitemap
Alexander Makarov retweeted
In case you missed it, we launched our first State of PHP survey together with @phpstorm (a JetBrains IDE.) This initiative aims to build a clearer picture of today’s PHP ecosystem. Take the survey and help us map the herd! 👉 thephp.foundation/blog/2026/… #phpcommunity #stateofphp
Alexander Makarov retweeted
The X link-removal RFC didn't pass 🙌
So I updated the Social Media Policy RFC and it's open for feedback: github.com/php/policies/pull…
Alexander Makarov retweeted
The @ThePHPF Survey for 2026 is on: take a moment to ask yourself important #PHP questions, and contribute your observation with the community and the fundation.
thephp.foundation/blog/2026/…
Alexander Makarov retweeted
20 years. One project. Zero signs of stopping. 🔥
@fabpot is live at #PHPverse 2026, and he’s about to reveal the real secrets behind sustaining @symfony.
This is required watching for every OSS maintainer 👉
bit.ly/4eusH4C
Alexander Makarov retweeted
We've got a new demo for Yii3 which is local LLM-powered document summarizer: reddit.com/r/PHP/comments/1t… #yii
Alexander Makarov retweeted
Timing attacks are real, and most devs don't protect against them.
When you compare two strings with === or strcmp(), #PHP stops at the first different byte. If the first character matches, it takes slightly longer than if it doesn't.
An attacker can measure response times to guess a secret character by character. HMAC token, API key, CSRF token... byte by byte, statistically.
hash_equals() was added in PHP 5.6 specifically for this. It always compares ALL bytes, regardless of where the first mismatch is. Constant time.
Same applies to #golang: use crypto/subtle.ConstantTimeCompare().
Same in #nodejs: crypto.timingSafeEqual().
If you're comparing secrets with == or ===, you may be leaking information through time!
Alexander Makarov retweeted
🎁 Yii2 HTTP Client 2.0.17 is out.
This release focuses on compatibility, stability, and maintenance for the Yii2 HTTP client extension.
What changed:
• Fixed a `stream_get_contents()` TypeError when PHP error reporting is turned off.
• Fixed PHP 8.5 deprecation around the predefined `$http_response_header` variable.
• Fixed `curl_close()` and `curl_multi_close()` deprecations in PHP 8.5.
• Improved PHPDoc annotations for response status code handling.
• Added full HTTP status line details to `Message::getHeaders()` / `Client::getHeaders()`.
• Applied Yii2 coding standards.
• Raised the minimum PHP version to 7.4.
A small but important maintenance release to keep Yii2 HTTP Client reliable across modern PHP versions.
github.com/yiisoft/yii2-http…
Finished two big migration guides today for Yii3 docs:
- yiisoft.github.io/docs/guide…
- yiisoft.github.io/docs/guide…
Straight migration is, of course, not possible since it is a different framework but I was able to cover many nuances. If something is missing or not clear — let me know.
Alexander Makarov retweeted
Introducing CTOR: #PHPStan extension package to catch fake optional setters ↓
tomasvotruba.com/blog/introd…
Useful for both legacy and modern codebases to improve latent object design.
Alexander Makarov retweeted
🎁 Yii 2.0.55 is released
Yii Framework 2.0.55 is here with an important security fix for CVE-2026-39850, plus continued PHPStan/Psalm, PHPDoc, and type annotation improvements.
Upgrade instructions:
yiiframework.com/download/
Alexander Makarov retweeted
Lately I've been working on integrating #Testo #PHP with @infection_php
There's still more ahead, but in the meantime you can read my fresh article about mutation testing
php-testo.github.io/docs/the…
During preps for a talk got ~20K RPS with #yii 3 and #frankenphp for session-enabled app and ~30K for session-less one. Single server.