PHP Foundation Q2 2026: URI Builders, Raw Sockets, and a Leaner zval

On July 21, Executive Director Elizabeth Barron published the PHP Foundation’s first Quarterly Progress Report, a new format meant to make the day-to-day work of the Foundation’s thirteen core contractors visible instead of scattered across changelogs and mailing list threads. It is not a complete list of everything that shipped, but a high-level summary of the most impactful work from a team spread across eight countries. For a working PHP developer, it is also one of the better single documents for understanding what is actually coming down the pipe toward PHP 8.6 and beyond.

A few items in the report are worth more than a passing skim.

ext/uri gets a way to build, not just parse

PHP 8.5 shipped the URL Parsing API with Uri\Rfc3986\Uri and Uri\WhatWg\Url, but reading a URI apart is only half the job. Máté Kocsis’s Followup Improvements for ext/uri RFC was accepted for PHP 8.6, and the Foundation reports most of it is already implemented. The headline addition is a Builder-pattern API for constructing URIs from parts instead of string concatenation, alongside dedicated classes for path segments and host/URI type detection.

The companion piece is a still-under-discussion RFC, Query Parameter Manipulation Support, also authored by Kocsis. It proposes a Uri\QueryParams class as a real alternative to $_GET and the aging parse_str() / http_build_query() pair, with explicit support for RFC 1866, RFC 3986, and WHATWG parsing rules:

$uri = new Uri\Rfc3986\Uri('https://api.example.com/search?tag=php&tag=laravel');

$params = $uri->getQueryParams();

echo $params->getAll('tag')[0];   // "php"
$params->append('tag', 'symfony');
$params->delete('page');

$uri = $uri->withQuery($params->toRfc3986String());

Nothing here is voted in yet; per the Foundation’s report, voting on the query parameters RFC should open next quarter. But it is worth watching if you have ever hand-rolled query string manipulation to avoid parse_str()’s dot-and-space mangling of array keys.

Native raw sockets close a real gap with Go and Rust

David Carlier landed AF_PACKET raw buffer support in ext/sockets, letting PHP read and write raw Linux packet sockets directly. Previously, doing anything at that level from PHP meant shelling out to a compiled tool or reaching for FFI against libpcap. Now it is a native extension call:

$socket = socket_create(AF_PACKET, SOCK_RAW, htons(0x0003));
socket_bind($socket, ['sll_ifindex' => if_nametoindex('eth0')]);

while (true) {
    $bytes = socket_recvfrom($socket, $buffer, 65536, 0, $from);
    // inspect raw ethernet frame in $buffer
}

This is not a feature most web applications will ever touch, and that is by design: opening an AF_PACKET socket requires CAP_NET_RAW or root, the same privilege every other language requires for packet capture and injection. It does not widen PHP’s attack surface for ordinary code. What it does is make PHP usable for network tooling, monitoring agents, and packet inspection utilities that previously had no reason to consider it.

An early, honest experiment: shrinking zval

Ilija Tovilo, alongside ongoing security triage work, has started experimenting with an 8-byte zval representation. zval is the container the Zend Engine uses to hold every PHP value, so its size affects memory footprint and cache behavior across the entire engine. The Foundation’s report is careful to frame this as “very early stages of experimentation,” not a roadmap item, and there is no RFC or target version attached to it yet. It is the kind of change that, if it goes anywhere, would take years to land. Worth knowing about, not worth planning around.

PIE 1.5 is closing the gap with Composer

The PHP Installer for Extensions is heading toward a 1.5 release with several quality-of-life features James Titcumb’s team has been building against Composer’s own interaction model. The batch of changes includes installing multiple extensions in one command, a --select flag for unattended installs in CI, making a re-install of an already-installed extension a no-op instead of an error, and a new lockfile-driven install path:

pie install --from-lock

That last one matters for anyone trying to make PHP extension installs reproducible across environments the way composer install --no-dev already is for userland dependencies. PIE has also picked up support for some of the old PECL placeholder replacements, which should ease migration for projects still leaning on documentation or scripts written against the PECL era.

The Ecosystem Security Team’s numbers, updated

Volker Dusch’s Ecosystem Security Team, funded by an Alpha-Omega grant, has now scanned over 500 of the most-used Composer packages and nearly every major framework, sharing more than 100 fixes directly with maintainers. That is up from the roughly 300 packages reported in the team’s one-month update in June. If you maintain a widely-used package and have not heard from the team, the invitation to reach out for a specific security review still stands, and applies to any project with a real security need, not just the largest ones.

Governance moves that matter more than they sound

The report also covers what Barron and Director of Fundraising Ben Marks have been doing outside the codebase: a PHP Ambassador program, quarterly Advisory Board meetings, a State of PHP Survey, a revived monthly newsletter, and published minutes from Governing Board meetings on GitHub. None of this ships a feature, but a Foundation that publishes its board minutes and reports contractor-by-contractor progress is a different kind of organization than one that communicates through release notes alone. Worth noting since the Foundation runs largely on sponsorship and individual donations, and transparency is what makes that funding model sustainable.

Why this report format is worth watching

The Foundation’s stated plan is to keep publishing these quarterly, one contractor at a time. For a language that has occasionally been criticized for opaque decision-making, a running record of “here is what our thirteen paid contractors actually worked on this quarter” is a meaningfully different level of visibility than PHP has had in the past. If you want a rhythm for tracking PHP internals without following the internals mailing list day to day, bookmarking the Foundation’s blog and checking in each quarter is now a reasonable substitute.