Practical PHP, Laravel, devops, and AI-assisted workflow notes from Md Zia Uddin.
mongodb/laravel-mongodb 5.11.0 tagged 10 Sep 2026 for CVE-2026-88022. A 3-arg where('=', $array) is now a literal $eq. I would run composer show and composer audit --locked before I claim I am patched. This is not a Laravel core CVE.
Sep 25, 2026 · 8 min read
13.31 adds Queue::totalSize() so I stop adding pending + delayed + reserved by hand, and a JobInterrupted event that only fires when an Interruptible job is actually in handle(). SQS still returns 0. An idle SIGTERM is still WorkerInterrupted. I would run composer show laravel/framework before I claim either.
Sep 23, 2026 · 9 min read
I wanted a self-hosted BaaS with Postgres instead of another Firebase bill. Appwrite 2.0’s installer came up on :20080. localhost was the VPS, not my laptop, and a 2 GB droplet OOM’d before Console IV loaded. Wizard hostname matching Traefik Host, 4 GB RAM plus swap, then close 20080 — that is the lab path.
Sep 14, 2026 · 12 min read
PHP 8.6.0beta3 tagged 10 Sep 2026. GA is still scheduled 19 Nov. I would not put beta FPM on a VPS. I would run the official CLI container, try clamp() and ? placeholders, and leave Laravel 13 on 8.5.
Sep 11, 2026 · 8 min read
No spam. One short email per new article — practical PHP, Laravel, devops, and AI-assisted workflows.
On 13.29, Storage::get('../../../.env') already threw. Storage::path() of the same string still concatenated past the disk root. 13.30 runs path() through Flysystem's WhitespacePathNormalizer. I would bump composer show laravel/framework before I trust a query-string download again.
Sep 9, 2026 · 9 min read
PHP 8.5.0 shipped 20 Nov 2025; 8.5.10 is the latest I can cite (27 Aug 2026). I would not start with the pipe operator. I would make php-fpm match php -v, stop calling array_first() like a Laravel helper, and only then touch clone-with and Uri\Rfc3986\Uri.
Sep 4, 2026 · 8 min read
I wanted a photo instance I actually own. Pixelfed is Laravel 12, and the homepage never tells you that Composer will OOM a 1GB VPS or that feeds stay empty until Horizon is a systemd service. Redis, Intervention Image, and Flysystem are the packages that decide whether the box is useful.
Sep 1, 2026 · 12 min read
Why I'm starting a blog on nzian.xyz, how it's built (Markdown + PHP rendering, file cache, content stored outside the web root), and what to expect next.
Apr 26, 2026 · 2 min read