PHP ecosystem sees major security release and key contributor shift to VR startup

The PHP development team released PHP 8.6.0 alpha 3, alongside coordinated security patches for the active 8.5 branch (8.5.9) and the maintenance‑mode 8.2 branch (8.2.33). The updates fix a stack‑based out‑of‑bounds write in ext/bcmath, a PostgreSQL SQL‑injection flaw, a Phar circular‑symlink crash, and a libgd vulnerability, while adding new features such as partial function application, a clamp() function, and TAILCALL VM support on Windows.

In parallel, longtime PHP contributor Laruence announced he will step back from active PHP open‑source work to devote his effort to Realsee, a VR‑based 3‑D reconstruction platform built within Beike. After years of work on PHP performance (LLVM, PHP 7, PHP 8 JIT) and related extensions (Yaf, Yar, Yaconf), he now leads a team of over 200 engineers delivering large‑scale digital‑space services for millions of properties, aiming to expand the platform beyond real‑estate into broader digital‑twin applications.