Software Development, Testing & Open Source

Sebastian Bergmann, in a yellow T-shirt with a lapel microphone, sits at a long wooden table and explains something with one hand raised. In the foreground, two people sit with their backs to the camera: on the left, Ines Chargui, with long dark hair and a green knitted jumper, sits in front of an open laptop; on the right, someone in a black hoodie printed with “TEAM entwickler.de” films the interview with a smartphone on a gimbal, its screen showing Sebastian. In the background, a floor lamp with a black shade and a low shelf with magazines and silver vases stand in front of a backlit wall.

29 October 2026

Unverified

An interview at the International PHP Conference about Composer's new security behaviour, PHP2Shell, supply-chain security, and LLM-based tools.

A hand pours water from a glass jug into a white flowerpot on a windowsill. The plant in it has long since withered: its leaves are black and curled, its bare stems hang over the rim of the pot, and fallen leaves lie on the sill. Bright light falls through the window from behind. A visual metaphor for code that no longer has any effect and is still being looked after.

28 October 2026

Dead code still gets maintained

A few lines in PHPUnit's Test Runner had no effect after April 2023. For three and a half years I reformatted them, renamed things in them and hardened them for static analysis anyway. PHPStan 2.3 found them, and even then only some of them.

The silhouette of a person with a backpack climbing a rocky crest, lit from behind. One hand rests on the rock ahead, one leg has already followed, and the next hold is within reach. Conifers stand in the haze all around, the sun breaks over a ridge at the top right, and a warm veil lies over the whole scene. An image for a climb that consists of individual holds, every one of which is manageable on its own.

27 October 2026

Upgrading PHPUnit should be boring

Whoever upgrades in February is done by the afternoon. Whoever is three majors behind needs a project for it. The difference is not the upgrade but the year before it: the order you work in, and which of PHPUnit's two deprecation lists you read along the way.

This image shows an old, grimy pressure gauge in the foreground of a machine room. Its black needle stands between five and six bar, in the middle of the section of the scale marked in red. Blurred pipes, valves and further gauges in red and blue light fill the background. The imagery captures the essence of the article: the problem sat in the red zone for a long time, and whether the system holds depends on the few people who maintain it.

22 October 2026

Hate does not fix vulnerabilities

The PHP releases of 21 October 2026 fix two critical vulnerabilities, and you should update now. The PHP Foundation itself calls the time the fix took a structural failure, one that was also caused by a lack of resources. The hate now being poured over PHP changes nothing about that; broader funding would.

This image shows an open hand holding a classic pocket compass with its lid flipped open. In the background, a hilly landscape with a path winding through it blurs into the warm light of a low sun. The imagery captures the essence of the article: the CRAP index is a trusted old instrument that, like a compass, points the way. It shows you where to start, but it does not grade the quality of your work.

21 October 2026

Nineteen years of CRAP

The CRAP index has been in PHPUnit's code coverage report since 2007; experimental then, unvalidated still. Why I ship it anyway, and why it must never become a target.

Two swing-top glass jars with rubber seals, filled with preserved pear halves and cloves, stand on a pale blue wooden table. In front of them lie a pear cut in half and star anise, behind them fresh green pears. A visual metaphor for an archive: preserved, closed, and trustworthy only as long as its seal can be checked.

20 October 2026

Laying the past to rest

In 2019, after the break-in at pear.php.net, we suggested that PEAR needed a plan for its retirement. Seven years later, an RFC provides one. What it gets right, and why a frozen archive is not yet a safe one.

Windfall apples in the grass beneath an apple tree, photographed in the warm light of a low sun. The trunk and its shadow are visible at the top of the frame, with red apples covering the ground densely in front of it, many of them bruised. The imagery picks up the metaphor Marco Pivetta uses for mutation testing: shaking the tree does not tell you how much it bears, but which fruit no longer held.

14 October 2026

Where tests end and types begin

In April 2022, I spent two hours talking about mutation testing with Marco Pivetta and Stefan Priebsch. The recording recently resurfaced. What of it has survived four years?

In a dark room, a hand holds a small ultraviolet torch over a printed form titled CREDIT NOTE. Where the beam falls on one of its fields, a handwritten line appears that the form does not show in ordinary light: I am invisible. More sheets with printed charts lie around it on the desk, barely visible in the blue light.

8 October 2026

Your tool has a new reader

Every PHP tool that prints to a terminal now has two readers, and most of us have only been writing for one of them.

This image shows a close-up of a light-coloured tailor's measuring tape piled up in loose loops and coils against a warm, blurred background. The numbers and scale marks are only sharp in places. The imagery communicates the essence of Goodhart's Law: a measuring instrument tangled up in itself no longer measures anything. When the metric becomes the target, measurement loses its direction and its purpose.

7 October 2026

When the metric becomes the target

Goodhart's Law states that a metric ceases to be a good metric as soon as it becomes a target. What this means for code coverage and why tools alone cannot solve the problem.

Close-up of a red fire extinguisher's valve: the pressure gauge needle sits in the green zone, a yellow plastic seal secures the safety pin, and a yellow tag hangs from the neck. The tag has fields for model number and manufacturer, owner ID, and a monthly inspection record with columns for date, inspector, and comments. Every field is still blank. A visual metaphor for a component record: the form exists, but it only proves something once someone fills it in.

5 October 2026

What ISO/IEC 18974 asks of your composer.lock

ISO/IEC 18974 describes what an open source security assurance program has to prove. Composer already produces much of that evidence as a by-product of every build. What it does not produce: an archive, a second look at software that has already shipped, and a name next to every responsibility.

The key board of a hotel reception, made of dark wood and divided into two rows of narrow compartments. An oval brass plate with a room number sits above each compartment, and below it a hook holds a heavy brass fob with the matching key. A few hooks are empty because their keys are out. A visual metaphor for a number that has exactly one place, leaving nowhere for a second key under the same number to hang.

30 September 2026

One version per process

Andrew Nesbitt explains the size of npm dependency trees with the resolver. In PHP, the resolver is ultimately the engine itself: one name, one definition, one version per process. That is why PHP trees stay small, and why PHPUnit's PHAR has to rename its dependencies.

A person's hands at a workbench: one holds a brass pipe fitting, the other writes on a clipboard with a red pencil, and more fittings stand on the table. A symbol of verification: to know whether a part is right, someone has to examine it and write down what they observed.

23 September 2026

When the diff is free

Symfony Language Tools no longer accepts pull requests, and most Laravel packages no longer accept issues. Both decisions rest on the same premise: the diff has become cheap. What remains scarce is an understanding of the problem, and the contribution that carries it best is a failing test.

A person's hands tying a bowline knot in a sailing rope, the water below. A symbol of verification: trust in a knot is not inherited from whoever tied it, it is earned by tying and checking it yourself.

16 September 2026

Confidence is not transferable

After my experiment with AI-generated code, I came across three observations: organisational, individual, and generational. Together they point to an uncomfortable conclusion, and to the skill that will matter most in the AI era.

Two people running on the red track of a stadium, seen from above, staggered in adjacent lanes. The low sun stretches their shadows far across the surface, and the white lane markings run through the picture at identical spacing. A symbol of running the same course under identical conditions again and again until the pattern becomes visible.

9 September 2026

Repetition and Insight: What is new in PHPUnit 13.3?

Reliably detecting flaky tests and tolerating them in a controlled way, code coverage through the lens of your classes, branch and path coverage made visible, and a filter by test size: I walk you through what is new in PHPUnit 13.3.

A desire path runs across a lawn in a park. It is barely a shoe's width across, the grass along its edges trodden flat, the soil in the middle bare. It does not run straight: it curves gently up the slope and disappears between the bushes at the top. Nobody planned this route; it exists because everyone took it. A tracing JIT decides which code to compile in the same way.

2 September 2026

How PHP generates machine code

The JIT is not switched on in any default installation. Switching it on is a bet that the compiled code runs long enough to earn the compilation back. On a test suite of 177 tests the function JIT loses that bet, and the tracing JIT wins it.

The flag of the European Union and the German national flag flying side by side in front of the Reichstag building in Berlin.

2 September 2026

Digital sovereignty is written in PHP

Germany is spending €108 million to move its federal websites onto a PHP application; in 2025, The PHP Foundation received $730,534 in funding.

Sebastian Bergmann walks onto a stage through green and blue smoke, one hand raised in greeting, in front of a large screen that reads SEBASTIAN BERGMANN, CREATOR OF PHPUNIT next to a portrait of him.

27 August 2026

Succession, release cycle, and 26 years of PHPUnit

AFUP asked me what happens to PHPUnit if I stop, why there has been a new major version every year since 2017, and where I learned to think about testing.

Two hands guiding a hand plane along a light-coloured board. A shaving runs out of the plane, a second one curls up on the wood in front of the blade. A heap of shavings lies below the board. The board itself is smooth and shows its grain; nothing has been added to it.

26 August 2026

How PHP optimises bytecode

OPcache is called a cache, but it does more than keep bytecode around: fifteen passes sit between the compiler and the executor and rebuild it. I watch them at work and measure how much of it survives into the run time.

The approach to a station, backlit by a low sun. Dozens of rails branch apart over points and merge again, the railheads glowing gold. A railcar waits in the background under a dense web of overhead wires. A visual metaphor for the central question of every interpreter: how does execution get from one instruction to the next as quickly as possible?

19 August 2026

How PHP executes bytecode

Which compiler built your PHP binary is a performance decision: until PHP 8.5, a PHP built with Clang was up to 44 % slower than one built with GCC, depending on the benchmark. The difference is entirely in how the executor gets from one instruction to the next, and the Zend Engine has five models for that.

A worn metal checklist card hangs in the cockpit of an aircraft in front of dimly glowing flight instruments. The card is engraved with a list titled BEFORE TAKEOFF, whose items read Flight Controls CHECKED, Takeoff Briefing REVIEWED and Cabin SECURE, followed by a dashed line reading CLEARED FOR TAKEOFF and the beginning of an AFTER TAKEOFF section.

19 August 2026

So you received a security report. Now what?

A guide for PHP project maintainers, from the PHP Foundation Ecosystem Security Team.

This image shows the bolted corner joint of a yellow steel frame, photographed from below against a blue sky with a few clouds. Two beams meet at a right angle above an upright column, held by four blue bolts. The structure continues past the edge of the frame in both directions. The imagery captures the essence of the article: the joint is not what anyone looks at, and everything built above it depends on whether it holds.

17 August 2026

A language has non-functional requirements, too

Nobody decides whether a language is modern. What gets decided is whether you can bet a decade on it: who owns it, how upgrades arrive, how it scales, and whether you can still hire for it in year six. This article holds PHP to the criteria an architecture decision is actually made on.

This image shows five wooden cubes with black stars on a light blue background. Four cubes already sit neatly in a row, while a hand is only just setting down the fifth: still tilted, not quite in line with the others. The imagery captures the essence of the article: PHP has four of the five points safely in hand, and the fifth is within reach.

12 August 2026

Four out of five

How does PHP in 2026 compare with the current ideas about designing modern languages? This article takes stock of the criteria of closures, objects, pattern matching, generics, and an unconventional answer to the question of extensibility.

A sealed shipping box is handed across a counter, along with a clipboard holding a form. A packing note listing the enclosed items with quantities and prices is affixed to the box. A visual metaphor for a bill of materials that is created while packing and ships with the package instead of being guessed at afterwards.

5 August 2026

Your composer.lock knows what a carmaker only guesses

A car manufacturer lists an Android botnet in its open source attribution. The entry gives away how the list was made: by scanning instead of by declaring. Why a declared dependency list is worth more than a scanned one, and how the PHPUnit PHAR discloses its own contents.

A hand presses the red emergency stop button of an industrial machine. A visual metaphor for a switch that halts the execution of code: exactly what zend.disable_eval does for eval().

29 July 2026

When static analysis runs your code

A security vulnerability in PHPCSUtils revealed an eval() call in a static analysis tool. Why disable_functions cannot reach eval(), and what a switch in the PHP engine to disable it could look like.

An unbroken red wax seal on an envelope. A visual metaphor for untouched tests: as long as the seal is intact, the contents are provably undisturbed.

22 July 2026

Untouched tests are half the proof

My favourite kind of bug fix only adds a new regression test and leaves every existing test untouched. I checked this claim against PHPUnit's own history: I learned the most from the counterexamples.

A heavy steel chain lies on a dark surface. Where a link is missing, a thin knotted orange rope ties the two ends together. A visual metaphor for a supply chain whose strength is decided by its weakest link.

15 July 2026

Composer and Packagist under supply chain stress

2025 and 2026 proved to be a stress test for the supply chains of all package ecosystems. A review of Composer and Packagist: what PHP does well, what it can learn — and who owns our infrastructure.

A solitary figure in a vast concrete corridor lined with massive columns. Bright light streams through tall windows, creating sharp shadows across the empty floor. The scale dwarfs the person, visually representing the weight of institutional systems that constrain individual agency.

8 July 2026

Stories about systems that resist people

Five of the best television series I have ever seen are about the gap between what people want to achieve and what institutions allow them. They fascinate me because, after decades of developing Open Source software, I know much of this from my own working life.

A hand holds a camera lens up against a deep blue background, its rear glass element and electrical contacts facing the viewer. A symbol of reaching for a precision instrument and choosing exactly where to point it.

1 July 2026

Precision and Clarity: What is new in PHPUnit 13.2?

Selecting exactly the tests you want, finer control over the order they run in, faster and clearer output when they fail, and more expressive test doubles: I walk you through what is new in PHPUnit 13.2.

Aerial view of a winding blue river meandering through dense green forested mountain terrain, with several smaller tributary streams flowing into the main river.

24 June 2026

Merging code coverage data

Merging code coverage data from parallel CI jobs has long been fragile and error-prone. These problems are finally solved.

A glowing cockpit instrument panel in deep blue light, its dials, throttle levers, and backlit gauges tracing speed and status: a metaphor for reading the telemetry your test suite records on every run.

17 June 2026

What your test run already knows

On every run, PHPUnit knows how long each test took, how much memory it used, and why it failed. Most of that evaporates. otr-report reads it back out of the Open Test Reporting logfile and puts it within reach.

A mechanical stopwatch lies on a weathered wooden surface, waiting to be started. It symbolises how the duration of a test run has become a measurable factor that determines more than just developer convenience.

12 June 2026

Speed as a security feature

How fast is your test suite, and what vulnerabilities does an LLM agent therefore fail to detect? What was long considered a productivity issue is now part of the security debate.

An astronaut in a detailed white spacesuit rides a small cyan-glowing rocket through deep, star-speckled space, leaning forward as a brilliant orange flame and a billowing trail of glowing exhaust streak out behind, with a single bright star shining in the upper right: a metaphor for taking a sluggish test suite and propelling it to blazing speed.

11 June 2026

Turbo-Charging Your PHPUnit Suite

Slow tests destroy flow, kill TDD, and erode trust until nobody runs the suite. The fix has four tiers, and the biggest wins come from test design, not from infrastructure or parallelisation.

A young man in jeans and a white long-sleeved shirt, rendered in black and white, swings a large green shield emblazoned with a bright red checkmark, batting away a flurry of crumpled paper balls against a soft peach background – a metaphor for using tests as an active defence that knocks out security weaknesses before they can reach production.

10 June 2026

Test-Driven Security

For every vulnerability we find in production, there is a test that, had it existed, would have prevented it. Test-Driven Security treats the CWE list as a checklist and PHPUnit as the tool we already have in our workflow.

The illustration shows a programmer in a dark office in front of a laptop. Like an investigator, he searches for clues on a pinboard full of photos, notes and red threads – an emotional introduction that picks up on the familiar feeling of bug hunting. The accompanying text explains how to design software so that debugging does not have to feel like criminal investigation work.

3 June 2026

Debugging as a design goal

Why do some bugs feel like a short detective story, while others feel like a never-ending thriller? I show you which decisions make your software debuggable.

A simple wooden bridge crosses a flowing stream in a straight line, leading into a green forest. A symbol of the fact that the simplest solution is often the most effective.

27 May 2026

Code I do not have does not cause any problems

Not every problem requires new code. And every line we do not write is a line that will not cause any problems.

Only what must exist has a door. The safest door is the one that was never built.

20 May 2026

The attack surface begins in the repository

We protect what exists. But do we ask often enough whether it should exist at all? How removing unused branches can protect against Poisoned Pipeline Execution.

A heavy steel chain breaks at its central link in a burst of red-orange sparks, with fragments of binary digits scattering outward against a deep blue, circuit-lit background. A visual metaphor for the supply-chain security failure that workflow hardening is meant to prevent.

17 May 2026

Hardening GitHub Actions workflows

A walk through the GitHub Actions weaknesses in PHPUnit's workflows, how each one could have been exploited, and what was changed to close them.

13 May 2026

ComoCamp 2026

Three days in Vienna, three days of ComoCamp: my report on inspiring workshops, exciting open space sessions, and the uniquely open, collaborative atmosphere.

A telescope on a tripod stands silhouetted against a clear starry sky. A symbol of how the right tools sharpen our view of what matters.

6 May 2026

Closures, Clarity, and Control: What is New in PHPUnit 13.1?

Closures as data providers, richer Open Test Reporting, custom issue trigger resolvers, and significant changes to code coverage: I walk you through the changes.

The image shows five wooden blocks with symbols representing interpersonal skills. A hand deliberately highlights the cube with the red heart and the inscription “EMPATHY”. The warm, calm atmosphere emphasises empathy as a technical skill in software development.

29 April 2026

Technical debt is not malice

Technical debt is not malice, it is context. An argument for why empathy is a technical skill that matters more than you think.

A glowing magnifying glass over a bug symbol, held by a hand, against a dark background of binary code and geometric patterns. A visual metaphor for the disciplined investigation of performance problems.

23 April 2026

Debugging Performance in PHP

“It feels slow” is not a diagnosis. I explain the three disciplines that turn vague complaints into actionable data: tracing, profiling, and benchmarking.

A bouncer in a black suit, earpiece in, hand raised in a firm “stop” gesture at the door of a club. Behind him, a queue of hopeful guests waits behind a golden velvet rope. A visual metaphor for a gatekeeper deciding who gets in and who does not.

18 April 2026

The Bouncer in the Dependency Resolver

Composer 2.9 moved security advisory enforcement from an opt-in third-party package into the resolver itself. This article walks through how the mechanism works, how it relates to the older packages it replaces, and where it can bite you.

A large piece of cheese with holes on a wooden board, surrounded by cheese cubes and a knife.

15 April 2026

Everything we have

In a world with endless possibilities for code to be wrong, one approach alone is not enough to make our software truly robust.

The image shows an abstract, futuristic design with a dominant, glowing question mark as its central motif. It emerges from a chaotic, undulating landscape of geometric pixels and voxel-like structures in intense shades of pink, purple and blue. These create depth and dynamism. The chaotic background resembles a seething, digital terrain that symbolises disorder and complexity. The question mark rises stably and questioningly from it – perfect as a visual mood for fuzz testing, where random chaos reveals security.

8 April 2026

Security through chaos

This practical deep dive into the philosophy behind “security through chaos” shows that security does not come from perfect foresight, but from surviving chaos.

This photograph captures a professional workspace set up outdoors against a backdrop of a natural garden. The scene showcases an organised desk arrangement on a light wooden surface, bathed in daylight.

1 April 2026

Beyond Best Practices

Testing, code reviews and documentation are all essential prerequisites that constrain the autonomy of AI, thereby safeguarding human agency in software development.

The image depicts a modern software development workspace, with two developers collaborating at a shared desk. In the foreground, a woman wearing glasses and a warm, cognac-coloured jumper is typing on a keyboard and engaging with the team. Behind her, a male developer in a light green shirt is also focused on his work.

25 March 2026

Effective Code Reviews

Pair, pull, or post-push? Find the code review strategy that is right for your team.

A road disappearing into thick fog. A symbol of how AI-generated code may look readable and plausible to us, but we cannot tell whether it will lead us to the right destination.

18 March 2026

Faster than understanding

An AI coding agent implemented a complex software metric in 15 minutes. I have now spent hours trying to figure out whether the implementation is correct. Is this really a productivity boost?

Glass sphere resting on wet pebbles at the shoreline, reflecting a pier and sunset, symbolizing a shift in perspective and bringing clarity to complex testing practices.

11 March 2026

From anti-pattern to clarity

The any() matcher is deprecated. But migration is easier than you think – and leads to better tests.

The image shows a person untangling a complicated thought in order to find a solution to a problem.

4 March 2026

Better than withConsecutive()

I explain how PHPUnit 13's parameter set matchers finally solve the problem that made upgrading to PHPUnit 10 such a challenge.

2 March 2026

Why we created PHP Reads

Good PHP writing is easy to miss, so every week we hand-pick three articles from the PHP community worth your time and say why we chose them

The image shows a close-up of printed financial data on paper, with multiple vertical columns of numbers in black, green, and red ink representing values such as prices or changes. A metallic pen lies diagonally across the sheet, suggesting analysis or review of the numerical information.

25 February 2026

Replay Testing

Replay Testing leverages the memory of your event sourcing system to test new versions with real history and shows which oracles truly inspire confidence in your changes.

The image illustrates that valuable insights can be gained from recorded events through skilful processing and analysis, a metaphor for the value of event sourcing and automated testing in software development.

20 February 2026

From Events to Insights

Event Storming, DDD, CQRS, and Event Sourcing are intertwined: the tests not only check the events, but also become living documentation and a bridge between technical expertise and code.

A collage in halftone style: one hand holds a question mark, a second one a key. Arrows point to the right, towards a third hand that holds up a light bulb with a keyhole above a wireframe globe.

11 February 2026

How my understanding of software changed

A classic database only stores the “now” and forgets history. In this article, I describe my journey to DDD and event sourcing and explain why we need to learn to model time itself.

A jigsaw puzzle on a blue background shows a yellow light bulb. Several pieces are missing from the picture and lie scattered next to it.

4 February 2026

Data Provider or Properties?

One test, hundreds of inputs, and an automatic edge case search. But property-based testing has a hidden pitfall that many overlook.

The image shows a hand against a dark background, presenting a glowing light form that is drawn half like a brain, half like a light bulb. The scene conveys focused clarity and symbolises small inputs with great insight – fitting for shrinking in property-based testing.

28 January 2026

Smaller input, greater insight

Shrinking is the unsung hero of property-based testing. I show you how it helps to make inevitable errors understandable.

A person at a laptop ticks off a checklist with a stylus. Transparent documents and a column of round check marks float above the keyboard, the largest of them in blue.

21 January 2026

Property-Based Testing

We only test what we think of. That is precisely what can become a problem.

The image shows a colourful, chalky network of dots and connections on a black background. It is a playful visualisation of distributed, loosely coupled communities and thus fits perfectly as the mood for an article about the Fediverse.

18 January 2026

Open Source, Open Feeds: Mastodon and PeerTube as online spaces for the PHP community

With phpc.social and phpc.tv, the PHP community is building its own donation-funded online spaces in the Fediverse – free from algorithms and fascist tech bros.

The image shows several interlocking gears in white and yellow on a dark board surface. A hand is adding to or highlighting one of the yellow gears. This hand can be interpreted as a symbol of the developer, who deliberately inserts new, type-safe components into an existing system without disrupting the mechanism.

14 January 2026

Type-Safe Collections

Does PHP really need generics? A controversial thesis with a practical solution.

The image depicts a symbolic scene that represents cooperation and team spirit. The focus is on several hands arranged in a circle from above, working together to bring wooden puzzle pieces together. The hands belong to different people wearing different clothes. Some light-coloured shirts and grey sleeves are visible. The scene takes place on a green meadow, conveying a sense of naturalness and openness. The light-coloured puzzle pieces represent the individual components that must be put together to form a larger whole.

7 January 2026

How PHP and its ecosystem test each other

PHP tests Laravel, Symfony, PHPUnit, and more every night. PHPUnit tests PHP. This is Open Source collaboration at work.

This image depicts a woman holding a white theatrical mask up to her face against a dramatic, dark background. A bold red panel is visible on the left, and there is ambient stage lighting in the background, consisting of blue and white orbs. Her eyes peer over the mask, suggesting a moment of self-examination or realisation, with an expression of curiosity and slight concern. The theatrical setting and professional staging emphasise the performative nature of the moment.

31 December 2025

The Stub/Mock Intervention

Self-sabotaging mock objects? With PHPUnit 12.5, that's a thing of the past because the test runner now asks the right question: Do you really need a mock object, or would a test stub suffice?

This festive holiday image showcases a beautifully illuminated Christmas tree rendered as an artistic composition of soft, out-of-focus bokeh lights against a deep navy blue night sky. The tree is constructed entirely from overlapping, translucent circular orbs of light, creating a dreamy, impressionistic effect.

24 December 2025

A festive break

I take a break from my weekly articles and invite you to a free online event where I will present the latest improvements to PHPUnit.

The image shows an aircraft flight recorder, commonly known as a “black box”, resting on the seabed under water. The cylindrical orange device is slightly rusted and mounted on a base plate, with a rectangular attached unit behind it. A large white label on the cylinder reads “FLIGHT RECORDER DO NOT OPEN”.

17 December 2025

A flight recorder for your code

Your PHP project has no tests and an upgrade is pending? The classic dilemma: to introduce tests, you have to change code – to change code, you need tests. How can you break this cycle? With characterisation tests.

The image shows two hands that seem to be forming a glowing light that appears magical. The person is wearing several rings and bracelets and has their arm tucked into a purple jumper. In the foreground is a table covered with a dark cloth, on which lie candles, coins, chains and a small bottle containing a blue-green liquid. The warmly lit scene evokes a spiritual or mystical atmosphere, reminiscent of a ritual or fortune telling.

10 December 2025

Seeing the Truth: Test Oracles

Your tests are successful. But are they really? Without a suitable test oracle, you will never know.

This image illustrates the contrast between technical motivation, represented by flowing, dynamic data streams, and domain motivation, represented by solid, stable foundational concepts. This visual metaphor illustrates the main point that DTOs facilitate the movement of data between layers, while value objects represent unchangeable domain concepts that form the basis of business logic. The layered architecture also illustrates how these objects are used in different contexts: technical boundaries versus core business logic. It emphasises the stability and predictability that immutability brings to testing practices.

3 December 2025

Testing with DTOs and Value Objects

Know the differences between data transfer objects and value objects and understand why immutability helps with testing.

The image shows a variety of colourful game pieces (such as those often used in board games) arranged on a surface with lines drawn on it connecting the pieces to each other. The pieces are in different colours (e.g. red, yellow, blue, green, purple, black) and stand at the intersections of a schematic network. The lines indicate that the pieces have relationships with or are connected to each other. The image thus visualises a network or web of relationships between different entities, which is often used to illustrate concepts such as networks, social relationships, teamwork or dependencies.

28 November 2025

Testing with(out) dependencies

Why distinguishing between test stubs and mock objects in PHPUnit significantly improves the quality and readability of tests.

This image shows a stylised representation of a DNA double helix, with a single section highlighted. The DNA strands are shown in blue, while a short section of the base pairs and the associated connections glow red. The imagery communicates a mutation or targeted change at the molecular level, as applied in genetic analysis, mutation testing or biotechnological processing. The focused area could symbolise a mutation, repair or targeted intervention, as used in genetic research.

19 November 2025

Path Coverage or Mutation Testing?

How thoroughly do your tests cover the code, and how reliably do they detect real errors? I show you how to find out.

The image shows a row of electrical circuit breakers with wooden letter blocks placed on top of each breaker. The blocks spell out the phrase “BLACKOUT.” In front of the circuit breakers, there is a lit candle, symbolizing the situation of a power outage or blackout where electric power is unavailable and people rely on candles for light. The setting appears to be indoors, and the candle's flame provides a warm light illuminating the breakers and the surrounding area. The image visually represents the concept of losing electrical power with the word “blackout” and the candlelight.

11 November 2025

Open Source Blackout

Are you prepared for a world in which your projects freeze, deployments stall, and tech giants can no longer rely on free community-run infrastructure?

The picture shows a beautiful mountain landscape in the morning or evening light. In the foreground, you can see several dark, partly snow-covered ridges, while in the background, gently rolling hills and mountains disappear into the distance on several levels. The scene is shrouded in mist or haze, which enhances the colour gradient from violet to pink to bright yellow and finally blue in the sky. At the bottom right edge, a single person stands on a ridge with a walking stick, giving the image a particularly calm and impressive atmosphere.

5 November 2025

More control, less friction: What's new in PHPUnit 12.4?

Discover how PHPUnit 12.4 helps you get there with less friction and more insight.

This image shows a modern graphic collage depicting stylised hands holding or passing several light bulbs. The light bulbs symbolise ideas and innovations, with their yellow colour immediately catching the eye and conveying a positive, creative impression.

29 October 2025

Modern PHP Development

Modern PHP development combines proven principles with the latest tools. It brings together documentation, quality, automation, and AI.

The image shows a wooden staircase leading through dunes to the beach, running towards a sunrise or sunset. The years from 2026 to 2035 are painted large and white on the individual steps, as if symbolising the path to the future. At the end of the staircase, where the light is strongest, the journey seems to lead into the coming years, while the wide sky and calm sea in the background convey a peaceful, expansive mood.

22 October 2025

A look ahead to 2035

I discuss key issues for the future relating to ethics, digital sovereignty, Open Source, and web standards.

The picture shows a light bulb lying on a wooden surface. The light bulb is lit and creates a warm atmosphere. Right next to the light bulb is a small pile of various old metal keys. The interplay between the glowing light bulb and the keys symbolically conveys the idea that ideas (light bulb) can be the key (bunch of keys) to new possibilities or solutions.

15 October 2025

PHPUnit features that surprise even professionals

Discover the hidden capabilities of PHPUnit and learn how to get the most out of your tests with clever features.

The image shows the interior of a vehicle with a futuristic-looking control panel consisting of several orange and green seven-segment displays arranged one above the other, showing the date and time, flanked by metal plates, switches, cables and connectors, creating the impression of a time travel console.

7 October 2025

From AmigaBASIC to AI

A personal journey from my first lines of BASIC on the Amiga to the question of how AI will shape the next generation of developers.

The image shows several people working together to assemble a puzzle made up of yellow pieces that form the shape of a light bulb. The light bulb typically symbolises an idea or innovation. The scene takes place on a wooden table, which also holds a cup of coffee, a glass of water, an open laptop and some documents. The people's hands are visible as they fit the puzzle pieces together, illustrating collaboration and teamwork.

1 September 2025

Innovation through collaboration: The highlights of PHPUnit 12.3

Discover how collaboration with real-world developers has shaped the latest advancements in PHPUnit 12.3.

Workspace with various tools that are often used for precise manual work, model making or handicrafts

16 June 2025

Psalm or PHPStan?

Psalm or PHPStan: which tool is the better choice for code analysis? Or is it worth combining both tools for maximum code quality?

A person wearing a backpack stands on a rocky ledge overlooking a range of green mountains under a partly cloudy blue sky.

8 June 2025

30 Years of PHP, 25 Years of PHPUnit

I look back on 30 years of open source innovations.

Collaborative prioritisation of quality goals with LASR

10 May 2025

ComoCamp 2025

I am thrilled by the inspiring workshops, exciting open space sessions and the uniquely open, collaborative atmosphere of ComoCamp.

25 August 2024

SoCraTes 2024

SoCraTes has enriched and motivated me in a lasting way through inspiring discussions, exciting sessions on topics such as PHP, software testing, security and open-source funding, as well as the special, collaborative atmosphere.

Tool wall on which a variety of hand tools are neatly arranged

25 June 2024

PHP_CodeSniffer or PHP-CS-Fixer?

Should PHP_CodeSniffer or PHP-CS-Fixer be used to get code “in shape”? Should both tools even be used together?

A man is sitting on a dune covered with dry grass. He appears pensive or perhaps even sad, as he rests his head on his arm with one hand while looking down.

22 March 2024

PCOV or Xdebug?

Should you use PCOV or Xdebug to collect code coverage data? I give a personal answer.

The image shows a panoramic view of a harbour with a train on an elevated railway bridge in the foreground. On the left is a modern building with a striking glass façade, which is the Elbphilharmonie concert hall in Hamburg. In the background, several ships and cranes can be seen, indicating port activity. The weather is cloudy but bright, suggesting late afternoon or early evening. The scene appears both calm and industrial.

11 March 2024

PHPUnit Code Sprint: March 2024

I recollect my experience at the PHPUnit project's most recent code sprint.

The image shows a yellow diamond-shaped traffic sign with the black inscription “DEAD END”. It is located in an urban environment, in front of a building with large windows and metal bars. In the background, there are other buildings with typical metal external staircases, as are often found in some neighbourhoods. The sign indicates that the road ends at this point and that it is not possible to drive through.

28 November 2022

PHP 7: Security Support Ends. Now what?

Security support for PHP 7 has ended. What does this mean for you?

The image shows a cork notice board with a yellow sticky note attached to it with two red pins. The note has a stylised light bulb drawn on it, representing an idea or a flash of inspiration. The light bulb is surrounded by short lines symbolising rays of light, reinforcing the image of creative inspiration or a brainwave.

4 April 2022

How I manage test fixture

I reflect on why I no longer write setUp() methods.

The image shows two people starting on a running track. In the foreground, a person in a red sports outfit is seen in the starting position for a sprint, ready to run. In the background, another person is also in the starting position. The image conveys a sporty and competitive moment on an outdoor athletics track in daylight, surrounded by trees and buildings.

2 August 2021

Ready Or Not, Here It Comes

Is your software ready for PHP 8.1? Now is the time to find out.

A sign reading “Private Property No Entry” stands in front of a large modern house with a wooden deck and glass railings in the background.

21 April 2021

Do not mock what you do not own

If you use abstractions you don't own, testing may be difficult.

The image shows a glass surface covered with fine water droplets or condensation. A large question mark has been painted or wiped onto this fogged-up glass. The background appears yellowish to greenish and blurred, so that the question mark clearly stands out as the central motif.

8 October 2020

Caching makes everything faster. Right?

While working on PHPUnit, I encountered an interesting problem.

The image shows two chess pieces on a light, almost white background. The central piece, a black king, stands upright. Next to it lies another king – presumably white – on its side, apparently defeated. The scene appears minimalistic and focuses exclusively on this symbolic moment, which is often interpreted as representing victory and defeat.

6 July 2020

Failing IT Projects

I explain how we can learn from failed IT projects.

The image shows an analogue wall clock with a yellow frame hanging on a white wall. The time is approximately 6:50 p.m. The clock face has a simple design and the background of the clock and the wall are white, giving the image a very minimalist look. There is a lot of empty space on the left, while the clock is located on the right side of the image.

5 June 2020

Who wound the clock?

I explain why PHPUnit no longer looks at the clock.

The image shows a wooden sign with the word “CLOSED” written on it. The sign is photographed at an angle and, thanks to its warm, brownish colouring, blurriness and strong grain, has a particularly atmospheric and nostalgic feel. It is reminiscent of a photograph taken in a small, cosy shop or café at closing time.

21 February 2020

PHPUnit: A Security Risk?

The long story of a security problem that should not have been one.

The image depicts a tranquil seascape at sunset or sunrise. The water's surface reflects the warm colours of the sky, which glows in shades of orange, yellow, blue and violet. Several birds can be seen flying in the sky, creating a peaceful and relaxed atmosphere. The silhouettes of the birds stand out clearly against the colourful horizon, emphasising the vastness and tranquillity of the scene. In the background, a dark headland or coastline can be seen, completing the picture.

7 February 2020

Migrating to PHPUnit 9

In the tension between backward compatibility and progress, a good developer experience must not be neglected.

In the picture, a man in a suit is sitting outdoors at a table in front of a laptop. He has raised both hands in frustration and is looking up. His facial expression appears desperate or annoyed. The scene is set on an empty street with benches and buildings in the background. There is also a coffee cup on the table in front of him.

12 February 2019

Help! My tests stopped working

Running tests at the touch of a button is a great thing. Updating the testing tool at the touch of a button also sounds promising – or perhaps not?

The image shows a concrete wall with a rough surface and visible horizontal lines and joints. Shadows fall on it, forming patterns, presumably from plants or leaves. The shadows create an interesting interplay of light and dark, giving the image a calm, natural atmosphere.

1 February 2019

Blast from the Past

Package managers are worthwhile targets, even if no one uses them anymore. Background information on the breach of the PEAR infrastructure of the PHP project.

A young person with long brown hair looks thoughtful and slightly concerned, resting their chin on their hand against a teal background.

24 February 2017

Testing keeps me from getting things done

Writing unit tests takes time. Is it really worth the effort?

15 February 2017

The Death Star

I explain why using overly open version restrictions can lead to problems.

The image shows a yellow, diamond-shaped traffic sign with the large black lettering “END” in the centre. In the background, several palm trees and a slightly cloudy sky can be seen during sunset or sunrise. The scene conveys a calm atmosphere and the sign stands out clearly in the foreground.

31 December 2016

PHP 5: Active Support Ends. Now what?

Active support for PHP 5 has ended. What does this mean for you?

The image shows a small group of four people sitting together in a bright, modern room. In the foreground, a man is sitting with his hand raised, as if he wants to ask a question or speak. The group's attention is focused on a person in the background who is standing in front of the large windows and appears to be speaking or giving a presentation. The atmosphere is reminiscent of a meeting, seminar or training session.

5 February 2016

Questioning Best Practices

Best practices are not set in stone and need to be questioned and then adapted, if need be, every once in a while.

Five flipcharts stand side by side in a conference room with blue carpet. The sheets are covered with handwritten notes, keywords and small sketches in many different colours. A man in a light blue shirt stands in front of the fourth one, looking at the results.

11 August 2014

SoCraTes 2014

My first SoCraTes: a World Café on Thursday, two days of Open Space on TDD, legacy code and apprenticeship, and a board game whose objective looks suspiciously like that of a software project.

Software Development, Testing & Open Source

Composer learns to wait

Unverified

Dead code still gets maintained

Upgrading PHPUnit should be boring

Hate does not fix vulnerabilities

Nineteen years of CRAP

Laying the past to rest

Where tests end and types begin

Your tool has a new reader

When the metric becomes the target

What ISO/IEC 18974 asks of your composer.lock

One version per process

When the diff is free

Confidence is not transferable

Repetition and Insight: What is new in PHPUnit 13.3?

How PHP generates machine code

Digital sovereignty is written in PHP

Succession, release cycle, and 26 years of PHPUnit

How PHP optimises bytecode

How PHP executes bytecode

So you received a security report. Now what?

A language has non-functional requirements, too

Four out of five

Your composer.lock knows what a carmaker only guesses

When static analysis runs your code

Untouched tests are half the proof

Composer and Packagist under supply chain stress

Stories about systems that resist people

Precision and Clarity: What is new in PHPUnit 13.2?

Merging code coverage data

What your test run already knows

Speed as a security feature

Turbo-Charging Your PHPUnit Suite

Test-Driven Security

Debugging as a design goal

Code I do not have does not cause any problems

The attack surface begins in the repository

Hardening GitHub Actions workflows

ComoCamp 2026

Closures, Clarity, and Control: What is New in PHPUnit 13.1?

Technical debt is not malice

Debugging Performance in PHP

The Bouncer in the Dependency Resolver

Everything we have

Security through chaos

Beyond Best Practices

Effective Code Reviews

Faster than understanding

From anti-pattern to clarity

Better than withConsecutive()

Why we created PHP Reads

Replay Testing

From Events to Insights

How my understanding of software changed

Data Provider or Properties?

Smaller input, greater insight

Property-Based Testing

Open Source, Open Feeds: Mastodon and PeerTube as online spaces for the PHP community

Type-Safe Collections

How PHP and its ecosystem test each other

The Stub/Mock Intervention

A festive break

A flight recorder for your code

Seeing the Truth: Test Oracles

Testing with DTOs and Value Objects

Testing with(out) dependencies

Path Coverage or Mutation Testing?

Open Source Blackout

More control, less friction: What's new in PHPUnit 12.4?

Modern PHP Development

A look ahead to 2035

PHPUnit features that surprise even professionals

From AmigaBASIC to AI

Innovation through collaboration: The highlights of PHPUnit 12.3

Psalm or PHPStan?

30 Years of PHP, 25 Years of PHPUnit

ComoCamp 2025

SoCraTes 2024

PHP_CodeSniffer or PHP-CS-Fixer?