Post

Pick a password longer than 72 bytes and PHP's default hash keeps only the first 72, so a shortened password still logs you in. An RFC wants PHP to refuse instead, and the list can't agree it's worth the break. https://youtu.be/3Hp0E0SbusM #PHP #PHPInternals #PHP87

youtu.beThis Week in PHP Internals | Oct 1, 202614 stories from the PHP internals mailing list, September 24 – October 1, 2026.

2/10/26, 12:56 am2 reposts1 like

Len Woodward

@projektgopher.com

Top story: Sjoerd Langkemper's RFC would make password_hash() with bcrypt refuse passwords past 72 bytes. Kamil Tekiela and @timwolla.bsky.social: checking length is the app's job. Rowan Tommins, Andrey Andreev and Robert Chapin are for it. Derick Rethans is a -1: "a scary BC break."

Len Woodward

@projektgopher.com

Gina P. Banyard's CompiledRegex prototype drew 18 replies, and several want it called just Regex: Larry Garfield, Casper Langemeijer, Jordi Kroon, Juris Evertovskis. Ayesh Karunaratne and @seld.be want to build one from the patterns you already have.

Len Woodward

@projektgopher.com

Pratik Bhujel's terminal extension is now the Io\Terminal RFC for PHP 8.7. @nicolasgrekas.bsky.social: calling stty is "a workaround we've been carrying since way too long." Larry Garfield wants it mockable, so v0.3 makes Terminal an interface.

Len Woodward

@projektgopher.com

Time\Instant got a bridge from DateTime: toInstant(). @timwolla.bsky.social and Derick Rethans won't write the testing-clocks RFC, and they're inviting the community to. Mirco Babin flagged a clash with PSR-20's now(). Morgan: "Well, then it's not an instant, is it?"