Async PHP in production lessons benchmarks and tradeoffs :: Pallavi Thukral

Async PHP has come a long way from being an experimental concept to powering real, production-grade systems. But anyone who’s actually deployed async PHP in production knows — it’s not all sunshine and benchmarks. There are sharp edges, unexpected tradeoffs, and a learning curve that goes beyond “just install Swoole or ReactPHP.” In this advanced session, we’ll take a hard look at what running async PHP in production really means. We’ll walk through live demos comparing synchronous vs. asynchronous execution models under real-world workloads — from database I/O and API calls to parallel job handling. You’ll see real performance benchmarks, resource usage metrics, and what happens when async code meets legacy frameworks or blocking libraries. We’ll cover: 1. When async PHP makes sense — and when it doesn’t 2. Performance tuning with Swoole, ReactPHP, and Fibers 3. Debugging concurrency issues, race conditions, and memory leaks 4. Integrating async patterns into existing monoliths safely 5. Lessons learned from production — what went right, what went wrong, and what we’d never do again Expect raw numbers, war stories, and code you can take home. If you’re ready to push PHP to its performance limits and understand the real-world tradeoffs of asynchronous execution, this session will give you the data, the insights, and the confidence to do it right.

Bridge the Testing Gap: Mastering BDD with Codeception for Cross-Team Success :: Alena Holligan

Transform your PHP testing strategy with Codeception and Behavior-Driven Development—the powerful combination that turns testing from a developer bottleneck into a collaborative advantage. Join Alena Holligan for a hands-on exploration of how BDD bridges technical and business teams, creating executable specifications that everyone understands. What You'll Master * BDD Fundamentals That Work: Move beyond traditional testing silos by implementing Behavior-Driven Development principles that connect user stories directly to automated tests through readable Gherkin syntax. * Codeception in Action: Get practical experience setting up PHP's most versatile testing framework, from initial configuration to writing robust acceptance tests that mirror real user journeys. * Multi-Level Testing Strategy: Leverage Codeception's modular architecture to create comprehensive test suites spanning acceptance, functional, unit, and API testing—all from a unified platform. * Cross-Team Collaboration: Enable product managers, QA professionals, and stakeholders to actively participate in test creation and validation, ensuring requirements are captured accurately from day one. Live Workshop Elements * Transform abstract user requirements into concrete, executable test scenarios * Build reusable test components that scale across projects * Implement validation patterns for complex business workflows * Create living documentation that stays synchronized with your application Perfect For Developers ready to elevate their testing practices, QA professionals seeking better collaboration tools, and team leads looking to align technical delivery with business expectations. No prior BDD experience required—just bring your curiosity and prepare to revolutionize how your team approaches quality assurance. Leave with your first working BDD test suite and the confidence to implement Codeception across your entire development lifecycle.

Building a Zero-Trust Architecture for PHP APIs and Applications :: Guman Chauhan

I will be discussing how zero-trust model is essential for modern PHP backends handling sensitive data and APIs. This talk demonstrates how to design and implement a zero-trust architecture in PHP environments, using principles like least privilege, continuous validation, secure identity, and encrypted communication. Through live examples, attendees will learn how to implement secure tokens, enforce API-level access control, and isolate trust zones within PHP applications. Key Takeaways Learn how to apply zero-trust principles to PHP microservices and APIs. Understand secure token handling, role-based access, and continuous authentication patterns. Gain practical insights into hardening PHP applications deployed in cloud or containerized environments.

Building Resilient PHP Applications with an Event-Driven Mindset :: Savio Resende

Event Sourcing is a powerful architectural pattern that captures application state changes as a sequence of immutable events, enabling robust, auditable, and scalable systems. In this beginner-friendly talk, we’ll demystify event sourcing and show how PHP developers can implement it effectively to solve real-world problems. We’ll explore the core philosophy of event sourcing - storing "what happened" instead of "what is" - and its benefits, including complete audit trails, simplified debugging, and flexibility for future features. Using practical PHP examples, we’ll walk through a simple event-sourced system with a relational database (e.g., MySQL) in a Laravel example. Attendees will learn key concepts like event stores, aggregates, and how that causes optimized performance. This talk is perfect for developers new to event sourcing or those curious about its practical applications in PHP. By the end, you’ll have a clear understanding of how to start incorporating event sourcing into your projects, whether for e-commerce, financial systems, or complex workflows. Join us to discover how event sourcing can make your PHP applications more resilient and adaptable!

Custom PHPStan Rules: Automate Standards and Save Time :: Dave Liddament

PHPStan is best known for its ability to catch bugs, but did you know it can do so much more? By creating custom PHPStan rules you can enforce your project-specific coding standards, automate tedious review tasks, and ensure a consistent codebase - all without manual intervention. This talk will guide you through step by step the process of creating a custom PHPStan rule. By the end of the talk, you'll have the knowledge and confidence to craft your own PHPStan rules, helping your team reduce bugs, save time, and focus on what matters most: writing great code.

Demystifying Regular Expressions :: Steve Grunwell

Regular Expressions ("RegEx") are a powerful tool in any developer's toolbox, but wrapping your mind around its cryptic syntax can be difficult. Anchors, quantifiers, and capture groups? What does it all mean?! This talk introduces the basic concepts and syntax of RegEx, focusing on the types of patterns developers may see every day. We'll discuss when and where RegEx is a great choice and — perhaps more importantly — where RegEx can cause a world of pain. Attendees will walk away with a greater understanding of how Regular Expressions work and can benefit their projects, regardless of language.

Describe Your API with OpenAPI :: Ben Ramsey

No matter how big or small your API, no matter the audience, internal or external, you need to provide clear and precise documentation for your API. Since its inception as Swagger, OpenAPI has seen wide adoption as the de facto specification for describing APIs. Whether your API is yet to be built or has been around for a decade, you can use OpenAPI to document all the parts of your APIs. In this talk, I’ll introduce you to the basic concepts of OpenAPI, we’ll use it to create documentation for a simple API, and I’ll leave you with a few tips, tricks, and gotchas I’ve learned along the way. You should be able to take what you’ve learned and immediately begin describing your APIs with OpenAPI.

Don't Get Pwned: OWASP Top 10 for the Lazy PHP Developer :: Gunnard Engebreth

Security doesn't have to be a full-time job. This talk breaks down each OWASP vulnerability with the minimum effort required to not get hacked. No academic theory – just "do this, don't do that" with practical PHP examples. I'll show you security quick wins, how to leverage your framework's built-in protections, and the security checks you can automate so you don't have to think about them again.

From Concert Hall to Code Review, Symphony to Software :: Sarah Peters

An orchestra succeeds when musicians listen, adapt, and communicate. A development team is no different. As a professional violinist turned software developer, I have spent years working in two high-stakes, deeply collaborative environments. In fact, for a full year, I held two full-time jobs: one as a section violinist in the Kansas City Symphony, the other as a software developer building applications for a Top3 Consulting Firm. Now, as a full-time developer at Georgetown University, I still find time to play as a substitute with the Baltimore Symphony Orchestra. While they might sound like wildly different careers (and in some ways, they are!), the skills from one world to the other are transferable. In both the music and tech worlds, success isn’t just about individual skill, it’s about how people work together. Whether playing in an orchestra or working on a new feature development with a development team, I have learned that great teams share these common traits: trust, communication, adaptability, and a shared vision. In this talk, we’ll explore: Listening as Leadership: How the best musicians and developers actively listen and respond, whether in a live performance or a sprint planning meeting. High-Trust Teams: Why an orchestra can perform concerts without a single word and what tech teams can learn from that level of trust. Rehearsal vs. Iteration: The role of preparation, structured feedback, and the importance of stepping away when stuck. Adapting Under Pressure: How performing in a live concert teaches the same resilience needed when shipping high-stakes software. The beauty of interpretation: Just as no two performances of the same piece are identical, no two developers solve a problem in the exact same way. Whether you're an engineer, designer, or team lead, you’ll walk away with a fresh perspective on teamwork, leadership, and collaboration from the lessons I have learned from the concert hall that are deeply relevant to software development.

It's Time To Talk About Signals :: Julian Burr

With the active TC39 proposal in play, I think it’s about time we talk about Signals. Over the years, the concept has had many different names. From “observables” in KnockoutJS, to “refs” in VueJS, before Solid made “signals” popular. We’ve seen the carcinization of frontend frameworks in the pursuit of more seamless and fine-grained reactivity in our applications. But what actually are Signals? Why do we keep coming back to them? And why is their potential adoption as a language standard such a big deal?

Kubernetes for PHP Developers: From Docker Compose to Production :: Eric Mann

You've mastered Docker Compose for local development, but production is a different beast. Kubernetes promises scalability, self-healing, and zero-downtime deployments—but the learning curve feels vertical. This talk bridges that gap, translating Docker Compose concepts into Kubernetes patterns specifically for PHP developers. Attendees will understand the practical path from Docker Compose to Kubernetes for PHP applications, have realistic expectations about complexity and cost, and know enough to make informed decisions about whether Kubernetes is right for their projects.

LGTM: Strategies for Successful Code Review :: Andy Snell

It's easy to tell when peer code review fails: a minor one line change is blocked with a dozen comments; a massive pull request with hundreds of files is approved with just "LGTM"; a critical requirement is missed; a production-breaking bug slips through; your reviewer is being a pedantic jerk; the reviewee thinks *you* are a pedantic jerk. Giving good code reviews is a skill just as creating good code and writing good tests: it takes practice. This talk will mostly skip over the theory and various reasons why you should be doing peer code reviews. Many companies don't have a choice: code review is required explicitly or implicitly (as a standard secure coding practice) by many compliance frameworks, like SOC 2, HIPAA, PCI-DSS and GDPR. What we will cover are practical, real-world strategies for successfully reviewing code, including: - How to think through the code while reviewing it and finding issues - When to approve versus when to block a pull request - Writing review comments without being a jerk - Pair peer code reviews versus traditional peer code reviews - How to make the review process beneficial to both the reviewer and reviewee - What parts of code review can be outsourced to code quality and AI review tooling - How to review code in an unfamiliar language (e.g. Python, Rust, or Go)

Modernizing Legacy PHP Infrastructure: From Anywhere to Cloud-Native :: Joe Ferguson

Your PHP application runs reliably—but on infrastructure from another era. Whether it's bare metal in a data center, VMs on a cloud provider stuck in 2015, or poorly architected AWS infrastructure deployed before your team knew better, you know it's time to modernize. But where do you start? This talk guides you through the strategic and tactical decisions involved in modernizing legacy PHP infrastructure, regardless of where it currently lives. We'll explore three critical migration paths: escaping aging data centers for modern cloud platforms, moving from stagnant cloud providers that haven't evolved (OpenStack, CloudStack, outdated hosting platforms), and re-architecting existing cloud infrastructure using modern, well-architected patterns within the same provider. You'll learn how to assess your current infrastructure's technical debt, build a migration roadmap that minimizes risk and downtime, and leverage modern tools like Docker, Kubernetes, GitHub Actions, and infrastructure-as-code to create resilient, scalable systems—all while keeping your PHP application running for your users.

Nginx and You :: Chris Lemon Free

Most PHP apps run behind nginx, but many developers only touch a small part of what it can do. In this session, we’ll walk through useful nginx features that anyone can start using, even if you’re not a DevOps specialist. We’ll cover how nginx interfaces with PHP, how to structure clean and maintainable config, and simple optimizations that can noticeably improve performance. We’ll also look at helpful features like caching, rate limiting, redirects, and ways to avoid common configuration mistakes. If nginx has ever felt like a mysterious black box, this session will help you understand it clearly and confidently, with examples you can take home and apply right away.

PHP 8.6: The Inside Scoop :: Daniel Scherzer

Join PHP core developer and veteran release manager Daniel Scherzer for a deep dive into the new features, syntax updates, deprecations, and surprises coming in PHP 8.6. While PHP 8.6 is still in active development, and the first alpha candidate won't be tagged until July, it is never too early to start preparing.

Practical AI Contexts and Prompts :: Mark Niebergall

Explore how AI contexts and agents can transform PHP software development. This talk demonstrates how to setup the context for AI prompts, integrate AI tooling, and automate tasks such as code generation, testing, and architectural decisions to enhance developer efficiency and code quality.

React and the Art of Gamification :: Courtney Yatteau

Unlock the power of gamification in your React applications to create compelling, interactive user experiences. Explore React's versatile architecture and component-based approach, perfect for integrating game mechanics like scoring, achievements, and adaptive challenges. Drawing on principles from educational settings, discover the psychology behind gamification to enhance user engagement and retention. Along the way, see how tools like the React Compiler can simplify building performant gamified features by optimizing components automatically. Join me to learn practical techniques and build a gamified app that keeps users coming back for more.

Reinventing Redux from scratch :: Matteo Antony Mistretta Free

Redux taught us the value of predictable state management, but what if we could keep its principles while solving modern challenges? Inspired by Entity Component System patterns from game development, I'll show how entity-based state management with event queues can dramatically simplify complex UIs—cascading dashboards, dynamic widgets, real-time collaboration—while staying 100% compatible with Redux DevTools and react-redux. We'll explore why letting reducers dispatch events isn't as crazy as it sounds, and how borrowing ideas from game engines can give us Redux's predictability with half the boilerplate. Whether you're wrestling with thunks, managing widget lifecycles, or just tired of Redux ceremony, you'll walk away with fresh perspectives on state management.

Scaling Legacy PHP: Refactoring the Heart of the System Without Rewriting :: Vijay Panwar

Many organizations have mission-critical PHP systems that are decades old and built on monolithic architecture. In this talk we’ll explore pragmatic ways to refactor the core stored-procedures, message queues (SQS), backlog handling and data flows without doing a full rewrite. We’ll walk through actual patterns for queue purging, backlog mitigation, redesign of key logic (e.g., an flowOfData stored proc), and strategies for deploying changes with minimal downtime. Attendees will leave with an actionable roadmap to modernize legacy systems while keeping them live.

Secure by Design – Hardening JavaScript Applications in 2026 :: Bhaskar Bharat Sawant

Abstract With JavaScript powering everything from critical APIs to mobile apps, security remains a pressing challenge. Supply chain vulnerabilities, XSS, CSRF, and dependency risks continue to dominate the landscape. In this session, I’ll present a framework for securing JavaScript applications end-to-end—covering package hygiene, runtime protections, and front-end defense patterns. Using real-world incidents as case studies, we’ll explore how teams applied automated dependency scanning, Content Security Policies (CSP), and sandboxed workers to minimize risk. Attendees will walk away with practical security playbooks tailored for modern JavaScript stacks. What’s your talk about? How to integrate security best practices directly into the JavaScript development lifecycle—shifting from reactive patching to proactive resilience. What audience will get: • Proven strategies for preventing supply chain and runtime attacks • Practical steps to enforce front-end and API security • Framework for embedding security checks in CI/CD pipelines Target audience: JavaScript developers, security engineers, DevSecOps practitioners, and engineering leaders.

Supercharge your PHP apps with Go-powered PHP extensions :: Alexandre Daubois

Frameworks like Laravel and Symfony gives us a huge amount of flexibility through their service container and drivers system. Sometimes, PHP itself becomes the bottleneck. In this talk, we’ll go one layer deeper: writing a custom PHP extension with FrankenPHP and Go, without any C code, before plugging it directly into Laravel as if it were a native feature. Let's see how we can implement an in-memory LRU cache as a PHP extension, then expose it to Laravel and Symfony through a custom cache driver. Step by step, we'll explore how to extend the caching system with our high-performance extension. Expect to see real code and real internals! Even if you never wrote a PHP extension yourself, you’ll walk away with a deeper understanding of both Laravel’s and Symfony's flexibility, as well as PHP’s core runtime, without prior knowledge in C. It opens endless possibilities to blow-up your apps performances!

Taming Time in PHP: Best Practices and Gotchas :: Scott Keck-Warren

Time is one of the hardest problems in software, even if you're not working across time zones, formats, and legacy systems. In this talk, you’ll learn how to manage time effectively in PHP web applications, including how to handle daylight saving transitions, properly use `DateTimeImmutable`, and avoid pitfalls in date math. Whether you're maintaining a legacy system or building greenfield, this session will equip you with the tools and patterns to avoid time-related bugs and improve code reliability.

The Command-Line for Beginners: An Introvert's Guide to Crawling into Your Shell :: Eric Poe

For many developers, the terminal remains an intimidating black box — powerful, but mysterious. This talk is a gentle introduction to the command-line interface, tailored for those who prefer quiet mastery over noisy GUIs. We'll explore how the shell can become your most trusted companion in development, unlocking speed, precision, and automation across Linux, macOS, and even Windows. Whether you're deploying code, managing servers, or just trying to simplify your workflow, you'll leave with practical tools and a newfound confidence to crawl into your shell — and thrive there.

The Trust Protocol: Securing Code, Culture, and Collaboration :: Nia Luckey

Abstract: In a world where zero-day exploits and supply chain attacks dominate the headlines, the conversation about security has never been more urgent or more human. We engineer firewalls, intrusion detection systems, and end-to-end encryption, yet when it comes to trust within our teams and organizations, we often leave it unpatched. What if the same principles that secure our digital ecosystems could be applied to the way we lead, collaborate, and innovate? This session introduces The Trust Protocol, a framework rooted in cybersecurity’s bedrock concepts of authentication, encryption, and resilience that reimagines how leaders and developers can build trust that is as durable as the systems they code. Through real-world parallels between cyber defense and human dynamics, you will learn how to: Authenticate worth to strengthen identity and credibility in both code reviews and leadership. Encrypt purpose to safeguard clarity and focus in high-pressure projects. Engineer resilience to recover stronger from setbacks, outages, and even failed launches. By fusing technical rigor with human-centered strategies, this talk equips you to harden both your systems and your culture against today’s most insidious vulnerabilities, including burnout, misalignment, and distrust. Expect a fresh perspective that goes beyond DevSecOps, showing how the same logic that secures data can also secure the future of your team.

Type Safe PHP: Leveraging Static Analysis for Robust Code :: Dave Liddament

Type hints and type declarations in PHP add clarity, reduce bugs, and enable safe refactoring - cornerstones of maintainable and reliable code. While PHP’s type system improves with every release, it still has limitations. In this talk, we’ll explore how far PHP’s type system can go and uncover strategies for leveraging its full potential. Next, we’ll dive into the world of static analysis, discovering how tools like PHPStan or Psalm can bridge the gaps in PHP’s type system, providing insights and safeguards that native types can’t. By the end of this session, you’ll have the tools and knowledge to make your PHP code more robust, reliable, and future-proof. Whether you’re maintaining legacy code or building a new application, this talk will help you harness the power of types to elevate your development practices.

What Online Dating Taught Me about Algorithms :: Diana Pham

Have you ever thought about the parallels between online dating platforms and fundamental algorithm principles? (I’m sure that would make a great date opener.) In this session, we will cover various algorithms, highlighting their functions in online dating as well as broader applications. We’ll learn about the history of online dating, understand how different platforms predict compatibility, and what this teaches us about machine learning, pattern recognition, and data sorting. The session will include practical JavaScript code that shows how these algorithms are implemented. Whether you are intrigued by date horror stories or are simply interested in learning about algorithms, swipe right on this talk!

Winning with JavaScript in Serverless Apps :: Priyatham Bazaru

JavaScript now powers an enormous portion of the serverless world, but writing efficient functions requires more than just knowing the language. This session explores the JavaScript-specific nuances that determine performance, scalability, and cost across serverless platforms. Rather than focusing on providers, we’ll examine how different serverless execution models (isolates, containers, micro-VMs, and edge runtimes) influence JavaScript behavior. Examples include: - Isolate-based runtimes (Cloudflare Workers, Deno Deploy) and how they favor smaller bundles and near-instant startup - Micro-VM or container-based runtimes (AWS Lambda, Azure Functions, GCP Cloud Functions) where dependency size, I/O strategy, and initialization code matter much more - Edge vs. centralized execution, and how JavaScript’s non-blocking model fits into ultra-low-latency workloads This session includes some code snippet walkthroughs and horror stories of serverless failures. I have seen in my career and some of the gotchas that everyone misses in these hostile environments. Attendees will leave with a deep understanding of how to write JavaScript that thrives in serverless environments, how runtime architecture changes, what “efficient” means, and how to choose the right serverless model (edge, container, isolate) for the job based on JavaScript’s strengths and constraints.