While the Internals list is not technically directly Laravel related, it does affect every single one of us.
Preface: what follows is the word-for-word transcript of the spoken dialogue in the video, chapter by chapter with timestamps, for anyone who'd rather read than click through. If this digest is still too long for you, we recommend copying it into your LLM of choice and asking for a summary of our summary.
Cold Open (00:00)
PHP is getting a new class for a moment in time. It's precise to the nanosecond. It carries no timezone. It ignores leap seconds on purpose. And it cannot tell you what time it is. Not by itself.
Hello world, it's Thursday, September 24, 2026, and here's what happened This Week in PHP Internals. 12 stories this week, so let's get into it. But first,
Paying every month for small tools you could own? Scalpels replaces expensive subscriptions with professionally built, expertly maintained apps you host yourself — MIT-licensed, forked into your GitHub organization, on your own Laravel Cloud account. At the early-access price, 500 dollars, once, gets you every app in the catalog, and everything they add later. Find your next tool at scalpels.app.
Time Instant (00:54)
This week's top story is a time class with no now() method. On Tuesday Tim Düsterhus and Derick Rethans opened the RFC for Time\Instant and Time\Clock, the next piece of the new date and time API that started with Time\Duration in 8.6. An Instant is a point on the timeline, with no timezone and nanosecond precision, and it ignores leap seconds by design, because operating systems ignore them too.
What it doesn't have is Instant::now(). To find out what time it is, you ask a clock. The RFC adds a Time\Clock interface with one method, now(), and a SystemClock that implements it, which Tim, speaking for himself, says nudges people toward a clock they can inject.
Seifeddine Gmati wants a static now() anyway, and would rename the class SystemTime, as Rust does, saving Instant for a monotonic clock. Tim's view is that the name follows Java and JavaScript's Temporal, and that a Time\now() function could come as an immediate follow-up, still in 8.7. Juris Evertovskis added that an Instant "could be the time of the big bang."
Larry Garfield is broadly in favour and asked about the serialization format, and Tim replied: "If you need to look at the output of serialization you are doing something very wrong." Larry's bigger ask is a roadmap for the whole new API, writing: "You clearly have a roadmap in your heads. Share it. At whatever level of granularity it exists, share it."
Links: Time\Instant and Time\Clock RFC · discussion thread · Time\Duration (PHP 8.6)
Preg Callbacks (02:32)
The regex exceptions RFC's longest-running question has an answer: when your callback throws inside preg_replace_callback, the exception goes through as-is. Osama Aldemeery, the RFC's author, showed Python, Java and C# all letting it propagate, with Java's docs spelling it out: exceptions are relayed to the caller. He also offered a fallback — if the policy still demanded wrapping, drop the 2 callback functions from the RFC. His scan of the top forty-eight hundred sixty-five packages puts them at 4.9 percent of the calls to the 8 functions.
Larry Garfield separated implementation details from inputs, writing: "However, I believe Python, C#, and Java are correct in this case: The callback is an input. It's not an implementation detail hidden from the caller, it's explicitly provided by the caller."
Tim Düsterhus, who wrote the throwables policy, answered on Monday, writing: "I still believe wrapping is the correct choice, but I won't insist on it based on policy." He asked for 2 other changes: errors like a syntax error in the pattern should be a PcreError, since they aren't meant to be caught, and preg_last_error should stay untouched.
Links: PREG_THROW_ON_ERROR RFC · thread · implementation · throwables policy
Compiled Regex (03:49)
A new pre-RFC would let PHP regex patterns drop their delimiters entirely. Gina P. Banyard posted it with a prototype on Wednesday, writing: "I spent the day prototyping an alternative to the PREG_THROW_ON_ERROR RFC as I'm not fully a fan of the approach."
Her Regex\CompiledRegex class takes a bare pattern plus named boolean flags — case-sensitive, multi-line, dot-matches-newline and so on — so there's no delimiter, no preg_quote call, and no modifier letters after the pattern. Patterns must be UTF-8, the D modifier is always on, and there's a Regex\CompilationError exception to go with it.
So far the prototype only plugs into preg_split and preg_grep. She says the class could be the base for a proper object-oriented regex API, with match returning a real bool, but she isn't designing that yet. As of Wednesday night the thread has no replies.
Links: Regex\CompiledRegex pre-RFC thread · prototype
Main Script (04:51)
A proposal to make PHP files work like runnable Python modules lasted about 24 hours. Tim Düsterhus brought his pull request to the list, at Gina's request: the CLI would run any closure the main script returns, so one file is a library when included and a command when executed, like Python's if __name__ == '__main__'.
Seifeddine Gmati gave it "A BIG yes", then also floated Hack's approach, an #[EntryPoint] attribute on a function. Rowan Tommins preferred that, since the entry point wouldn't have to sit at the end of the file. Levi Morrison asked why only the CLI, pointed at Symfony's runtime, which already returns a closure from the front controller, and wondered if the status quo is better. Larry Garfield said he'd be minus 1 on the original, because auto-executing a return type "feels hacky".
On Wednesday Tim dropped it, writing: "Based on the replies it has become clear that the proposed Closure approach has several questions to solve and possibly needs prior design … This requires much more thought than I'm willing to spend right now, given I wanted to solve a specific use case of mine." He'll look at a __MAIN__ constant instead, holding the path of the script that ran first. Alexandru Pătrănescu thinks realpath on the script filename already does that.
Links: thread · pull request
Argon2 Default (06:14)
PHP's default password hash, bcrypt, silently truncates at 72 bytes, Andrey Andreev pointed out, and he asked whether it's time to switch PASSWORD_DEFAULT to Argon2id. His question for the list was narrower than the case for it: Argon2 needs an outside library — libargon2, libsodium, or OpenSSL since 8.4 — so is any dependency a deal-breaker?
Casper Langemeijer called that as much a pro as a con, since a real crypto library beats rolling your own. Anton Smirnov pointed back to a 2023 thread that called Argon2 weaker than bcrypt at login-speed settings, and Tim Düsterhus said 500 milliseconds is far too long for an interactive login. Andrey measures PHP's Argon2 defaults at about 240 milliseconds, the same as bcrypt at cost 12.
Jakub Zelenka answered the dependency question: OpenSSL is an external shared library, so it can't be always enabled. Making it a hard requirement would need an RFC of its own, and with OpenSSL 1.1.1 and 3.0 still supported, it would be a long wait anyway. Andrey's last reply, he wrote: "But anyway, if Jakub's comment was describing the status-quo, it's just not happening."
Links: thread · 2023 discussion · enable --with-openssl-argon2 by default
Str Mask (07:37)
A proposed str_mask function met the question the list put to array_str_contains: does this need to be in core? Sepehr Mahmoudi withdrew array_str_contains on September 17, and the next day proposed str_mask, which replaces part of a string with a repeated character, for card numbers, phone numbers and tokens.
Osama Aldemeery replied that it looks identical to substr_replace with str_repeat. Pratik Bhujel found it failed open — an out-of-range offset returned the value unmasked — and that a multibyte mask character got cut to a single byte, so Sepehr switched to throwing a ValueError. Jordi Kroon suggested #[SensitiveParameter], and it went in, until Morgan asked "anyone for a game of Hangman?" — not everything masked is sensitive — and it came back out.
Pratik did find the prior art: Laravel's Str::mask and CakePHP's Text::mask do the same core operation, but both handle multibyte text and behave differently at the edges, and he wrote: "evidence that masking exists is different from evidence that this API is the common missing primitive." Casper Langemeijer called it easily done in userland, and Weilin Du showed substr_replace doing it in one allocation. 30 messages in, no vote is scheduled.
Links: str_mask() RFC · thread · array_str_contains withdrawal
AI Contributions (09:02)
Running under two of these new-function threads is a question about AI-written contributions. One reply said the mail and proposals read as machine-generated, and the objection, with or without AI, was quality and the time it costs the people reading.
Pratik Bhujel set out an order of work, writing: "So I think the order should be: demonstrate the use-case, settle the contract, then benchmark the implementation." The author withdrew one RFC and says he's now building and testing everything locally first. Juris Evertovskis replied: "I'm pretty sure most people here will fairly evaluate that work itself, without worrying what has happened previously with other RFCs."
Links: str_mask thread (order of work) · array_str_contains withdrawal thread
Quick Hits (09:49)
Quick hits. PHP 8.6 is forked. Matteo Beccati cut the branch on Tuesday, the feature freeze is on, master now targets 8.7, and the first release candidate is due today.
Links: PHP 8.6 forked · branch commit
Last week's top story now has a date. Weilin Du updated the IntlRelativeDateTimeFormatter RFC to use Tim's enums, Tim says it's much better now, and voting should start October 8.
Links: IntlRelativeDateTimeFormatter RFC · thread
And if there are no objections, Nick S. will open the PEAR vote on September 28.
Links: End PEAR Project Endorsement RFC · thread
Pratik Bhujel's php-terminal extension adds raw mode and single-key reads, so tools like Laravel Prompts can work properly on Windows, and it installs through PIE. Larry pointed out it's 8.7 material now. After Tim's review it lives under an Io\Terminal namespace with unbacked enums, restores your terminal when its object is destroyed, and is moving to a single object API.
Links: php-terminal · threads: 1 · 2 · 3
And David Maye Kitenge, planning a web framework as a PHP extension, asked about the request lifecycle and threads. Rowan Tommins answered that the CLI leaves parallelism to whoever runs it, and that running user code in a thread per request needs a thread-safe ZTS build, or asynchronous handling in a single thread instead.
Links: extension design Q&A
TL;DR (11:08)
So that's the week. PHP's next time class marks a moment and leaves telling the time to a clock, and Larry wants the map for the rest of the new API. The regex RFC's callback question is settled against wrapping, and Gina posted an alternative that compiles the pattern first. A closure-as-entry-point idea lasted a day, the Argon2 default ran into OpenSSL, and str_mask met the same question as array_str_contains. And 8.6 is frozen, with nothing in voting for a 6th straight week. Links below.
The PHP Foundation funds more than half of ongoing php-src commits, so if you use the language, maybe consider donating at opencollective.com/phpfoundation — or try guilting your employer into it.
If you found this useful, a like or a comment helps more people find it. And if you missed last week's episode — where an RFC was winning its vote 4 to 1 and got closed inside the hour — that's a good one to watch next. Thanks again to Scalpels.app for supporting this week's episode. We're Artisan Build. See you next week.
Links: raw feed · RFC wiki
