[Blog] PHP Ecosystem Security Team

sitemap.xml

@@ -105,4 +105,7 @@
  <url>
   <loc>https://scherzer.dev/Blog/20260810-fossy-2026</loc>
  </url>
+ <url>
+  <loc>https://scherzer.dev/Blog/20260909-ecosystem-security</loc>
+ </url>
 </urlset>

src/Blog/feed-rss.xml

@@ -3,9 +3,14 @@
   <channel>
     <title>Daniel Scherzer's Blog</title>
     <description>Entries from Daniel Scherzer' personal blog</description>
-    <pubDate>Mon, 10 Aug 2026 00:00:00 +0000</pubDate>
+    <pubDate>Wed, 09 Sep 2026 00:00:00 +0000</pubDate>
     <generator>https://github.com/DanielEScherzer/website-content</generator>
     <link>https://scherzer.dev/Blog</link>
+    <item>
+      <title>Joining the PHP Ecosystem Security Team</title>
+      <pubDate>Wed, 09 Sep 2026 00:00:00 +0000</pubDate>
+      <link>https://scherzer.dev/Blog/20260909-ecosystem-security</link>
+    </item>
     <item>
       <title>FOSSY 2026</title>
       <pubDate>Mon, 10 Aug 2026 00:00:00 +0000</pubDate>

src/Blog/posts/20260909-ecosystem-security.md

@@ -0,0 +1,34 @@
+---
+title: Joining the PHP Ecosystem Security Team
+---
+
+# Joining the PHP Ecosystem Security Team
+
+I'm excited to share that I am joining the PHP Foundation's Ecosystem Security
+Team to help harden the PHP codebase.
+
+As AI tools generate more and more security reports, they frequently report
+issues that the PHP project does not consider to be security vulnerabilities,
+but which are still worth addressing as code hardening measures. Other times,
+the AI agents simply don't understand something because it isn't documented
+well. In those cases, the solution is to improve the documentation, benefiting
+both AI agents and regular PHP developers. More details about this work are
+available [on the PHP Foundation blog][phpf-blog].
+
+I've only just begun, but I've found the work so far to be fascinating, giving
+me a chance to work on parts of the PHP codebase that I'm not very familiar
+with.
+
+I now contribute to PHP wearing three different "hats":
+
+* as a volunteer developer, maintaining the Reflection extension, implementing
+new features, addressing bugs, etc.
+* as a release manager, building and releasing new versions of the PHP 8.5
+branch
+* [new] as a contractor for the PHP Foundation Ecosystem Security Team, helping
+address non-security issues that are reported to the security team and qualify
+as hardening
+
+I look forward to helping secure the PHP project moving forward.
+
+[phpf-blog]: https://thephp.foundation/blog/2026/09/09/welcome-daniel-scherzer/

src/Pages/OpenSourcePage.php

@@ -58,6 +58,12 @@ class OpenSourcePage extends BasePage {
 					'slides' => '20260520 PHPTek PHP 8.6 presentation.pdf',
 					'blog' => '20260525-phptek-2026',
 				],
+				[
+					'conf' => 'Longhorn PHP Conference',
+					'loc' => 'Austin, Texas',
+					'date' => 'October 2026',
+					'upcoming' => true,
+				],
 			],
 		],
 		'PHP-SemVer' => [
@@ -84,6 +90,18 @@ class OpenSourcePage extends BasePage {
 				],
 			],
 		],
+		'Workshop-PHP-extensions-Rust' => [
+			'title' => 'Creating new PHP extensions in Rust',
+			'workshop' => true,
+			'iterations' => [
+				[
+					'conf' => 'Longhorn PHP Conference',
+					'loc' => 'Austin, Texas',
+					'date' => 'October 2026',
+					'upcoming' => true,
+				],
+			],
+		],
 	];
 
 	private const PHP_RFCS = [
@@ -258,12 +276,14 @@ private function addTalksSection(): void {
 		];
 		$list = FluentHTML::fromTag( 'ul' );
 		foreach ( array_reverse( self::OPEN_SOURCE_PRESENTATIONS ) as $details ) {
+			$workshop = ( $details['workshop'] ?? false ) ? '[workshop] ' : '';
 			if ( count( $details['iterations'] ) === 1 ) {
 				$once = $details['iterations'][0];
 				$item = FluentHTML::make(
 					'li',
 					[],
 					[
+						$workshop,
 						'"' . $details['title'] . '," ',
 						...( $makeDetails( $details['iterations'][0] ) ),
 					]
@@ -279,6 +299,7 @@ private function addTalksSection(): void {
 				'li',
 				[],
 				[
+					$workshop,
 					'"' . $details['title'] . '"',
 					FluentHTML::make( 'ul', [], $iterations ),
 				]

src/Pages/WorkPage.php

@@ -95,9 +95,33 @@ protected function build(): void {
 		$this->contentWrapper->append(
 			FluentHTML::make( 'h1', [], 'Work experience' ),
 		);
+		$this->addPHPSecuritySection();
 		$this->addWikiTeqSection();
 	}
 
+	private function addPHPSecuritySection(): void {
+		$this->contentWrapper->append(
+			FluentHTML::make( 'h3', [ 'class' => 'subsection-header' ], 'PHP Ecosystem Security' ),
+			FluentHTML::make(
+				'p',
+				[],
+				[
+					<<<END
+In September 2026, I joined the PHP Foundation's Ecosystem Security Team to work
+on hardening the PHP codebase and addressing non-security issues that are
+reported to the security team. See 
+END,
+					FluentHTMl::make(
+						'a',
+						[ 'href' => './Blog/20260909-ecosystem-security' ],
+						'my blog post'
+					),
+					' for more details.',
+				]
+			),
+		);
+	}
+
 	private function addWikiTeqSection(): void {
 		$makeLink = static fn ( $href, $text ) => FluentHTML::make(
 			'a',
@@ -115,12 +139,12 @@ private function addWikiTeqSection(): void {
 				[],
 				[
 					<<<END
-I joined WikiTeq in January 2023 as a Technical Project Manager, working with a
-team of developers around the world to support clients that use MediaWiki,
-including major corporations and government agencies. As part of my work at
-WikiTeq, I developed multiple MediaWiki extensions, though most of them are
-private. My contributions made as part of my work at WikiTeq are all available
-under the account 
+I worked at WikiTeq from January 2023 until May 2026 as a Technical Project
+Manager, working with a team of developers around the world to support clients
+that use MediaWiki, including major corporations and government agencies. As
+part of my work at WikiTeq, I developed multiple MediaWiki extensions, though
+most of them are private. My contributions made as part of my work at WikiTeq
+are all available under the account 
 END,
 					$makeLink( 'https://github.com/DanielButAtWork', '@DanielButAtWork' ),
 					<<<END

tests/data/Home.html

@@ -7,7 +7,5 @@
 a release manager for PHP 8.5 (where I am one of two "rookie" release managers)
 and for PHP 8.6 (where I am the "veteran" release manager). I also contribute to
 PHP as a developer, and as the maintainer of the built-in Reflection extension.</p><p>See the links in the navigation bar above for more information about my
-experience.</p><h2 class="subsection-header">Contact</h2><ul><li><a href="https://www.linkedin.com/in/daniel-e-scherzer/" target="_blank" class="external-link">LinkedIn</a></li><li>Email: <code>daniel.e.scherzer@gmail.com</code></li></ul><h2 class="subsection-header">Blog</h2><p>I also have a blog. You can see a full index of my posts <a href="/Blog">here</a>. My latest blog post is: </p><div class="blog-preview"><h3>FOSSY 2026</h3><span class="blog-preview-date">Monday, 10 August 2026</span><p>Last week, I was in Vancouver for the FOSSY 2026 conference, where I gave a talk
-about my experience as a new open-source contributor. My experiences as a
-contributor, and previous conferences I have attended, have mostly been focused
-on PHP, but FOSSY is a conference about open source software more broadly. <a href="/Blog/20260810-fossy-2026">Continue reading...</a></p></div></div><div class="des-footer"><div class="des-footer--content">Content is © 2026 Daniel Scherzer</div></div></body></html>
+experience.</p><h2 class="subsection-header">Contact</h2><ul><li><a href="https://www.linkedin.com/in/daniel-e-scherzer/" target="_blank" class="external-link">LinkedIn</a></li><li>Email: <code>daniel.e.scherzer@gmail.com</code></li></ul><h2 class="subsection-header">Blog</h2><p>I also have a blog. You can see a full index of my posts <a href="/Blog">here</a>. My latest blog post is: </p><div class="blog-preview"><h3>Joining the PHP Ecosystem Security Team</h3><span class="blog-preview-date">Wednesday, 09 September 2026</span><p>I'm excited to share that I am joining the PHP Foundation's Ecosystem Security
+Team to help harden the PHP codebase. <a href="/Blog/20260909-ecosystem-security">Continue reading...</a></p></div></div><div class="des-footer"><div class="des-footer--content">Content is © 2026 Daniel Scherzer</div></div></body></html>

tests/data/OpenSource.html

@@ -1,7 +1,7 @@
 <!DOCTYPE html>
 <html lang="en"><head><link rel="icon" href="data:,"><meta name="viewport" content="width=device-width, initial-scale=1, minimum-scale=1"><link rel="stylesheet" type="text/css" href="/resources/default-styles.css"><title>Open source</title></head><body><div class="des-navbar"><a href="/Home">Home</a><a href="/files/Resume.pdf">Résumé</a><strong class="des-strong-page-link">Open Source</strong><a href="/Work">Work</a><a href="/Blog">Blog</a></div><div class="content-wrapper"><h1>Open source contributions</h1><p>I contribute to open-source projects on GitHub as <a href="https://github.com/DanielEScherzer" target="_blank" class="external-link">@DanielEScherzer</a>.</p><h3 class="subsection-header">Conference Presentations</h3><p>I have given a few presentation at various open-source-related conferences. The
 slides and my post-conference write-ups in my blog are listed below. Note that
-even when a presentation is given multiple times, the content changes.</p><ul><li>&quot;From First PR to Release Manager: A Path into Open Source,&quot; <em>FOSSY 2026</em>. Vancouver, Canada, August 2026. (<a href="./files/20260806 FOSSY presentation.pdf">Slides</a>, <a href="./blog/20260810-fossy-2026">Blog write up</a>)</li><li>&quot;Semantic Versioning and the PHP Ecosystem: A Reality Check,&quot; <em>PHP Tek 2026</em>. Chicago, Illinois, May 2026. (<a href="./files/20260521 PHPTek SemVer presentation.pdf">Slides</a>, <a href="./blog/20260525-phptek-2026">Blog write up</a>)</li><li>&quot;PHP 8.6: The Inside Scoop,&quot; <em>PHP Tek 2026</em>. Chicago, Illinois, May 2026. (<a href="./files/20260520 PHPTek PHP 8.6 presentation.pdf">Slides</a>, <a href="./blog/20260525-phptek-2026">Blog write up</a>)</li><li>&quot;Introduction to Rust for Experienced Software Developers,&quot; <em>ConFoo Montreal 2026</em>. Montreal, Canada, February 2026. (<a href="./files/20260225 ConFoo Rust presentation.pdf">Slides</a>, <a href="./blog/20260302-confoo#content-intro-to-rust">Blog write up</a>)</li><li>&quot;PHP 8.5: New Features from the Source&quot;<ul><li><em>ConFoo Montreal 2026</em>. Montreal, Canada, February 2026. (<a href="./files/20260226 ConFoo PHP presentation.pdf">Slides</a>, <a href="./blog/20260302-confoo#content-php-85">Blog write up</a>)</li><li><em>MergePHP</em>. Remote, November 2025. (<a href="./files/20251117 MergePHP presentation.pdf">Slides</a>, <a href="./blog/20251118-mergephp-talk">Blog write up</a>)</li><li><em>Longhorn PHP Conference</em>. Austin, Texas, October 2025. (<a href="./files/20251025 Longhorn PHP presentation.pdf">Slides</a>, <a href="./blog/20251029-longhorn-php#content-my-talk">Blog write up</a>)</li></ul></li></ul><h3 class="subsection-header">PHP</h3><p>I started contributing to the PHP source in August 2024, working primarily on
+even when a presentation is given multiple times, the content changes.</p><ul><li>[workshop] &quot;Creating new PHP extensions in Rust,&quot; <em>Longhorn PHP Conference</em>. Austin, Texas, October 2026. Upcoming.</li><li>&quot;From First PR to Release Manager: A Path into Open Source,&quot; <em>FOSSY 2026</em>. Vancouver, Canada, August 2026. (<a href="./files/20260806 FOSSY presentation.pdf">Slides</a>, <a href="./blog/20260810-fossy-2026">Blog write up</a>)</li><li>&quot;Semantic Versioning and the PHP Ecosystem: A Reality Check,&quot; <em>PHP Tek 2026</em>. Chicago, Illinois, May 2026. (<a href="./files/20260521 PHPTek SemVer presentation.pdf">Slides</a>, <a href="./blog/20260525-phptek-2026">Blog write up</a>)</li><li>&quot;PHP 8.6: The Inside Scoop&quot;<ul><li><em>Longhorn PHP Conference</em>. Austin, Texas, October 2026. Upcoming.</li><li><em>PHP Tek 2026</em>. Chicago, Illinois, May 2026. (<a href="./files/20260520 PHPTek PHP 8.6 presentation.pdf">Slides</a>, <a href="./blog/20260525-phptek-2026">Blog write up</a>)</li></ul></li><li>&quot;Introduction to Rust for Experienced Software Developers,&quot; <em>ConFoo Montreal 2026</em>. Montreal, Canada, February 2026. (<a href="./files/20260225 ConFoo Rust presentation.pdf">Slides</a>, <a href="./blog/20260302-confoo#content-intro-to-rust">Blog write up</a>)</li><li>&quot;PHP 8.5: New Features from the Source&quot;<ul><li><em>ConFoo Montreal 2026</em>. Montreal, Canada, February 2026. (<a href="./files/20260226 ConFoo PHP presentation.pdf">Slides</a>, <a href="./blog/20260302-confoo#content-php-85">Blog write up</a>)</li><li><em>MergePHP</em>. Remote, November 2025. (<a href="./files/20251117 MergePHP presentation.pdf">Slides</a>, <a href="./blog/20251118-mergephp-talk">Blog write up</a>)</li><li><em>Longhorn PHP Conference</em>. Austin, Texas, October 2025. (<a href="./files/20251025 Longhorn PHP presentation.pdf">Slides</a>, <a href="./blog/20251029-longhorn-php#content-my-talk">Blog write up</a>)</li></ul></li></ul><h3 class="subsection-header">PHP</h3><p>I started contributing to the PHP source in August 2024, working primarily on
 bug fixes, improvements to the <a href="https://www.php.net/manual/en/book.reflection.php" target="_blank" class="external-link">Reflection extension</a> and various cleanup. In March 2025, I requested and was granted access to make
 direct changes (and approve others&#039; changes) to PHP. I also became the official
 maintainer of the reflection extension.</p><p>Also in March 2025, I volunteered to serve as one of the release managers for