Fibers are mature, AMPHP and ReactPHP share one event loop via Revolt, and the concurrency jokes are finally wrong. So how much must a Drupal dev learn? Almost none directly — Drupal's synchronous DB blocks the whole model. The one real win (parallel outbound HTTP in a queue worker) Guzzle already gives you, no Fibers required.
Every time() and new \DateTime() buried in your logic is a hidden dependency on the one thing you can't pause — and it's why your time-sensitive tests are flaky. Inject Drupal's TimeInterface (already there) or Symfony's Clock (freeze and advance instantly in tests). Where Drupal's built-in falls short, and the discipline that makes 'what happens at midnight?' a test you can actually run.
CVE-2026-45034 (CVSS 9.2) bypasses an earlier PhpSpreadsheet fix because one extra slash makes parse_url() return false, walking past the guard and re-enabling phar deserialization. The real villain isn't the library — it's using parse_url() as a security boundary, a recurring PHP footgun the advisory itself warns against.
CVE-2026-71488 in league/commonmark — the Markdown parser behind Laravel, Drupal, Statamic and more — turns a single non-ASCII character into O(n²) parsing. No RCE, no leak, just one long line with an emoji pinning a CPU. Why algorithmic-complexity DoS is the vuln class nobody threat-models, and why you should benchmark parsers with adversarial input.
PHP's own JIT authors admitted it barely helps real apps like WordPress — ~3.5%. Here's why: a Drupal page is I/O-bound, and Amdahl's law caps what JIT can ever do to ~11% even if it made the CPU work infinitely fast. What actually speeds a site up instead (OPcache, preloading, a real cache backend), and the CPU-bound cases where JIT genuinely earns its keep.
Attribute hooks have been stable since Drupal 11.1, so I converted this blog's SEO module from a procedural .module file to a #[Hook] class. The catch nobody mentions: procedural hooks aren't actually deprecated yet and won't be removed before Drupal 13, around 2028. What's worth doing now, what isn't, and the LegacyHook trap that quietly fires your hook twice.
Field notes on running Drupal 10/11 on FrankenPHP in classic mode today, why worker mode is still off-limits for Drupal, and how it sits behind my Traefik/Coolify setup.
Laravel's official AI SDK wraps a dozen providers in one expressive API, with agents as plain PHP classes and real test fakes. What it does well — and where I'd stay cautious.
