Longhorn PHP 2026
15 - 16 Oct 2026 at Holiday Inn Austin Midtown

A hands-on workshop walking through the full AI-assisted development loop: setting up Claude Code or GitHub Copilot with a real PHP project, writing effective system prompts and context files, using AI for code review and refactoring, integrating AI-generated tests, and building CI/CD gates that catch AI hallucinations before they ship. Attendees bring their own laptops and leave with a working AI-augmented workflow they can apply to their actual projects Monday morning.

Software teams don't usually fail because individuals do bad work. They fail because the work doesn't stay in sync. A product manager writes acceptance criteria in a ticket. A backend engineer implements against their interpretation of it. A frontend team builds to a Postman collection that drifted from the real API weeks ago. A QA engineer writes tests against behavior that was changed in a meeting nobody documented. By the time something ships, four teams have four versions of the truth — and the API is a fifth. This tutorial is about eliminating that gap at its source. The central argument is simple: an OpenAPI description, written carefully, is the acceptance criteria. An Arazzo workflow document is the user journey spec. A Schemathesis test run is the QA sign-off. A PHPUnit test suite is the living proof that the implementation honors the contract. When product, frontend, backend, and QA all work from the same machine-readable artifact, synchronization stops being a communication problem and becomes a tooling problem — one with tractable solutions. We open by establishing OpenAPI as a shared contract, not a documentation afterthought. Attendees will learn to write descriptions that encode acceptance criteria precisely enough that product managers can review them, backend engineers can implement against them, frontend engineers can mock from them on day one, and QA engineers can derive test cases from them automatically. One file. Four audiences. No translation layer. We then introduce Arazzo to capture what OpenAPI alone cannot: the sequences, dependencies, and conditional flows that define how real users move through an API. Multi-step scenarios — authentication, onboarding, checkout, error recovery — become versioned, reviewable workflow documents that product and engineering sign off on together, rather than living in someone's head or buried in a Confluence page nobody updates. Finally, we wire both specifications into Schemathesis, demonstrating how a spec that product and engineering already agreed on becomes a test suite that runs in CI without QA having to write it from scratch. Failures surface as violations of the shared contract, not as ambiguous bug reports — making it immediately clear whether the issue is in the implementation, the spec, or the original requirement. Throughout, the tutorial treats the specification not as a technical artifact owned by engineers, but as the single surface where every role's concerns are expressed, negotiated, and verified. Attendees will leave with concrete workflows for keeping product tickets, API descriptions, mock servers, implementation, and test suites pointing at the same truth — and for making drift visible the moment it appears, rather than three weeks after a release. Target audience: Anyone who has ever been in a meeting where product, frontend, backend, and QA all had different answers to the question "what is this API supposed to do?" No prior OpenAPI experience is required.

Most codebases don't start messy — they evolve that way. Business logic bleeds into controllers, framework code wraps around your domain, and one day you realize: you're not driving the application anymore. The framework is. In this full-day hands-on workshop, we'll refactor a real-world PHP application step by step — moving from a tightly coupled codebase toward Clean Architecture, using Hexagonal Architecture principles along the way. We won't work with a "todo app." We'll use **Conduit** — the RealWorld Example App — a Medium-like blogging platform with real complexity: use cases with varying flows, and enough coupling to make the refactoring meaningful. **What we'll cover:** - A short theory foundation: Clean Architecture, ports & adapters, primary vs secondary actors — the *why*, not just the *what* - A group whiteboard exercise to map your own application's boundaries (primary vs secondary actors — this one clicks for people) - Live coding: extracting use cases, ports/adapters, domain layer, and read models - Real trade-offs: what to extract, when, and what it costs - Strangler Fig applied at the codebase level: how to make progress without stopping the world **By the end of the day, you'll know how to:** - Decouple business logic from your framework and infrastructure - Refactor incrementally — no big-bang rewrites - Apply Clean Architecture patterns with confidence, not cargo-culting - Argue the trade-offs clearly with your team The workshop has been delivered at **SymfonyCon Amsterdam 2025** (4.67/5 participant rating), **SymfonyOnline 2026**, **SymfonyLive Berlin 2026**, and as an in-house session at Masterlease Poland. Each edition improved the format — Berlin introduced a two-perspective whiteboard exercise and more structured coding-together time that participants responded especially well. **Audience:** Mid/Senior PHP developers who work with legacy or growing codebases **Prerequisites:** Comfort with PHP OOP; no prior Clean Architecture knowledge required **Stack:** PHP + Laravel (hands-on exercises)

Lunch

While PHP core comes with some nice functionality, the real power in PHP is found in extensions. Some of the functionality we take for granted come from extensions that are always enabled (e.g. the "standard" extension provides output buffering, array functions like sort() and in_array(), string utilities like trim() and explode(), and more). While plenty of extensions are bundled with PHP, and either always enabled (like reflection and json) or can be enabled with build flags (like mbstring and zip), extension can also be written separately. Third-party extensions include APCu, ImageMagick, Yaml and more. In this tutorial, we will cover how to create your own PHP extension. Initial topics include zvals, zend strings, hash tables, parameter parsing, and engine hooks. Hands-on examples will cover global functions, class registration, opaque types managed outside of the property system, and the use of external libraries. Extensions have been written in C, C++, Rust, and probably other languages too. This tutorial will be conducted in C, since that is the language that PHP is written in; the topics and examples provide a foundation for building extensions written in other languages as well.

Reading about injection teaches you the words. Exploiting it teaches you the lesson. This hands-on tutorial walks every OWASP Top 10 category inside a deliberately vulnerable PHP app—you'll find the bug, exploit it yourself, then fix it properly. We cover injection, broken access control, authentication failures, SSRF, insecure deserialization, and the rest, with concrete mitigations for Laravel, Symfony, and WordPress. You leave with muscle memory and a hardening checklist—not just awareness.

AustinPHP Meetup

Opening Announcements

PHP isn't an institution. It's people. Every feature you rely on, every security patch, every page of documentation exists because someone chose to show up. The PHP Foundation funds 12 core developers who work to keep the language secure, modern, and moving forward, but the language belongs to millions. The space between those 12 and those millions? That's where you come in. In this keynote, I'll take you inside what The PHP Foundation has been doing and why: the commits, reviews, and RFCs shaping PHP's future, the hard-won lessons about sustaining open source at the scale of the web, and how partnering with this community has moved PHP forward. I'll also be honest about what lies ahead. Because the challenges facing PHP are facing all of open source: aging and overwhelmed maintainers, uncertainty in AI times, funding gaps, and infrastructure that the whole internet depends on but few people sustain. These problems aren't solved by foundations alone. They're solved by communities that decide to act. PHP has given freely to our careers for over thirty years. Now we get to shape the next thirty. You don't need to be a core developer to matter here, you just need to show up, like every person who built this language and community has done. The future of PHP isn't something that happens to us. It's something we build, together.

You think you know Tetris. Falling blocks, line clears, gets faster — every developer alive has played it. But Tetris has a published 60-page specification called the Tetris Guideline that defines an eight-phase state machine, a 7-bag randomizer, a Super Rotation System with wall-kick offsets, T-spin detection, and three different placement-time rules. There's a 40-year competitive community, a licensing saga that became an Apple TV movie, and a teenager who in late 2023 became the first human to play far enough into NES Tetris to crash it. I built my own Tetris in PHP from the spec. This talk is what falling blocks taught me about specifications, state machines, bitmask encodings, and the strange power of communities that outlive the products that birthed them.

Join PHP core developer and veteran release manager Daniel Scherzer for a deep dive into the new features, syntax updates, deprecations, and surprises coming in PHP 8.6. While PHP 8.6 is still in the release candidate phase, now is the time to start preparing to upgrade.

JSON is the data interchange format of choice. But its performance in a relational database is horrible. RDMS are built around standard data types such as INTERGERS and CHAR. There are many good reasons to store data in JSON in your database, but you give up many powerful features of SQL to do so. The answer is JSON_DATA(), which *temporarily* converts JSON to relational data types, unleashing Window Functions, Aggregates, and more. You will learn how to perform simple conversions with JSON_TABLE(), move on to working with embedded data, and handle missing data or errors. Finally, we will look at alternatives that can be faster, such as materializing the data or using other JSON functions.

Where do you start when onboarding to a decade-old PHP application? "It depends!" This talk crosses "how to think like a Staff Engineer" with a specific scenario: You're new on a "legacy" PHP application looking to make a big impact. What factors should you consider, what questions should you be asking, and where should you focus first to ramp up faster? You won't find the most important answers you need anywhere in the code. Attendees will learn how to discover & prioritize business value, herd coworkers toward consensus, and generate real impact.

Running open-weight AI models as a hobby often begins innocently enough. You download a small model, ask it a few questions, and think, “That was neat.” A few weeks later, you are comparing quantization formats, benchmarking tokens per second, explaining to your family why the house is warmer than usual, and trying to convince your boss that a suspiciously high-end gaming GPU is actually a critical business expense. Local inference, however, is more than another hobby for nerds. It has a real place in the developer’s toolkit alongside frontier cloud models from Anthropic, OpenAI, and others. Frontier models remain the right choice when a task is urgent, difficult, or critical—but not every workload needs their full capability, cost, or dependency on a remote service. Open-weight models running on hardware you control are well suited to the low, slow, and long work: background agents, large-scale code analysis, document processing, experimentation, embeddings, reranking, and other tasks that benefit from privacy, predictable costs, or the freedom to run unattended for hours. Learning to operate these models also develops a next-generation engineering skill set that will become increasingly valuable across the software industry. Developers already understand that “the cloud” is just someone else’s computer. As AI becomes part of our everyday infrastructure, we need to understand what it takes to run that infrastructure ourselves: choosing models and runtimes, working within memory constraints, evaluating quality, and balancing speed, context length, concurrency, and cost. In this talk, we’ll explore how to get started without spending a fortune and how to turn a downloaded set of weights into a dependable development tool. We’ll look beyond the model itself to OpenAI-compatible APIs, routing, observability, embeddings, rerankers, and specialized models. We’ll also examine the relationship between open source and open weights. If developers care about understanding, modifying, and controlling the software they depend on, those same concerns increasingly apply to the models powering their toolchains. You do not need a data center, a research budget, or permission to expense a suspiciously large GPU. You can start small, learn the fundamentals, and gradually build local inference into a useful complement to cloud AI. Come for the practical guidance. Stay because you, too, may soon have strong opinions about four-bit quantization.

The open source world never stands still. Technologies evolve, best practices change, and the skills that matter today may look different tomorrow. Whether you're new to open source or have years of experience, learning is a constant. This session explores how to build a sustainable approach to learning in a rapidly changing ecosystem. We'll discuss why curiosity is one of the most valuable skills in open source, how certifications can serve as checkpoints rather than finish lines, and how community participation accelerates growth in ways that courses and documentation alone cannot. Through stories, practical examples, and lessons from open source communities and certification development, you'll learn strategies for maintaining momentum, overcoming common barriers to learning, and staying engaged without burning out. Whether you're exploring a new technology, preparing for a certification, or looking for your next opportunity to contribute, this session will help you stay curious, confident, and ready for what's next

Lunch / Open Spaces Signup

Developers can catch 90% of critical blocker accessibility issues with just a few quick checks. If each developer agrees to test their work for accessibility issues before committing to the branch or marking an issue as “Done,” they can prevent major accessibility problems from advancing through the development pipeline. We will walk through two tests for a total of 6 checkpoints you can do in a web browser that should uncover critical blockers that will prevent some people from using a webpage.

You've probably used OAuth without realizing it. Maybe you've signed in to an app using Google, authorized an app to post to your X/Twitter account, or granted access to your GitHub repositories. What's really going on under the hood? How does this handshake of trust actually work, and why do developers love (and sometimes loathe) implementing it? In this session, we'll peel back the layers of OAuth 2.0 and OpenID Connect to understand their roles in modern authentication and authorization. We'll demystify access tokens, refresh tokens, scopes, and the dance between resource servers and clients. You'll see how OpenID Connect extends OAuth to handle identity and login flows securely. And most importantly, we'll look at practical, real-world examples to make these concepts click. If you've ever felt overwhelmed by the acronyms or confused by the specs, this talk is for you. You'll leave with a solid mental model of how OAuth and OpenID Connect work together to make the web a safer, more connected place.

Ever faced a heavy computational task and thought, "Maybe PHP isn't the right tool for this"? Think again! With `ext-parallel`, multithreading is a reality in PHP. In this session, I'll show you how to use it to tackle demanding tasks, scale your applications, and unlock performance you didn’t think was possible — all without leaving PHP behind.

On the surface, the idea of code review is a no-brainer: why wouldn't we want a second set of eyes on our code, especially before deploying to production? As we peel back the layers, however, we find that the topic of code review is much more nuanced. How detailed should the review be? Who is qualified to perform the review (hint: it's not just senior developers)? Can we afford to take another developer away from their project to review this one? What steps can we take to ensure reviews are constructive, rather than demoralizing? Attendees will gain deeper insight into some of the arguments for and against systemic, peer code review, as well as pick up some useful tools to make code review a natural part of their teams' workflow.

Most PHP apps run behind nginx, but many developers only touch a small part of what it can do. In this session, we’ll walk through useful nginx features that anyone can start using, even if you’re not a DevOps specialist. We’ll cover how nginx interfaces with PHP, how to structure clean and maintainable config, and simple optimizations that can noticeably improve performance. We’ll also look at helpful features like caching, rate limiting, redirects, and ways to avoid common configuration mistakes. If nginx has ever felt like a mysterious black box, this session will help you understand it clearly and confidently, with examples you can take home and apply right away.

NativePHP has given PHP developers the ability to ship web apps as native iOS and Android apps. Like many things, just because one can doesn’t mean they should. This talk covers the different expectations users of mobile apps have and how to meet those expectations while using NativePHP.

No typing for 2 weeks. That's what my surgeon told me, before I was diagnosed with osteoarthritis in all of my fingers at 38 years old. For more than 2 years now I've been on a mission to type as little as possible and get even more work done using assistive technology, including AI. In this session, I'll summarize the hard-earned lessons from my attempts to use technology including laser eye tracking, facial gestures, foot pedals, Talon Voice, OS-native dictation and accessibility features, custom split mechanical keyboards, code scaffolding, automated tests, and AI. Then I will give a live demonstration of the assistive devices and tools I use today to save time, money, and lives with PHP at Texas Transportation Institute by creating a simple and tested API from public data using Laravel Blueprint.

Most developers use PHPUnit exactly as it comes out of the box, but PHPUnit is designed to be extended. In this session we'll explore the extension points that allow you to tailor PHPUnit to your application, your domain, and your development workflow. Through practical examples, we'll build custom assertions, reusable testing components, expressive constraints, and discover how PHPUnit's modern extension system can power your own testing tools. Along the way you'll see how a small amount of customization can make tests easier to read, easier to maintain, and more useful when they fail. Whether you've been using PHPUnit for six months or ten years, you'll leave with practical ideas for building a test suite that is cleaner, more expressive, and speaks the language of your application.

Many business processes begin with a status column and a few if statements. Then exceptions, retries, approvals, and failure paths appear. Before long, the workflow is scattered across controllers, services, queue consumers, scheduled jobs, and database updates, and nobody can say with confidence which transitions are valid or what should happen when something fails. In this hands-on session, we'll use state machines to make these workflows explicit, predictable, and testable in PHP. Using familiar examples such as orders, payments, withdrawals, onboarding, and identity verification, we'll model each process as a set of states, allowed transitions, guard conditions, and actions rather than relying on loose status strings. Using a real PHP state machine library, we'll build a workflow live, prevent invalid transitions, centralize the rules that determine what can happen next, and automatically trigger actions when the state changes. We'll also test the workflow logic independently of controllers and infrastructure. We'll then look at how a state machine fits into a real PHP application, including where the workflow logic should live and how the rest of the application should interact with it. You'll leave knowing how to recognize when a growing collection of conditionals should become an explicit workflow model and how to implement that model cleanly and testably in PHP.

Open Spaces

Every engineer eventually faces a commit they're not sure they should make. I've faced a few—and walked away from work I couldn't reconcile, including offensive AI targeting in defense and pivotal moments building cryptographic and financial infrastructure where the right call cost something real. This keynote isn't a lecture on morality. It's a candid account from twenty years in the rooms where these decisions get made: defense contracts, DARPA programs, crypto and distributed finance, and now AI. We'll talk about dual-use technology—the same embedding pipeline that powers search can power surveillance—and the quiet, compounding pressure to just ship. We'll talk about what it actually costs to say "no," why "I just built the tool" stopped being a defense years ago, and how to build a career where your conscience and your craft don't have to be enemies. You write the future for a living. This is a conversation about doing it on purpose.

Closing Announcements

Afterparty