PHPStan 2.3: Leap in Performance, Generics Improvements, Detecting Unused Variables, and More!
I had so much fun with the interactive charts and widgets, check out the article. I promise it's worth checking it out yourself, and not just letting your agent summarize it for you 😉 It contains a lot of interactive widgets with practical examples of the new features in action.
Every software platform eventually deals with serious vulnerabilities.
So when evaluating a platform's security, I don't think "Has this software ever had a serious vulnerability?" is a particularly useful question.
A better question is: What happens when one is found?
I started thinking about this after reading about the recent Citrix NetScaler zero-day. It also got me thinking about something Drupal has built specifically for that uncomfortable period between disclosure of a critical vulnerability and getting the actual patch deployed: Drupal Steward.
For certain highly critical, mass-exploitable vulnerabilities, Steward can provide network-level protection while organizations test and deploy the software update. It doesn't replace patching, but it can make that "patch gap" less dangerous.
I dug into Steward, Drupal's coordinated security process, and why I think the response to vulnerabilities tells us more about a platform's security than the existence of vulnerabilities themselves:
Zero-Days Happen. What Matters Is What Happens Next.
I'm especially curious: who here is actually using Drupal Steward? What's your experience been with it?