Schedule

At Symfony 2025 we asked “Package Manager Security in 2025: What’s Next?” and outlined our long term supply chain security strategy. Reality caught up with us fast!

The PHP ecosystem has been hit by the same class of supply chain attacks that has repeatedly hit npm and PyPI: taken-over GitHub accounts and stolen access tokens used to publish malicious tags on packages the attackers had no legitimate access to. This talk walks through what we changed across Composer and Packagist in response, and what is still in flight.

Our response came in two phases. First, detection: the Aikido malware feed integrated into Packagist.org, a public transparency log that helped analyze attacks. Then the prevention work: Composer 2.10's unified dependency policy framework covering malware, advisories, and abandoned packages, stable version immutability on Packagist.org so tagged releases can no longer be silently rewritten. We’ll look at more recent changes like Composer 2.11’s minimum-release-age configuration, maintainer security posture and MFA status publication on Packagist, and the new organization level ownership and controls over open-source packages on Packagist.org.

We’ll provide concrete tips and best practices for keeping your own supply chain secure, and give an outlook into what we have planned for 2027.

APIs are the foundation of our AI applications today and need to be secure. From broken authorisation and authentication to injection attacks, the OWASP API Security Top 10 identifies the most critical security issues facing APIs today. In this talk, we'll walk through the items on the list and explore these security flaws and look at how to prevent them. By the end of this session, you'll have a clear understanding of the most critical API security risks and be equipped with the knowledge to build more secure APIs.

Diversity is a big topic and yet a lot of companies I encounter are hardly diverse. What could be the cause, and how can we change this?

Are you aware of how your daily common language may exclude certain people or groups? Could it be that implicit bias and our own behaviour may impact our chances of improving diversity? Slightly changing your language and behaviour and being aware of potential pitfalls may make your workplace more inclusive and welcoming. In this talk we'll discuss 10 situations in which we can improve our daily (work) life to be more inclusive. It includes practical examples that can be directly applied to your team or company.

Developers know one golden rule: never use innerHTML on user input. Yet, as we're integrating Large Language Models (LLMs) into our applications, we often make a fatal mistake. We're treating AI output as a trusted source. This is fine. Well, not automatically....

Let’s look at OWASP LLM05 and how "Improper Output Handling" affects web security. Therefore, let's discuss examples of how safe inputs can trick models, leading to vulnerabilities such as XSS and injection attacks. By the end, you’ll learn how to be "professionally pessimistic" for AI. You’ll see how to sanitize LLM data, safely render Markdown, and manage AI-generated content. Let's approach technology with caution, I look forward to exploring this with you! ❤️

Most Symfony applications buffer everything: Doctrine results, serialized objects, JSON, exports. They build the entire response, then send it. This works fine, until it doesn't: memory spikes, time-to-first-byte creeps up, and exports start dying in production.

LLMs make the problem impossible to ignore. When a model takes several seconds to answer, waiting for the return means staring at a spinner the whole time. Streaming isn't a back-end optimization anymore. It's the foundation modern user experience is built on.

In this talk, we tear down an assumption baked into most Symfony apps: that a response has to be fully built before it's sent. We'll rethink the data flow end to end, StreamedResponse, incremental JSON encoding with the JsonStreamer component, iterable Doctrine data sources, Server-Sent Events, and EventStreamResponse for real time.

You'll walk away knowing how to stream data as it's produced, power live interfaces, generate exports of several million rows, and keep memory flat, using tools already sitting in Symfony.

In order to be able to show growth and improve myself as a developer and coworker, I need a system. Previous attempts at journaling failed, but with the rise of LLM and AI, there is a new option.

In this talk, I explain my journaling system, how it works for me, and how you can use the open sourced template to make it your own.

This is for developers: it is not an app, nor a SaaS. It's something you can use within your own IDE, with your own workflow, and your own modifications.

I've been using this system for a year now. It has grown, like I have. I will share some of the pitfalls and improvements I've went through so far, which includes better text writing, use of MCPs to pull data from other systems, and more.