Lyon, France. Talks in English and French.

I explain the layer under the one you use.

Name: Extensions de runtime cross-language : utiliser Go pour étendre PHP
Start: 2026-12-04
Location: DevFest Lyon

PHP engine, FrankenPHP, Symfony, Scrutineer. Security triage for The PHP Foundation.

Book a talk See the code

Alexandre Daubois on stage at the Dutch PHP Conference, 2026

29 stages · 15 cities · 11 recordings · 381 merged changes in Symfony · 2 RFCs in PHP 8.6 · 8 advisories credited · 21 articles

Who

The layer under yours

ROLE: CTO, Les-Tilleuls.coop
CORE TEAMS: PHP, Symfony (mergers, since 2025-02), FrankenPHP, Scrutineer
Status: Open for 2027 talks and workshops. Contact
Links: GitHub Bluesky X LinkedIn Sessionize Medium

Your application Symfony, Laravel, API Platform apps Where you work. I make the layers under it explainable.
Framework Symfony Core team. JsonPath component, HTTP QUERY, 380 merged changes.
Server FrankenPHP, Caddy Core team. Extension generator, Ember for observability.
Engine PHP, Zend Engine Two RFCs in PHP 8.6, bug fixes, deprecations, security fixes.

Security Across every layer PHP Foundation triage, Scrutineer with Alpha-Omega, 8 CVEs credited.

The layers, and where I work. Read from the top down.

Talks

On stage since 2021

DevFest LyonSymfonyCon WarsawGoLabForum PHPWeAreDevelopers World CongressAPI Platform ConAFUP Dayphp[tek]Dutch PHP ConferencePHP UK ConferenceWeb Days ConventionFOSDEMbetterCode() PHPDevFest ToulouseCodemotionInternational PHP ConferencePHPers SummitSymfonyWorld OnlineMalt AcademySymfonyLive ParisPimcore Inspire

29Stages since 2021

11Recordings

15Cities

Paris 5Lyon 4Amsterdam 3Lille 2Munich 2Toulouse 2Aix-en-Provence 1Bologna 1Brussels 1Chicago 1London 1Milan 1Poznań 1San José 1Warsaw 1

Next stage

17 Sep · API Platform Con, Lille

Observer FrankenPHP : la DX au service de la performance

Talk · FR · Event page

Add to calendar Book me next

In 3 daysdays

–hours

–minutes

Upcoming

Date	Where	Subject	Status
17 Sep	API Platform Con, Lille	Observer FrankenPHP : la DX au service de la performance fr	In 3 days
23 Sep	WeAreDevelopers World Congress, San José	Know Your Enemies: Live Exploit of a PHP Engine Security Breach en	In 9 days
08 Oct	Forum PHP, Paris	L'Ecosystem Security Team de la PHP Foundation de l'intérieur fr	In 24 days
01 Nov	GoLab, Bologna	Make your Go server observable in half a day Workshop, 180 min en	In 48 days
25 Nov	SymfonyCon Warsaw, Warsaw	Making Your Symfony App Observable Without the Pain Workshop, 1 day en	In 72 days
04 Dec	DevFest Lyon, Lyon	Extensions de runtime cross-language : utiliser Go pour étendre PHP fr	In 81 days
2027	Your conference	Engine, security, runtime, Go. Talk or workshop, EN or FR.	Open

Past talks

202120222023202420252026 AFUP Day, 22 May: JsonPath : pour des API incassables php[tek], 14 May: Writing PHP extensions in Go Dutch PHP Conference, 13 Mar: Supercharge your PHP apps with Go-powered PHP extensions PHP UK Conference, 20 Feb: Know Your Enemies: Live Exploit of a PHP Engine Security Breach Web Days Convention, 05 Feb: Au cœur d'une core team FOSDEM, 01 Feb: Know Your Enemies: Live Exploit of a PHP Engine Security Breach php[architect] Community Corner, 21 Jan: FrankenPHP with Alexandre Daubois betterCode() PHP, 25 Nov: FrankenPHP: The New Superpowered PHP Server DevFest Toulouse, 13 Nov: Au cœur d'une core team Codemotion, 14 Oct: Créer sa Malware Sandbox en PHP API Platform Con, 19 Sep: PIE: The Next Big Thing AFUP Day, 16 May: Détecter les battements du cœur humain en PHP Dutch PHP Conference, 21 Mar: PIE: The PHP's Next Big Thing International PHP Conference, 14 Nov: Streams: We All Underestimate PHP Redis International PHP Conference, 14 Nov: Apple Pkl: The Renewal of PHP Apps Configuration DevFest Toulouse, 07 Nov: Créer sa Malware Sandbox en PHP Forum PHP, 11 Oct: Covariance, Contravariance et Diamant Forum PHP, 10 Oct: Créer sa Malware Sandbox en PHP AFUP Day, 24 May: Composer 101 : gérer efficacement vos dépendances Dutch PHP Conference, 15 Mar: Iterators + Generators: The Road to Virtual Infinite RAM Forum PHP, 13 Oct: Streams : nous sous-estimons tous Predis !PHPers Summit, 27 May: Iterators: The Road to Virtual Infinite RAM SymfonyWorld Online, 17 Jun: Little-known Symfony components that are worth a look Malt Academy, 19 May: 6 composants (méconnus) de Symfony SymfonyLive Paris, 07 Apr: Des composants Symfony méconnus qui valent le détour Pimcore Inspire, 18 Nov: Symfony 5

With a recording With slides Talk only. Click a dot to jump to it.

20267 stages

Date	Stage	Subject	Recording
22 May	AFUP Day, Lyon	JsonPath : pour des API incassables fr
14 May	php[tek], Chicago	Writing PHP extensions in Go en
13 Mar	Dutch PHP Conference, Amsterdam	Supercharge your PHP apps with Go-powered PHP extensions en An LRU cache written in Go as a PHP extension, then used from Laravel and Symfony.
20 Feb	PHP UK Conference, London	Know Your Enemies: Live Exploit of a PHP Engine Security Breach en	Video
05 Feb	Web Days Convention, Aix-en-Provence	Au cœur d'une core team fr
01 Feb	FOSDEM, Brussels	Know Your Enemies: Live Exploit of a PHP Engine Security Breach en Main track, K.1.105 La Fontaine. I exploit a patched vulnerability and a backdoor that reached RC, live, in a sandbox.	Video
21 Jan	php[architect] Community Corner	FrankenPHP with Alexandre Daubois podcast en	Video

20256 stages

Date	Stage	Subject	Recording
25 Nov	betterCode() PHP	FrankenPHP: The New Superpowered PHP Server en
13 Nov	DevFest Toulouse, Toulouse	Au cœur d'une core team fr
14 Oct	Codemotion, Milan	Créer sa Malware Sandbox en PHP en Cybersecurity track. That afternoon I ran my first circuit on a real quantum computer.
19 Sep	API Platform Con, Lille	PIE: The Next Big Thing en	Video
16 May	AFUP Day, Lyon	Détecter les battements du cœur humain en PHP fr
21 Mar	Dutch PHP Conference, Amsterdam	PIE: The PHP's Next Big Thing en	Video

20247 stages

Date	Stage	Subject	Recording
14 Nov	International PHP Conference, Munich	Streams: We All Underestimate PHP Redis en
14 Nov	International PHP Conference, Munich	Apple Pkl: The Renewal of PHP Apps Configuration en
07 Nov	DevFest Toulouse, Toulouse	Créer sa Malware Sandbox en PHP fr
11 Oct	Forum PHP, Paris	Covariance, Contravariance et Diamant fr	Video Slides
10 Oct	Forum PHP, Paris	Créer sa Malware Sandbox en PHP fr	Video
24 May	AFUP Day, Lyon	Composer 101 : gérer efficacement vos dépendances fr	Slides
15 Mar	Dutch PHP Conference, Amsterdam	Iterators + Generators: The Road to Virtual Infinite RAM en	Video Slides

20232 stages

Date	Stage	Subject	Recording
13 Oct	Forum PHP, Paris	Streams : nous sous-estimons tous Predis ! fr	Video Slides
27 May	PHPers Summit, Poznań	Iterators: The Road to Virtual Infinite RAM en	Slides

20223 stages

Date	Stage	Subject	Recording
17 Jun	SymfonyWorld Online	Little-known Symfony components that are worth a look en
19 May	Malt Academy	6 composants (méconnus) de Symfony fr	Video Slides
07 Apr	SymfonyLive Paris, Paris	Des composants Symfony méconnus qui valent le détour fr First conference talk.	Slides

20211 stage

Date	Stage	Subject	Recording
18 Nov	Pimcore Inspire	Symfony 5 en	Video Slides

Code

What I build and fix

PHP RFCs

Date	RFC	Status
30 Jan	pack()/unpack() endianness modifiers for floating-point numbers	Accepted 11 yes, 0 no
21 Nov	pack()/unpack() endianness modifiers on integers	Accepted

Created

Ember Real-time terminal dashboard for Caddy and FrankenPHP, with Prometheus export and a daemon mode. The FrankenPHP docs recommend it. v1.6.1 FrankenPHP extension generator Write a PHP extension in Go, no C. FrankenPHP shipped it in 2025-06. Fifty follow-up changes since. Symfony JsonPath New component in Symfony 7.3. RFC 9535 functions and custom functions in 8.1. Also its ReDoS fix, CVE-2026-45756. lazy-stream Write and read streams only when needed. PHP. v1.6.1 phikl Apple's Pkl bridge for PHP. 0.8.5 quo A quantum circuit simulator in Go. I wrote it to understand how the maths runs.

Contributions

381 Symfony Top 5 contributor in 2023, 2024 and 2025. 50 PHP interpreter Bug fixes, deprecations for 8.5, fast ZPP conversions. 71 Scrutineer Core team. Alpha-Omega's open-source security scanner: scheduled scans, fix validation, disclosure workflow, advisory deep-dives, federation. 90 FrankenPHP Extension generator, docs, metrics. 361 Symfony docs Second most active contributor in 2023. 10 PIE The PHP Installer for Extensions.

Merged changes, refreshed nightly from GitHub.

Security

Date	Item
14 Jul	Joined The PHP Foundation as a contracted developer on security: triage, validation and fixes for php-src reports.
23 Jun	Scrutineer: Alpha-Omega's open-source scanner that finds, reproduces and reports vulnerabilities across ecosystems. The PHP Foundation named my contributions as what lets more people scan PHP projects.
18 May	Alpha-Omega, the OpenSSF and Linux Foundation initiative for open-source security, funds the PHP Foundation's Ecosystem Security Team. Scrutineer is the tooling that team shares with other languages.
20 May	Twig 3.26.0: thirteen CVEs. Fixes by Fabien Potencier, Nicolas Grekas and me.
20 May	CVE-2026-45756: ReDoS in Symfony JsonPath match() and search(). My fix.

Advisory credits

8 GitHub security advisories credit me. Full list on GitHub.

Advisories8 on record

Reference	Advisory
CVE-2026-54162	Ember has unneutralized terminal escape/control sequences from Caddy logs injected into t…
CVE-2026-54164	API Platform Core: Relation IRIs are not type-checked: a related resource can be denormal…
CVE-2026-45756	Symfony's JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits
CVE-2026-45755	Symfony's Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC
CVE-2026-45754	Symfony's Mailjet Mailer Webhook Parser Never Verifies the Configured Secret
CVE-2026-45075	Symfony's HEAD Request Bypasses methods
CVE-2026-45070	Symfony has Email Header Injection via Non-Token Characters in Mime Parameter Names
CVE-2024-50343	Symfony has an incorrect response from Validator when input ends with `\n`

Writing

A book and some articles

Book Clean Code in PHP Expert tips and best practices to write beautiful, human-friendly, and maintainable PHP Packt, Oct 2022, with Carsten Windler.

Date	Article	Where
10 Aug	I Had An AI Agent Port Duke Nukem 3D to My iPhone The tests stayed green while confirming a bug, twice.	ITNEXT
05 May	I Always Congratulate, Even When They're Wrong	Analyst's Corner
28 Apr	Building a Monitoring Tool #2: Designing the CLI with Cobra	ITNEXT
20 Apr	Go Is Not Magic: The Internals of The Garbage Collector	ITNEXT
13 Apr	Go Is Not Magic: The Internals of the GMP Scheduler	ITNEXT
09 Apr	Building a Monitoring Tool #1: Real-Time Observability Without the Bloat	ITNEXT
30 Mar	Ember: Real-time monitoring for Caddy and FrankenPHP	ITNEXT
24 Mar	Quantum Supremacy vs. Quantum Advantage: State of The Union	ITNEXT
24 Feb	I Joined 3 Major Open-Source Core Teams Last Year. Here's My Reality Check.	ITNEXT
09 Feb	I Built a Quantum Simulator in Go, and It's Not as Hard as You Think	ITNEXT
Dec 2025	Quantum Computing Won't Break the Internet. It Will Just Force Us to Update It.	ITNEXT
Nov 2025	No, Quantum Computing Doesn't "Try Every Possibility at Once"	ITNEXT
Oct 2025	I want to learn Quantum Computing, and I'm not a Physicist	Medium
25 Aug	Writing PHP extensions in Go with FrankenPHP	Les-Tilleuls.coop
2024	Introducing Phikl: Apple PKL in PHP	Medium
30 Sep	Emojis are new Symfony's best friends!	SensioLabs Tech Blog
22 Apr	Symfony's MIME in 5 minutes	SensioLabs Tech Blog
03 Mar	Symfony Internals #1: Inside the Framework Configuration	SensioLabs Tech Blog
2022	Symfony Internals #2: Data Validation	SensioLabs Tech Blog
07 Jun	Why PHP finally makes you a (more) rigorous developer	Medium
2021	Ultimate Guide to Symfony Components (2021) The article my first talks came from.	Medium

Contact

Say hello

Bios in both languages, two lengths. Copy any block as is.

[email protected]

GitHub alexandre-daubois Bluesky @alexdaubois.bsky.social X @alexdaubois LinkedIn alexandre-daubois Sessionize alexandre-daubois Medium alex-daubois

Short bio, English

Alexandre Daubois is CTO at Les-Tilleuls.coop, a member of the PHP, Symfony and FrankenPHP core teams, and a security contractor for The PHP Foundation. He sits on the core team of Scrutineer, Alpha-Omega's open-source security scanner, co-wrote Clean Code in PHP and speaks about what happens under the framework: the engine, the server, the runtime.

Bio courte, français

Alexandre Daubois est CTO chez Les-Tilleuls.coop, membre des core teams PHP, Symfony et FrankenPHP, et travaille sur la sécurité de PHP pour The PHP Foundation. Il fait partie de la core team de Scrutineer, le scanner de sécurité open source d'Alpha-Omega, a coécrit Clean Code in PHP et parle de ce qui se passe sous le framework : le moteur, le serveur, le runtime.

Long bio, English

Alexandre Daubois is CTO at Les-Tilleuls.coop. He sits on the Symfony core team and the FrankenPHP core team, and contributes to the PHP interpreter, where two of his RFCs shipped in PHP 8.6. Since July 2026 he triages and fixes security reports for php-src with The PHP Foundation, and he sits on the core team of Scrutineer, the open-source security scanner Alpha-Omega builds with the ecosystem security engineers of PHP and other languages. He created the Symfony JsonPath component, the FrankenPHP extension generator that lets you write PHP extensions in Go, and Ember, a real-time terminal dashboard for Caddy and FrankenPHP. He co-wrote Clean Code in PHP (Packt, 2022). His talks at FOSDEM, php[tek], the Dutch PHP Conference, Forum PHP, API Platform Con and GoLab each take one tool you use every day and show how it works, demo first.

Bio longue, français

Alexandre Daubois est CTO chez Les-Tilleuls.coop. Membre des core teams Symfony et FrankenPHP, il contribue aussi à l'interpréteur PHP, où deux de ses RFC sont entrées dans PHP 8.6. Depuis juillet 2026, il trie et corrige les rapports de sécurité de php-src avec The PHP Foundation, et il fait partie de la core team de Scrutineer, le scanner de sécurité open source qu'Alpha-Omega construit avec les ingénieurs sécurité des écosystèmes PHP et d'autres langages. Il a créé le composant Symfony JsonPath, le générateur d'extensions de FrankenPHP qui permet d'écrire des extensions PHP en Go, et Ember, un tableau de bord temps réel pour Caddy et FrankenPHP. Il a coécrit Clean Code in PHP (Packt, 2022). Ses conférences, au FOSDEM, à php[tek], à la Dutch PHP Conference, au Forum PHP, à l'API Platform Con et à GoLab, prennent un outil que vous utilisez tous les jours et montrent comment il fonctionne, démo d'abord.