I explain the layer under the one you use.
ALEXANDRE DAUBOIS
PHP engine, FrankenPHP, Symfony, Scrutineer. Security triage for The PHP Foundation.
Lyon, France. Talks in English and French.
| Revision record | |
|---|---|
| REV 2026.09.02 | First edition. |
1.0 Identification
- ROLE
- CTO, Les-Tilleuls.coop
- CORE TEAMS
- PHP, Symfony (mergers, since 2025-02), FrankenPHP, Scrutineer
- SECURITY
- The PHP Foundation, contracted, since 2026-07. Triage and fixes for php-src. Core team of Scrutineer, Alpha-Omega's open-source security scanner.
- BOOK
- Clean Code in PHP, Packt, 2022, with Carsten Windler
- LANGUAGES
- English, French
- BASE
- Lyon, France. Travels for talks.
- STATUS
- Open for 2027 talks and workshops. Press kit and contact, 5.0
- LINKS
- GitHub · Bluesky · X · LinkedIn · Sessionize · Medium
- Your application Symfony, Laravel, API Platform apps Where you work. I make the layers under it explainable.
- Framework Symfony Core team. JsonPath component, HTTP QUERY, 380 merged changes.
- Server FrankenPHP, Caddy Core team. Extension generator, Ember for observability.
- Engine PHP, Zend Engine Two RFCs in PHP 8.6, bug fixes, deprecations, security fixes.
2.0 Field history
29 stages since 2021. 11 recordings.
······ ·· ············ ················ ····
······························· · ····· ············ ··············
···························· ·· ······· ······ ···· ······ ······ ··
························ ···· ···· ······· ··········
························· ······ ·· · ··· ·········
·························· ········· · · · ···········
··························· ············· ·· ··● ●·····●··●··········
·································· · · ·●●····················
·································· ····●·●●·············· ·
······························· · ··●·●· ●· ········
····················●········ ······ · ·· ··· · ······
●························· ····· ·· · ·······
························· ·········· · ··
····················· ·············· ·· ···
·········· · ·····························
······ · ···························· ··
····· · ······························ ·
····· ·· · ······························
······· ·······························
···· ································
· ···· ·······························
·· ··········· ······························
·············· ····· ····················
················ ·················
··················· ··················
························ ·················
·························· ···············
························ ···············
······················ ···············
···················· ················
················· ··············
2.1 Scheduled
| Sched. | Destination | Subject | Status |
|---|---|---|---|
| 17 SEP | API Platform Con, Lille | Observer FrankenPHP : la DX au service de la performance fr | T-15d |
| 23 SEP | WeAreDevelopers World Congress, San José | Know Your Enemies: Live Exploit of a PHP Engine Security Breach en | T-21d |
| OCT 2026 | Forum PHP, Paris | L'Ecosystem Security Team de la PHP Foundation de l'intérieur fr | Booked |
| 01 NOV | GoLab, Bologna | Make your Go server observable in half a day workshop, 180 min en | T-60d |
| NOV 2026 | SymfonyCon Warsaw, Warsaw | Making Your Symfony App Observable Without the Pain workshop, 1 day en | Booked |
| DEC 2026 | DevFest Lyon, Lyon | To be announced fr | Booked |
| 2027 | Your conference | Engine, security, runtime, Go. Talk or workshop, EN or FR. | Open |
2.2 Log
| Date | Stage | Subject | Rec. |
|---|---|---|---|
| 2026 | |||
| MAY | AFUP Day, Lyon | JsonPath : pour des API incassables fr | |
| 14 MAY | php[tek], Chicago | Writing PHP extensions in Go en | |
| 13 MAR | Dutch PHP Conference, Amsterdam | Supercharge your PHP apps with Go-powered PHP extensions en An LRU cache written in Go as a PHP extension, then used from Laravel and Symfony. |
|
| 20 FEB | PHP UK Conference, London | Know Your Enemies: Live Exploit of a PHP Engine Security Breach en | video |
| 05 FEB | Web Days Convention, Aix-en-Provence | Au cœur d'une core team fr | |
| 01 FEB | FOSDEM, Brussels | Know Your Enemies: Live Exploit of a PHP Engine Security Breach en Main track, K.1.105 La Fontaine. I exploit a patched vulnerability and a backdoor that reached RC, live, in a sandbox. |
video |
| 21 JAN | php[architect] Community Corner | FrankenPHP with Alexandre Daubois podcast en | video |
| 2025 | |||
| 25 NOV | betterCode() PHP | FrankenPHP: The New Superpowered PHP Server en | |
| 13 NOV | DevFest Toulouse, Toulouse | Au cœur d'une core team fr | |
| OCT | Codemotion, Milan | Créer sa Malware Sandbox en PHP en Cybersecurity track. That afternoon I ran my first circuit on a real quantum computer. |
|
| 19 SEP | API Platform Con, Lille | PIE: The Next Big Thing en | video |
| MAY | AFUP Day, Lyon | Détecter les battements du cœur humain en PHP fr | |
| 21 MAR | Dutch PHP Conference, Amsterdam | PIE: The PHP's Next Big Thing en | video |
| 2024 | |||
| NOV | International PHP Conference, Munich | Streams: We All Underestimate PHP Redis en | |
| NOV | International PHP Conference, Munich | Apple Pkl: The Renewal of PHP Apps Configuration en | |
| NOV | DevFest Toulouse, Toulouse | Créer sa Malware Sandbox en PHP fr | |
| OCT | Forum PHP, Paris | Covariance, Contravariance et Diamant fr | video · slides |
| OCT | Forum PHP, Paris | Créer sa Malware Sandbox en PHP fr | video |
| 24 MAY | AFUP Day, Lyon | Composer 101 : gérer efficacement vos dépendances fr | slides |
| 15 MAR | Dutch PHP Conference, Amsterdam | Iterators + Generators: The Road to Virtual Infinite RAM en | video · slides |
| 2023 | |||
| OCT | Forum PHP, Paris | Streams : nous sous-estimons tous Predis ! fr | video · slides |
| 27 MAY | PHPers Summit, Poznań | Iterators: The Road to Virtual Infinite RAM en | slides |
| 2022 | |||
| JUN | SymfonyWorld Online | Little-known Symfony components that are worth a look en | |
| 19 MAY | Malt Academy | 6 composants (méconnus) de Symfony fr | video · slides |
| APR | SymfonyLive Paris, Paris | Des composants Symfony méconnus qui valent le détour fr First conference talk. |
slides |
| 2021 | |||
| 18 NOV | Pimcore Inspire | Symfony 5 en | video · slides |
3.0 Parts supplied
3.1 PHP RFCs
| Date | RFC | Status |
|---|---|---|
| 30 JAN | pack()/unpack() endianness modifiers for floating-point numbers | Accepted 11 yes, 0 no |
| 21 NOV | pack()/unpack() endianness modifiers on integers | Accepted |
3.2 Created
- Ember
- Real-time terminal dashboard for Caddy and FrankenPHP, with Prometheus export and a daemon mode. The FrankenPHP docs recommend it. v1.6.1
- FrankenPHP extension generator
- Write a PHP extension in Go, no C. FrankenPHP shipped it in 2025-06. Fifty follow-up changes since.
- Symfony JsonPath
- New component in Symfony 7.3. RFC 9535 functions and custom functions in 8.1. Also its ReDoS fix, CVE-2026-45756.
- lazy-stream
- Write and read streams only when needed. PHP. v1.6.1
- phikl
- Apple's Pkl bridge for PHP. 0.8.5
- quo
- A quantum circuit simulator in Go. I wrote it to understand how the maths runs.
3.3 Contributions
| Project | Merged | Note |
|---|---|---|
| Symfony | 380 | Top 5 contributor in 2023, 2024 and 2025. |
| PHP interpreter | 49 | Bug fixes, deprecations for 8.5, fast ZPP conversions. |
| Scrutineer | 68 | Core team. Alpha-Omega's open-source security scanner: scheduled scans, fix validation, disclosure workflow, advisory deep-dives, federation. |
| FrankenPHP | 90 | Extension generator, docs, metrics. |
| Symfony docs | 361 | Second most active contributor in 2023. |
| PIE | 10 | The PHP Installer for Extensions. |
3.4 Security
3.5 Advisory credits
8 GitHub security advisories credit me. Full list on GitHub.
4.0 Writings
- BOOK
- Clean Code in PHP, Packt, OCT 2022, with Carsten Windler.
5.0 Press kit
Copy any block as is. Both languages, two lengths.
5.1 Contact
- [email protected]
- GITHUB
- alexandre-daubois
- BLUESKY
- @alexdaubois.bsky.social
- X
- @alexdaubois
- alexandre-daubois
- SESSIONIZE
- alexandre-daubois
- MEDIUM
- alex-daubois
5.2 Bio, short, English
Alexandre Daubois is CTO at Les-Tilleuls.coop, a member of the PHP, Symfony and FrankenPHP core teams, and a security contractor for The PHP Foundation. He sits on the core team of Scrutineer, Alpha-Omega's open-source security scanner, co-wrote Clean Code in PHP and speaks about what happens under the framework: the engine, the server, the runtime.
5.3 Bio, long, English
Alexandre Daubois is CTO at Les-Tilleuls.coop. He sits on the Symfony core team and the FrankenPHP core team, and contributes to the PHP interpreter, where two of his RFCs shipped in PHP 8.6. Since July 2026 he triages and fixes security reports for php-src with The PHP Foundation, and he sits on the core team of Scrutineer, the open-source security scanner Alpha-Omega builds with the ecosystem security engineers of PHP and other languages. He created the Symfony JsonPath component, the FrankenPHP extension generator that lets you write PHP extensions in Go, and Ember, a real-time terminal dashboard for Caddy and FrankenPHP. He co-wrote Clean Code in PHP (Packt, 2022). His talks at FOSDEM, php[tek], the Dutch PHP Conference, Forum PHP, API Platform Con and GoLab each take one tool you use every day and show how it works, demo first.
5.4 Bio, courte, français
Alexandre Daubois est CTO chez Les-Tilleuls.coop, membre des core teams PHP, Symfony et FrankenPHP, et travaille sur la sécurité de PHP pour The PHP Foundation. Il fait partie de la core team de Scrutineer, le scanner de sécurité open source d'Alpha-Omega, a coécrit Clean Code in PHP et parle de ce qui se passe sous le framework : le moteur, le serveur, le runtime.
5.5 Bio, longue, français
Alexandre Daubois est CTO chez Les-Tilleuls.coop. Membre des core teams Symfony et FrankenPHP, il contribue aussi à l'interpréteur PHP, où deux de ses RFC sont entrées dans PHP 8.6. Depuis juillet 2026, il trie et corrige les rapports de sécurité de php-src avec The PHP Foundation, et il fait partie de la core team de Scrutineer, le scanner de sécurité open source qu'Alpha-Omega construit avec les ingénieurs sécurité des écosystèmes PHP et d'autres langages. Il a créé le composant Symfony JsonPath, le générateur d'extensions de FrankenPHP qui permet d'écrire des extensions PHP en Go, et Ember, un tableau de bord temps réel pour Caddy et FrankenPHP. Il a coécrit Clean Code in PHP (Packt, 2022). Ses conférences, au FOSDEM, à php[tek], à la Dutch PHP Conference, au Forum PHP, à l'API Platform Con et à GoLab, prennent un outil que vous utilisez tous les jours et montrent comment il fonctionne, démo d'abord.
5.6 Photo
6.0 Colophon
- A nightly build reads Sessionize, GitHub, Packagist, YouTube, wiki.php.net and Medium, then rewrites this page. REV on the first line is the last build.
- I write the bios by hand. A script writes the rest.
- The titles use IBM VGA 9x16, the text-mode font of the PC, in VileR's remake (int10h.org, CC BY-SA 4.0). The text uses IBM Plex Mono. The board uses B612 Mono, the typeface Airbus commissioned for cockpit screens.
- The amber is #FFB000, close to the P3 phosphor of amber terminals, which peaks around 602 nm.
- curl daubois.dev returns this manual as plain text.
- One script runs on this page, for the board. Nothing tracks you.
- Source: github.com/alexandre-daubois/daubois.dev
- Last fetch: 2026-09-02 09:52 UTC.
END OF MANUAL · EK-DAUBOIS-RM-001 · REV 2026.09.02