1.0 ID

ROLE: CTO, Les-Tilleuls.coop
CORE TEAMS: PHP, Symfony (mergers, since 2025-02), FrankenPHP, Scrutineer
SECURITY: The PHP Foundation, contracted, since 2026-07. Triage and fixes for php-src. Core team of Scrutineer, Alpha-Omega's open-source security scanner.
BOOK: Clean Code in PHP, Packt, 2022, with Carsten Windler
LANGUAGES: English, French
BASE: Lyon, France. Travels for talks.
STATUS: Open for 2027 talks and workshops. Press kit and contact, 5.0
LINKS: GitHub · Bluesky · X · LinkedIn · Sessionize · Medium

Alexandre Daubois on stage at the Dutch PHP Conference, 2026 — Fig. 0. Unit, front view. Dutch PHP Conference, 2026.

Your application Symfony, Laravel, API Platform apps Where you work. I make the layers under it explainable.
Framework Symfony Core team. JsonPath component, HTTP QUERY, 380 merged changes.
Server FrankenPHP, Caddy Core team. Extension generator, Ember for observability.
Engine PHP, Zend Engine Two RFCs in PHP 8.6, bug fixes, deprecations, security fixes.

Security across every layer PHP Foundation triage, Scrutineer with Alpha-Omega, 8 CVEs credited.

Fig. 1. The layers, and where I work. Read from the top down.

2.0 Field history

29 stages since 2021. 11 recordings.

             ······    ··  ············        ················                            ····
·······························   · ·····      ············                           ··············
···························· ··  ·······        ······           ····              ······  ······ ··
························         ····            ····                           ·······   ··········
·························        ······ ··                                       ·  ···    ·········
   ··························     ·········                                ·      · ·    ···········
    ···························  ·············                          ·· ··●  ●·····●··●··········
      ·································· ·   ·                               ·●●····················
       ··································                                   ····●·●●·············· ·
       ·······························  ·                                   ··●·●· ●· ········
       ····················●········                                    ······    ·  ·· ··· · ······
        ●·························                                      ·····       ··   ·   ·······
         ·························                                        ··········            · ··
           ·····················                                        ··············   ··      ···
              ··········       ·                                       ·····························
                ······         ·                                     ···························· ··
                 ·····         ·                                    ······························ ·
                  ·····   ··      ·                                 ······························
                    ·······                                         ·······························
                          ····                                      ································
                             ·     ····                              ·······························
                              ·· ···········                          ······························
                                  ··············                        ·····   ····················
                                 ················                                  ·················
                                ···················                               ··················
                                ························                           ·················
                                ··························                          ···············
                                 ························                            ···············
                                  ······················                             ···············
                                   ····················                             ················
                                      ·················                             ··············

Fig. 2. Stages, 2021 to date. ● Paris ×5 · Lyon ×4 · Amsterdam ×3 · Lille ×2 · Munich ×2 · Toulouse ×2 · Aix-en-Provence ×1 · Bologna ×1 · Brussels ×1 · Chicago ×1 · London ×1 · Milan ×1 · Poznań ×1 · San José ×1 · Warsaw ×1

2.1 Scheduled

Sched.	Destination	Subject	Status
17 SEP	API Platform Con, Lille	Observer FrankenPHP : la DX au service de la performance fr	T-15d
23 SEP	WeAreDevelopers World Congress, San José	Know Your Enemies: Live Exploit of a PHP Engine Security Breach en	T-21d
OCT 2026	Forum PHP, Paris	L'Ecosystem Security Team de la PHP Foundation de l'intérieur fr	Booked
01 NOV	GoLab, Bologna	Make your Go server observable in half a day workshop, 180 min en	T-60d
NOV 2026	SymfonyCon Warsaw, Warsaw	Making Your Symfony App Observable Without the Pain workshop, 1 day en	Booked
DEC 2026	DevFest Lyon, Lyon	To be announced fr	Booked
2027	Your conference	Engine, security, runtime, Go. Talk or workshop, EN or FR.	Open

2.2 Log

Date	Stage	Subject	Rec.
2026
MAY	AFUP Day, Lyon	JsonPath : pour des API incassables fr
14 MAY	php[tek], Chicago	Writing PHP extensions in Go en
13 MAR	Dutch PHP Conference, Amsterdam	Supercharge your PHP apps with Go-powered PHP extensions en An LRU cache written in Go as a PHP extension, then used from Laravel and Symfony.
20 FEB	PHP UK Conference, London	Know Your Enemies: Live Exploit of a PHP Engine Security Breach en	video
05 FEB	Web Days Convention, Aix-en-Provence	Au cœur d'une core team fr
01 FEB	FOSDEM, Brussels	Know Your Enemies: Live Exploit of a PHP Engine Security Breach en Main track, K.1.105 La Fontaine. I exploit a patched vulnerability and a backdoor that reached RC, live, in a sandbox.	video
21 JAN	php[architect] Community Corner	FrankenPHP with Alexandre Daubois podcast en	video
2025
25 NOV	betterCode() PHP	FrankenPHP: The New Superpowered PHP Server en
13 NOV	DevFest Toulouse, Toulouse	Au cœur d'une core team fr
OCT	Codemotion, Milan	Créer sa Malware Sandbox en PHP en Cybersecurity track. That afternoon I ran my first circuit on a real quantum computer.
19 SEP	API Platform Con, Lille	PIE: The Next Big Thing en	video
MAY	AFUP Day, Lyon	Détecter les battements du cœur humain en PHP fr
21 MAR	Dutch PHP Conference, Amsterdam	PIE: The PHP's Next Big Thing en	video
2024
NOV	International PHP Conference, Munich	Streams: We All Underestimate PHP Redis en
NOV	International PHP Conference, Munich	Apple Pkl: The Renewal of PHP Apps Configuration en
NOV	DevFest Toulouse, Toulouse	Créer sa Malware Sandbox en PHP fr
OCT	Forum PHP, Paris	Covariance, Contravariance et Diamant fr	video · slides
OCT	Forum PHP, Paris	Créer sa Malware Sandbox en PHP fr	video
24 MAY	AFUP Day, Lyon	Composer 101 : gérer efficacement vos dépendances fr	slides
15 MAR	Dutch PHP Conference, Amsterdam	Iterators + Generators: The Road to Virtual Infinite RAM en	video · slides
2023
OCT	Forum PHP, Paris	Streams : nous sous-estimons tous Predis ! fr	video · slides
27 MAY	PHPers Summit, Poznań	Iterators: The Road to Virtual Infinite RAM en	slides
2022
JUN	SymfonyWorld Online	Little-known Symfony components that are worth a look en
19 MAY	Malt Academy	6 composants (méconnus) de Symfony fr	video · slides
APR	SymfonyLive Paris, Paris	Des composants Symfony méconnus qui valent le détour fr First conference talk.	slides
2021
18 NOV	Pimcore Inspire	Symfony 5 en	video · slides

3.0 Parts supplied

3.1 PHP RFCs

Date	RFC	Status
30 JAN	pack()/unpack() endianness modifiers for floating-point numbers	Accepted 11 yes, 0 no
21 NOV	pack()/unpack() endianness modifiers on integers	Accepted

3.2 Created

Ember: Real-time terminal dashboard for Caddy and FrankenPHP, with Prometheus export and a daemon mode. The FrankenPHP docs recommend it. v1.6.1
FrankenPHP extension generator: Write a PHP extension in Go, no C. FrankenPHP shipped it in 2025-06. Fifty follow-up changes since.
Symfony JsonPath: New component in Symfony 7.3. RFC 9535 functions and custom functions in 8.1. Also its ReDoS fix, CVE-2026-45756.
lazy-stream: Write and read streams only when needed. PHP. v1.6.1
phikl: Apple's Pkl bridge for PHP. 0.8.5
quo: A quantum circuit simulator in Go. I wrote it to understand how the maths runs.

3.3 Contributions

Project	Merged	Note
Symfony	380	Top 5 contributor in 2023, 2024 and 2025.
PHP interpreter	49	Bug fixes, deprecations for 8.5, fast ZPP conversions.
Scrutineer	68	Core team. Alpha-Omega's open-source security scanner: scheduled scans, fix validation, disclosure workflow, advisory deep-dives, federation.
FrankenPHP	90	Extension generator, docs, metrics.
Symfony docs	361	Second most active contributor in 2023.
PIE	10	The PHP Installer for Extensions.

3.4 Security

Date	Item
14 JUL	Joined The PHP Foundation as a contracted developer on security: triage, validation and fixes for php-src reports.
23 JUN	Scrutineer: Alpha-Omega's open-source scanner that finds, reproduces and reports vulnerabilities across ecosystems. The PHP Foundation named my contributions as what lets more people scan PHP projects.
18 MAY	Alpha-Omega, the OpenSSF and Linux Foundation initiative for open-source security, funds the PHP Foundation's Ecosystem Security Team. Scrutineer is the tooling that team shares with other languages.
20 MAY	Twig 3.26.0: thirteen CVEs. Fixes by Fabien Potencier, Nicolas Grekas and me.
20 MAY	CVE-2026-45756: ReDoS in Symfony JsonPath match() and search(). My fix.

3.5 Advisory credits

8 GitHub security advisories credit me. Full list on GitHub.

Ref.	Advisory
CVE-2026-54162	Ember has unneutralized terminal escape/control sequences from Caddy logs injected into t…
CVE-2026-54164	API Platform Core: Relation IRIs are not type-checked: a related resource can be denormal…
CVE-2026-45756	Symfony's JsonPath Evaluates Attacker-Controlled Regular Expressions in match()/search() Without Limits
CVE-2026-45755	Symfony's Mailtrap Mailer Webhook Parser Never Verifies the X-Mt-Signature HMAC
CVE-2026-45754	Symfony's Mailjet Mailer Webhook Parser Never Verifies the Configured Secret
CVE-2026-45075	Symfony's HEAD Request Bypasses methods
CVE-2026-45070	Symfony has Email Header Injection via Non-Token Characters in Mime Parameter Names
CVE-2024-50343	Symfony has an incorrect response from Validator when input ends with `\n`

4.0 Writings

BOOK: Clean Code in PHP, Packt, OCT 2022, with Carsten Windler.

Date	Article	Where
10 AUG	I Had An AI Agent Port Duke Nukem 3D to My iPhone The tests stayed green while confirming a bug, twice.	ITNEXT
05 MAY	I Always Congratulate, Even When They're Wrong	Analyst's Corner
28 APR	Building a Monitoring Tool #2: Designing the CLI with Cobra	ITNEXT
20 APR	Go Is Not Magic: The Internals of The Garbage Collector	ITNEXT
13 APR	Go Is Not Magic: The Internals of the GMP Scheduler	ITNEXT
09 APR	Building a Monitoring Tool #1: Real-Time Observability Without the Bloat	ITNEXT
30 MAR	Ember: Real-time monitoring for Caddy and FrankenPHP	ITNEXT
24 MAR	Quantum Supremacy vs. Quantum Advantage: State of The Union	ITNEXT
24 FEB	I Joined 3 Major Open-Source Core Teams Last Year. Here's My Reality Check.	ITNEXT
09 FEB	I Built a Quantum Simulator in Go, and It's Not as Hard as You Think	ITNEXT
DEC 2025	Quantum Computing Won't Break the Internet. It Will Just Force Us to Update It.	ITNEXT
NOV 2025	No, Quantum Computing Doesn't "Try Every Possibility at Once"	ITNEXT
OCT 2025	I want to learn Quantum Computing, and I'm not a Physicist	Medium
25 AUG	Writing PHP extensions in Go with FrankenPHP	Les-Tilleuls.coop
2024	Introducing Phikl: Apple PKL in PHP	Medium
30 SEP	Emojis are new Symfony's best friends!	SensioLabs Tech Blog
22 APR	Symfony's MIME in 5 minutes	SensioLabs Tech Blog
03 MAR	Symfony Internals #1: Inside the Framework Configuration	SensioLabs Tech Blog
2022	Symfony Internals #2: Data Validation	SensioLabs Tech Blog
07 JUN	Why PHP finally makes you a (more) rigorous developer	Medium
2021	Ultimate Guide to Symfony Components (2021) The article my first talks came from.	Medium

5.0 Press kit

Copy any block as is. Both languages, two lengths.

5.1 Contact

EMAIL: contact@daubois.dev
GITHUB: alexandre-daubois
BLUESKY: @alexdaubois.bsky.social
X: @alexdaubois
LINKEDIN: alexandre-daubois
SESSIONIZE: alexandre-daubois
MEDIUM: alex-daubois

5.2 Bio, short, English

Alexandre Daubois is CTO at Les-Tilleuls.coop, a member of the PHP, Symfony and FrankenPHP core teams, and a security contractor for The PHP Foundation. He sits on the core team of Scrutineer, Alpha-Omega's open-source security scanner, co-wrote Clean Code in PHP and speaks about what happens under the framework: the engine, the server, the runtime.

5.3 Bio, long, English

Alexandre Daubois is CTO at Les-Tilleuls.coop. He sits on the Symfony core team and the FrankenPHP core team, and contributes to the PHP interpreter, where two of his RFCs shipped in PHP 8.6. Since July 2026 he triages and fixes security reports for php-src with The PHP Foundation, and he sits on the core team of Scrutineer, the open-source security scanner Alpha-Omega builds with the ecosystem security engineers of PHP and other languages. He created the Symfony JsonPath component, the FrankenPHP extension generator that lets you write PHP extensions in Go, and Ember, a real-time terminal dashboard for Caddy and FrankenPHP. He co-wrote Clean Code in PHP (Packt, 2022). His talks at FOSDEM, php[tek], the Dutch PHP Conference, Forum PHP, API Platform Con and GoLab each take one tool you use every day and show how it works, demo first.

5.4 Bio, courte, français

Alexandre Daubois est CTO chez Les-Tilleuls.coop, membre des core teams PHP, Symfony et FrankenPHP, et travaille sur la sécurité de PHP pour The PHP Foundation. Il fait partie de la core team de Scrutineer, le scanner de sécurité open source d'Alpha-Omega, a coécrit Clean Code in PHP et parle de ce qui se passe sous le framework : le moteur, le serveur, le runtime.

5.5 Bio, longue, français

Alexandre Daubois est CTO chez Les-Tilleuls.coop. Membre des core teams Symfony et FrankenPHP, il contribue aussi à l'interpréteur PHP, où deux de ses RFC sont entrées dans PHP 8.6. Depuis juillet 2026, il trie et corrige les rapports de sécurité de php-src avec The PHP Foundation, et il fait partie de la core team de Scrutineer, le scanner de sécurité open source qu'Alpha-Omega construit avec les ingénieurs sécurité des écosystèmes PHP et d'autres langages. Il a créé le composant Symfony JsonPath, le générateur d'extensions de FrankenPHP qui permet d'écrire des extensions PHP en Go, et Ember, un tableau de bord temps réel pour Caddy et FrankenPHP. Il a coécrit Clean Code in PHP (Packt, 2022). Ses conférences, au FOSDEM, à php[tek], à la Dutch PHP Conference, au Forum PHP, à l'API Platform Con et à GoLab, prennent un outil que vous utilisez tous les jours et montrent comment il fonctionne, démo d'abord.

ALEXANDRE DAUBOIS