Longhorn PHP

A hands-on workshop walking through the full AI-assisted development loop: setting up Claude Code or GitHub Copilot with a real PHP project, writing effective system prompts and context files, using AI for code review and refactoring, integrating AI-generated tests, and building CI/CD gates that catch AI hallucinations before they ship. Attendees bring their own laptops and leave with a working AI-augmented workflow they can apply to their actual projects Monday morning.

Software teams don't usually fail because individuals do bad work. They fail because the work doesn't stay in sync. A product manager writes acceptance criteria in a ticket. A backend engineer implements against their interpretation of it. A frontend team builds to a Postman collection that drifted from the real API weeks ago. A QA engineer writes tests against behavior that was changed in a meeting nobody documented. By the time something ships, four teams have four versions of the truth — and

Reading about injection teaches you the words. Exploiting it teaches you the lesson. This hands-on tutorial walks every OWASP Top 10 category inside a deliberately vulnerable PHP app—you'll find the bug, exploit it yourself, then fix it properly. We cover injection, broken access control, authentication failures, SSRF, insecure deserialization, and the rest, with concrete mitigations for Laravel, Symfony, and WordPress. You leave with muscle memory and a hardening checklist—not just awareness.

While PHP core comes with some nice functionality, the real power in PHP is found in extensions. Some of the functionality we take for granted come from extensions that are always enabled (e.g. the "standard" extension provides output buffering, array functions like sort() and in_array(), string utilities like trim() and explode(), and more). While plenty of extensions are bundled with PHP, and either always enabled (like reflection and json) or can be enabled with build flags (like mbstring and