What the framework really does, where it stops, and how to use it in production. Plus behind the scenes of the platform.
Symfony 8.2 encrypts a Doctrine column with an attribute, and makes it searchable with a blind index. What that protects against, what the database loses, and how to encrypt a column that already holds data.
Invalid token, 419, CSRF verification failed: what the CSRF token really protects, when it is still needed in the age of SameSite cookies, and how Symfony, Laravel, Django and Rails handle it.
Symfony 8.2 records on the token every proof of identity given during the session. Enough to write SMS two-factor authentication without a bundle, without adding a role to the token and without a subscriber: an authenticator for the code, a voter that requires both proofs, an entry point that asks for the missing one.
Is a session opened three weeks ago worth a password typed a minute ago? When to ask for proof again, which proof, and how to do it without breaking the user's flow, with or without Symfony 8.2.
PHP2Shell (CVE-2026-109618 and 109619) on Symfony and FrankenPHP: check which PHP really runs, a stopgap until the fix, and rebuilding the Docker image.