February 24-26, 2027
Montreal, Canada
Top 20 sessions
PerformancePHP
In this talk we are going to dive deep into PHP's inner workings.
We will start by looking at how the language parser and scanner work, which convert scripts into an Abstract Syntax Tree. When then look at how PHP internal byte code is generated from this AST, and how the engine runs byte code.
We will start by looking at how the language parser and scanner work, which convert scripts into an Abstract Syntax Tree. When then look at how PHP internal byte code is generated from this AST, and how the engine runs byte code.
Java & JVM languagesSecurity
In our wallet, third-party services received digitally signed requests, so it was easy to assume that a valid signature meant the request was safe. It wasn’t. A signed request could still be replayed, retried after a timeout, arrive with clock skew, or leave important fields outside the signature. This talk looks at those failure cases and the practical use of nonces, idempotency, key rotation, and replay protection to handle them safely.
Architecture & Design PatternsJava & JVM languages
Java enums are usually introduced as a way to represent fixed sets of constants, but Effective Java also recommends a single-element enum as a safe way to implement a singleton. In this talk, I look at what happens when that pattern is used for small Java services, how it differs from classic singletons and DI-managed components, and where it starts to become a bad fit once state, dependencies, lifecycle, or testing requirements grow.
Architecture & Design Patterns.NET
Message brokers promise scalability and reliability - but ordering complicates both. Partitions, retries, competing consumers and redelivery can all disrupt message order. We’ll explore how popular brokers handle ordering, why strict ordering conflicts with scalability, and patterns for handling out-of-order messages. You’ll leave able to decide when ordering is necessary and design systems that remain correct when it breaks.
Architecture & Design PatternsPHP
PHP properties are having a golden age. Since PHP 7.4, they've become steadily more powerful, and recent features like interface properties, hooks, and asymmetric visibility open up vast new potential.
So now that we have all this power, what shall we do with it? It allows us to fully rethink what it means to model data.
In this session, we'll look at PHP properties, and OOP in general, with fresh eyes to see all that they can do for us.
So now that we have all this power, what shall we do with it? It allows us to fully rethink what it means to model data.
In this session, we'll look at PHP properties, and OOP in general, with fresh eyes to see all that they can do for us.
PHPTests & Quality
Hopefully by now, you know that testing is important, and you've integrated PHPUnit into your workflow. So now what?
In this "testing 202" course, we'll explore some features of PHPUnit you may not be using (but should), some techniques you may not have thought of, and answer the question "so what are traits actually good for?"
In this "testing 202" course, we'll explore some features of PHPUnit you may not be using (but should), some techniques you may not have thought of, and answer the question "so what are traits actually good for?"
Architecture & Design PatternsArtificial Intelligence
Diffusion models excel at short clips but suffer severe drift across extended sequences. We examine agentic video frameworks that solve this orchestration bottleneck. By decoupling production into hierarchical agents for narrative planning, identity-locked keyframing, audio-driven pacing, and code-based assembly, these systems preserve continuity, offering a scalable blueprint for autonomous, long-format video generation.
Tests & QualityArtificial Intelligence
AI coding agents fail on ambiguity, not syntax. BDD solved that years ago with executable specifications in business language. This talk maps a decade of BDD practice onto spec-driven development with agents: scenarios an agent implements against, used as the acceptance gate, and how to catch false green when the agent writes its own tests. Examples come from real projects and from building an open-source ERP. The workflow fits any language.
Artificial IntelligenceEcommerce
As autonomous agents replace manual web browsing, e-commerce requires standardized, machine-readable interfaces. We will go over an end-to-end framework implementing the Universal Commerce Protocol (UCP) for agentic commerce. Using the Model Context Protocol (MCP), our system connects LLM agents directly to Shopify’s global catalog, enabling structured product discovery, live cart management, and autonomous checkout orchestration.
Architecture & Design Patterns.NET
Pub/sub is a great start - but production systems need more. Explore the Outbox, sagas, scatter-gather, competing consumers, retries, back pressure and idempotency. Through practical scenarios, you’ll learn which pattern addresses which distributed-systems problem and leave able to recognise failure and scaling challenges in your own systems and choose an appropriate messaging pattern to address them.
Cloud ComputingSecurity
Kubernetes est aujourd’hui la plateforme d’orchestration de conteneurs la plus utilisée dans le monde (cloud public, hybride, on-prem).
Sa complexité et son adoption massive en font une cible privilégiée pour les attaquants.
De nombreuses compromissions récentes montrent que les mauvaises configurations sont la première source de vulnérabilités, bien avant les failles logicielles.
Sa complexité et son adoption massive en font une cible privilégiée pour les attaquants.
De nombreuses compromissions récentes montrent que les mauvaises configurations sont la première source de vulnérabilités, bien avant les failles logicielles.
PHP
Join PHP core developer and veteran release manager Daniel Scherzer for a deep dive into the new features, syntax updates, deprecations, and surprises coming in PHP 8.6. Whether you're maintaining legacy apps or building bleeding-edge libraries, this talk will help you upgrade to the newest version of PHP 8.5 with confidence. Features include improvements to the URL handling extension, partial function application, a new Duration class, and more.
Cloud ComputingJava & JVM languages
Buildpacks just reached CNCF Graduation!
We'll explore how they continue to replace Dockerfiles with smarter builds.
We’ll dive into the new distroless builders, Spring Boot 4.2’s switch to Ubuntu Resolute by default, the jvm-vendors buildpack to easily swap JVMs via variables, and upcoming security stack warnings and more!
Join me to learn how to build smaller, faster, and more secure container images!
We'll explore how they continue to replace Dockerfiles with smarter builds.
We’ll dive into the new distroless builders, Spring Boot 4.2’s switch to Ubuntu Resolute by default, the jvm-vendors buildpack to easily swap JVMs via variables, and upcoming security stack warnings and more!
Join me to learn how to build smaller, faster, and more secure container images!
Java & JVM languagesSecurity
Cette session explore le cycle de vie des vulnérabilités du point de vue d'un mainteneur open source.
Suivez le triage d'une faille trouvée par l'IA, sa reproduction avec la CI, puis l'utilisation de l'IA pour créer et valider un correctif.
Nous publierons le fix et suivrons sa divulgation dans GHSA, CVE et OSV.
Découvrez comment ces données alimentent les scanners (Snyk, Dependabot) et comment automatiser la protection de vos dépendances.
Suivez le triage d'une faille trouvée par l'IA, sa reproduction avec la CI, puis l'utilisation de l'IA pour créer et valider un correctif.
Nous publierons le fix et suivrons sa divulgation dans GHSA, CVE et OSV.
Découvrez comment ces données alimentent les scanners (Snyk, Dependabot) et comment automatiser la protection de vos dépendances.
PHPSecurity
In October 2026, a pair of critical vulnerabilities in PHP, termed "PHP2Shell," were disclosed. As a PHP 8.5 Release Manager, Daniel Scherzer had a front-row seat to the announcement of the PHP2Shell vulnerabilities and the distribution of their fixes. Join him for an in-depth account of what PHP2Shell is, the discovery and remediation process, how the fixes were built and disseminated, and much much more.
DevOps.NET
Are you looking to rapidly deploy your content? Are you looking to understand the full DevOps process? Come for this demo-only presentation where we start from scratch, template a React website and API with Aspire, live-code both Dockerfiles, live-code Kubernetes YAML resources, build up a DevOps pipeline in GitHub Actions, and deploy to Kubernetes. Then we commit, and watch the magic flow into place. You too can automate your full-stack DevOps.
SecurityArtificial Intelligence
L'IA agentique passe du MVP à la PROD plus vite que la plupart des équipes sécu n'adaptent leurs modèles de menace.
Des agents autonomes qui appellent des outils, enchaînent des LLMs et communiquent entre eux via des protocoles comme MCP et A2A introduisent des surfaces d'attaque que l'OWASP Top 10 classique n'a jamais couvertes : le prompt injection comme vecteur de mouvement latéral, le tool-poisoning, l'exploitation de la confiance A2A
Des agents autonomes qui appellent des outils, enchaînent des LLMs et communiquent entre eux via des protocoles comme MCP et A2A introduisent des surfaces d'attaque que l'OWASP Top 10 classique n'a jamais couvertes : le prompt injection comme vecteur de mouvement latéral, le tool-poisoning, l'exploitation de la confiance A2A
Architecture & Design PatternsHTML & CSS
Browsers give you exactly one chance to ask a user for permission to do something. If the user declines, the only way to give access to the camera, microphone or geolocation again is hidden deep in the browser's settings (i.e. it's not gonna happen).
Once again, HTML comes to the rescue of JS. A new set of HTML elements let users give explicit permission, right from the page. We'll explore their features, their restrictions and how to use them
Once again, HTML comes to the rescue of JS. A new set of HTML elements let users give explicit permission, right from the page. We'll explore their features, their restrictions and how to use them
JavaScriptTests & Quality
Unit tests? Integration tests? Mocks? Stubs? Fakes? How does this apply to the web? Let's look at all the ways you can test a web app and demo all the tools you'd use. We'll live-code most tests to show you exactly what makes a good testing strategy. You'll leave with a GitHub repo you can use to keep learning or fork and use in your own PWAs.
NetworksSecurity
Container security depends on several layers working together. The Guardians connect image and supply chain security, Kubernetes policies, runtime detection, network isolation, and observability. Practical examples with Trivy, Kyverno, and Falco show where each layer helps and where it falls short. Learn to harden images, limit workload privileges, spot suspicious behavior, and use network policies to contain an incident.
© 2010-2026 ConFoo. All rights reserved. Code of Conduct
Cookie Consent
To provide the best experiences, the usage of cookies are necessary. Some are essential for the proper functioning of the site, while others help us better cater to your interests.