惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

F
Full Disclosure
博客园 - 聂微东
博客园_首页
人人都是产品经理
人人都是产品经理
N
News | PayPal Newsroom
云风的 BLOG
云风的 BLOG
U
Unit 42
T
Tailwind CSS Blog
Recent Announcements
Recent Announcements
Security Archives - TechRepublic
Security Archives - TechRepublic
T
The Blog of Author Tim Ferriss
Stack Overflow Blog
Stack Overflow Blog
The Register - Security
The Register - Security
The Hacker News
The Hacker News
博客园 - Franky
Engineering at Meta
Engineering at Meta
Jina AI
Jina AI
月光博客
月光博客
freeCodeCamp Programming Tutorials: Python, JavaScript, Git & More
F
Fortinet All Blogs
Threat Intelligence Blog | Flashpoint
Threat Intelligence Blog | Flashpoint
C
Check Point Blog
C
Cyber Attacks, Cyber Crime and Cyber Security
有赞技术团队
有赞技术团队
TaoSecurity Blog
TaoSecurity Blog
博客园 - 司徒正美
GbyAI
GbyAI
G
Google Developers Blog
B
Blog
G
GRAHAM CLULEY
Y
Y Combinator Blog
雷峰网
雷峰网
爱范儿
爱范儿
酷 壳 – CoolShell
酷 壳 – CoolShell
D
Darknet – Hacking Tools, Hacker News & Cyber Security
Microsoft Azure Blog
Microsoft Azure Blog
WordPress大学
WordPress大学
V
V2EX
罗磊的独立博客
Know Your Adversary
Know Your Adversary
AWS News Blog
AWS News Blog
T
Troy Hunt's Blog
S
SegmentFault 最新的问题
P
Privacy & Cybersecurity Law Blog
T
Threat Research - Cisco Blogs
H
Help Net Security
N
Netflix TechBlog - Medium
Help Net Security
Help Net Security
L
LangChain Blog
D
Docker

DEV Community

Authentication Security Deep Dive: From Brute Force to Salted Hashing (With Java Examples) Why AI Systems Don’t Fail — They Drift Spilling beans for how i learn for exam😁"Reinforcement Learning Cheat Sheet" I Replaced Chrome with Safari for AI Browser Automation. Here's What Broke (and What Finally Worked) How Python Borrows Other People's Work The $40 Architecture: Processing 1 Billion API Requests with 99.99% Uptime Vibe Coding: A Workflow Guide (From Zero to SaaS) Most webhook security guides protect the wrong side. The scary part is delivery. Headless CMS for TanStack Start: Build a Blog with Cosmic EU Age Verification App "Hacked in 2 Minutes" — What Actually Happened Comfy Cloud’s delete function does not actually remove files Running AI Models on GPU Cloud Servers: A Beginner Guide Event-driven media intelligence with AWS Step Functions and Bedrock I scored 500 AI prompts across 8 quality dimensions — here's what broke How to Call Google Gemini API from Next.js (Free Tier, No Backend Needed) The Portal Protocol: Reclaiming Human Connection in the Age of AI How to Fix Your Team's Scattered Knowledge Problem With a Self-Hosted Forum Intro to tc Cloud Functors: A Graph-First Mental Model for the Modern Cloud Designing Multi-Tenant Backends With Both Ownership and Team Access I Built a Neumorphic CSS Library with 77+ Components — Here's What I Learned PostgreSQL Performance Optimization: Why Connection Pooling Is Critical at Scale Cómo construí un SaaS multi-rubro para gestionar expensas en Argentina con FastAPI + Vue 3 🚀 I Built an Ethical Hacking Scanner Tool – Open Source Project I Replaced /usage and /context in Claude Code With a Single Statusline A Pythonic Way to Handle Emails (IMAP/SMTP) with Auto-Discovery and AI-Ready Design I Collected 8.9 Million Polymarket Price Points — Here's What I Found About How Markets Really Move EcoTrack AI — Carbon Footprint Tracker & Dashboard Everyone's Using AI. No One Agrees How. 5 self-hosted ebook managers worth trying in 2026 Building Your First AI Agent with LangChain: From Chatbot to Autonomous Assistant Common SOC 2 Failures (Real World) Stop Vibe-Checking Your AI App: A Practical Guide to Evals How to Use SonarQube and SonarScanner Locally to Level Up Your Code Quality Your Next To-Do App Is Dead — I Replaced Mine with an OpenClaw AI Sign a Nostr event in 60 lines of Python using coincurve — no nostr-sdk, no nbxplorer, no rust toolchain ITGC Audit Explained Like You’re in Big 4 Patch Tuesday abril 2026: Microsoft parcha 163 vulnerabilidades y un zero-day en SharePoint Stop scraping everything: a better way to track competitor price changes Listing on MCPize + the Official MCP Registry while routing payments OUTSIDE the marketplace — how I kept 100% of my x402 revenue Building an AI-Powered Risk Intelligence System Using Serverless Architecture Why We Ripped Function Overloading Out of Our AI Toolchain Testing AI-Generated Code: How to Actually Know If It Works SaaS Churn Is Killing Your Business. Here Is What to Do About It (Without a Support Team) The Speed of AI Is No Longer Linear - And Self-Improving Models Are Why How to Implement RBAC for MCP Tools: A Practical Guide for Engineering Teams From Standard Quote to Persuasive Proposal: AI Automation for Arborists I built a CLI that scaffolds complete multi-tenant SaaS apps Axios CVE-2025–62718: The Silent SSRF Bug That Could Be Hiding in Your Node.js App Right Now The dashboard that ended our friendship Data Pipelines Explained Simply (and How to Build Them with Python) The Hidden Cost of AI Systems Nobody Talks About. undefined vs undeclared, and how typeof behaves Switching from file-based jobs to NATS/Kafka in Rust without changing code io_uring Adventures: Rust Servers That Love Syscalls Why Agentic AI is Killing the Traditional Database The POUR principles of web accessibility for developers and designers Quantum Neural Network 3D — A Deep Dive into Interactive WebGL Visualization How To Install Caveman In Codex On macOS And Windows Automation Pipeline Reliability: Why Your Workflow Breaks When Nobody Is Watching I Built an 'Open World' AI Coding Agent — It Works From ANY Folder From Freelancing to Product: A Tech Service Company's SaaS Transformation China's AI Giants: Adding Tencent Hunyuan & ByteDance Doubao to AI University (74 Providers) On the Vibe Coders and Their Lies clerk: Auto-Summarize Your Claude Code Sessions AI Weekly — 2026/04/10–04/17 | The Model Lockdown Is Here, but the Toolchain Is the Real Battleground AI 週報 — 2026/04/10–2026/04/17 模型封鎖潮來了,但工具鏈才是真戰場 Maybe this is how Open-Source apps are born... 🚀 Fine-Tune LLMs with LoRA and QLoRA: 2026 Guide tRPC v11 + Next.js App Router: End-to-End Type Safety Without the Boilerplate ShadCN UI in 2026: Why I Stopped Installing Component Libraries and Started Owning My Components SaaS Billing in React Server Components: Stripe + Supabase Without a Single `useEffect` Join our DEV Weekend Challenge — $1,000 in Prizes Across TEN winners! Submissions Due April 20 at 6:59 AM UTC. Implementing FSRS Spaced Repetition in Flutter + Supabase — Adding Memory Science to an AI Learning App "I Texted My Localhost From the Train — Claude Code Fixed the Bug Before I Got Home" I Built a Sales Prep AI and It Went Deeper Than Expected Design to Code #2: One JSON, Eleven Outputs Solving the 100M-Row Problem: A Summary Table Pattern for High-Volume Push Notification Logs Flutter Web With Wasm: What Actually Changes For Developers I Built 50 Royalty-Free Soundtracks for My Side Project in a Weekend Using AI Music Generation The Vibe Coding Security Checklist: 7 Things to Check Before You Ship Stop Letting Googlebot Guess Fix Your React App's SEO Right Desconstruindo o Streaming do LinkedIn: Como Criar um Engine de Extração de Vídeo de Alta Performance com HLS e FFmpeg (EDA Part-1) EDA (Exploratory Data Analysis) Explained With Real Life — Why Looking at Your Data Is the Most Important Step in Machine Learning Brand Relationship Management at Scale: Our 4-Touch Outreach System for 200+ Brands Why String.fromEnvironment() Might Return an Empty String in Dart JGuardrails 1.0.0 — Hardening Java LLM Apps Against Jailbreaks, Toxicity, and Prompt Injection Plan and Schedule a Full Week of Threads Content From One Claude Conversation Coding Cat Oran Ep3, Five Tables Changed Everything Updated: BFF Pattern I'm done watching freelancers get buried by 200 proposals. So I'm building the alternative. This is my first post BFS Algorithm in Java Step by Step Tutorial with Examples Tracking LLM Pricing Monthly: An Open Dataset for 22 AI Models How We Measure Content ROI on a Comparison Site: Revenue Attribution Without Perfect Data Introducing Nova AI Ops: The AI-Native Operating System for SRE Teams I built a free desktop video downloader for Windows — Grabbit How Talkie OCR Helps Vision-Impaired & Dyslexic Users Read the World Around Them VRCFaceTracking安装和iPhone面捕配置教程,有bug Even CrowdStrike Can't See Your Agents The Automation Gold Rush: What n8n Workflows and Claude Are Opening Up for Developers Right Now
Who Says PHP Isn't Good Enough for OPC UA?
Gianfrancesc · 2026-04-28 · via DEV Community

"PHP? For OPC UA? Come on."

If you've ever tried to connect a PHP application to a PLC, a SCADA system, or any industrial device, you've probably heard that line. Maybe you said it yourself, opening a browser and searching for a library that didn't exist.

That time is over.


The Historical Gap

OPC UA is the standard protocol for industrial automation. Motors, sensors, historians, SCADA systems, PLCs — the entire Industry 4.0 world speaks OPC UA. It's the OPC Foundation standard: battle-tested, secure, feature-rich. It is, essentially, the TCP/IP of the manufacturing industry.

And yet, for years, PHP was left out.

These were your options:

1. An HTTP-to-OPC-UA gateway
Spin up a separate process (Python, Node.js, a C++ binary), expose a REST API, and have PHP act as the HTTP client. Result: a more complex infrastructure, added latency, one more point of failure, and a second language to maintain in parallel.

2. Compiled C/C++ extensions
Some PHP libraries wrap C implementations via FFI or native extensions. But compiling .so files for every PHP version, on every server, in every CI pipeline is an operational nightmare. And if your shared host doesn't support that extension? Dead stop.

3. Shell out to other languages
Calling a Python or Node.js process from PHP. Fragile. Slow. Hard to debug. And again: two stacks, two teams, two deployments.

4. Commercial Windows-only libraries
COM bridges, proprietary solutions, Windows-dependent. Let's not even go there.

The practical result? Anyone running an ERP in Laravel, a dashboard in Symfony, or even just a PHP API that needed to read a temperature from a Siemens S7 — had to face this reality: PHP wasn't "industrial enough."


Where php-opcua Comes From

The project was born out of a real need. Gianfrancesco Aurecchia, its creator and maintainer, had a PHP application for monitoring a production line. He needed to connect it to Siemens PLCs via OPC UA. Every available option was ugly, expensive, or both.

Instead of working around the problem, he built the solution.

The result — today — is an ecosystem of 7 packages, 147,000 lines of PHP, 2,649 tests, 5,204 assertions, and zero runtime dependencies beyond ext-openssl. An open-source project that implements the full OPC UA binary protocol natively in PHP.


The Ecosystem: Package by Package

1. opcua-client — The Core

This is the core package. It implements the entire OPC UA binary protocol stack in pure PHP:

  • TCP transport and binary encoding/decoding
  • Secure channel with asymmetric and symmetric encryption
  • Session management
  • All major OPC UA services: browse, read, write, method call, subscriptions, history
composer require php-opcua/opcua-client

Enter fullscreen mode Exit fullscreen mode

use PhpOpcua\Client\ClientBuilder;

$client = ClientBuilder::create()
    ->connect('opc.tcp://192.168.1.100:4840');

$temp = $client->read('ns=2;s=Temperature');
echo $temp->getValue(); // 23.5

Enter fullscreen mode Exit fullscreen mode

Three lines. No config files, no XML, no gateway.

10 security policies, from None up to Aes256_Sha256_RsaPss and the new ECC policies (nistP256, nistP384, brainpoolP256r1, brainpoolP384r1). Anonymous, username/password, and X.509 authentication. Persistent trust store with TOFU support.


2. opcua-session-manager — The Answer to PHP's Stateless Model

This was the biggest objection. OPC UA requires a persistent session: the initial handshake costs 50–200ms and must be repeated on every connection. PHP's request/response model destroys all state at the end of each request.

The answer is the Session Manager: a long-lived ReactPHP daemon that keeps OPC UA sessions alive in memory, communicating with PHP processes over a Unix socket. The handshake happens once. Every subsequent request reuses the existing session — reducing per-request overhead from ~150ms to ~5ms.

composer require php-opcua/opcua-session-manager

# Start the daemon
php bin/opcua-session-manager

Enter fullscreen mode Exit fullscreen mode

use PhpOpcua\SessionManager\Client\ManagedClient;

// Same interface as the direct client
$client = new ManagedClient();
$client->connect('opc.tcp://localhost:4840');

$value = $client->read('i=2259');

Enter fullscreen mode Exit fullscreen mode

ManagedClient implements the same OpcUaClientInterface as the direct client. Change one line, keep all your code. In production, the daemon runs under systemd or supervisord.


3. laravel-opcua — Laravel-Native

composer require php-opcua/laravel-opcua

Enter fullscreen mode Exit fullscreen mode

Service Provider, Facade, Artisan commands, configuration via config/opcua.php. Named connections like database config. Subscriptions that become Laravel Events. Logging with Laravel's logger. Caching with Redis. Testing with MockClient.

use PhpOpcua\LaravelOpcua\Facades\Opcua;

// Read from the default connection
$temperature = Opcua::read('ns=2;s=Temperature');

// Switch to a different PLC on the fly
$level = Opcua::connection('tank-plc')
    ->read('ns=2;s=FillLevel');

Enter fullscreen mode Exit fullscreen mode

The OpcuaManager automatically checks whether the Session Manager daemon is running: if the Unix socket exists, traffic routes through the daemon for session persistence; otherwise it builds a direct client. Zero code changes to switch between development and production.


4. symfony-opcua — The Symfony Bundle

composer require php-opcua/symfony-opcua

Enter fullscreen mode Exit fullscreen mode

Dependency injection, semantic YAML configuration, autowiring of OpcUaClientInterface, a console command for the daemon, automatic Monolog integration, automatic PSR-16 cache pool injection, and 47 PSR-14 events dispatched through Symfony's event system.

# config/packages/php_opcua_symfony_opcua.yaml
php_opcua_symfony_opcua:
    connections:
        default:
            endpoint: '%env(OPCUA_ENDPOINT)%'

Enter fullscreen mode Exit fullscreen mode

use PhpOpcua\SymfonyOpcua\OpcuaManager;

class PlcController
{
    public function status(OpcuaManager $opcua): Response
    {
        $client = $opcua->connect();
        $value  = $client->read('i=2259');
        return $this->json(['status' => $value->getValue()]);
    }
}

Enter fullscreen mode Exit fullscreen mode


5. opcua-client-nodeset — 51 Companion Specs, Zero Manual Codecs

The OPC Foundation publishes dozens of "companion specifications": standardized data models for Robotics, Machinery, MachineTool, ISA-95, CNC, MTConnect, and many more. Decoding these structures normally requires writing custom codecs by hand.

opcua-client-nodeset ships 807 pre-generated PHP files from 51 companion specs. Enumerations as PHP BackedEnum, structures as typed DTOs with full IDE autocomplete.

composer require php-opcua/opcua-client-nodeset

Enter fullscreen mode Exit fullscreen mode

use PhpOpcua\Nodeset\Robotics\RoboticsRegistrar;
use PhpOpcua\Nodeset\Robotics\Enums\OperationalModeEnumeration;

$client = ClientBuilder::create()
    ->loadGeneratedTypes(new RoboticsRegistrar())
    ->connect('opc.tcp://192.168.1.100:4840');

$mode = $client->read(RoboticsNodeIds::OperationalMode)->getValue();
// OperationalModeEnumeration::MANUAL_REDUCED_SPEED — not a raw integer

Enter fullscreen mode Exit fullscreen mode


6. opcua-cli — Explore Without Writing Code

composer require php-opcua/opcua-cli

opcua-cli browse    opc.tcp://192.168.1.10:4840 /Objects
opcua-cli read      opc.tcp://192.168.1.10:4840 "ns=2;i=1001"
opcua-cli watch     opc.tcp://192.168.1.10:4840 "ns=2;s=Temperature"
opcua-cli endpoints opc.tcp://192.168.1.10:4840
opcua-cli trust     opc.tcp://server:4840
opcua-cli generate:nodeset MySpec.NodeSet2.xml

Enter fullscreen mode Exit fullscreen mode

Address space browsing, node read/write, real-time monitoring, endpoint discovery, trust store management, and PHP class generation from custom NodeSet2.xml files. Full security support, JSON output, debug logging.


7. uanetstandard-test-suite — CI Without Compromise

A Docker environment with 10 pre-configured OPC UA servers based on UA-.NETStandard (the OPC Foundation's reference implementation), covering all security policies, all data types, events, and historical data. The opcua-client test suite runs against real servers, not mocks.

./vendor/bin/pest                                          # everything
./vendor/bin/pest tests/Unit/                              # unit only
./vendor/bin/pest tests/Integration/ --group=integration   # integration only

Enter fullscreen mode Exit fullscreen mode

CI runs on PHP 8.2, 8.3, 8.4, and 8.5 via GitHub Actions.


Ecosystem by the Numbers

Lines of PHP 147,000
Tests 2,649
Assertions 5,204
Packages 7
Security policies 10 (RSA + ECC)
Companion specs 51
Pre-generated types 807
C runtime dependencies 0
Supported PHP versions 8.2 / 8.3 / 8.4 / 8.5

The Architecture at a Glance

Your Application
  │
  ├── laravel-opcua  or  symfony-opcua    Framework integration
  │     │
  │     ├── opcua-session-manager         Persistent sessions (optional)
  │     │
  │     └── opcua-client                  Binary protocol, crypto, I/O
  │           │
  │           └── opcua-client-nodeset    Type definitions (optional)
  │
  └── opcua-cli                           Developer tooling

Enter fullscreen mode Exit fullscreen mode

Each package has a single responsibility. You can use just opcua-client in a CLI script, or the entire stack in an enterprise Laravel application. The only dependency required everywhere is ext-openssl.


What You Can Build With It Today

Real-time dashboards — Read process variables from PLCs in Laravel, display charts, fire alerts: all in the same stack as your existing web application. No sidecar, no extra microservice.

SCADA-to-ERP integration — Read production counters via OPC UA and write them directly into your PHP-based ERP, MES, or inventory system. In an Eloquent model. Through a queue. With all the tools you already know.

IoT data collection — Use the Session Manager to maintain persistent connections to dozens of devices simultaneously. Collect sensor data, store it in your database, process it with Laravel queues or Symfony Messenger.

Automated OPC UA server testing — Use MockClient for unit tests and the Docker test suite for CI integration. Validate your OPC UA server implementation with a PHP test suite, without needing a separate desktop client.


Bonus: It's Already AI-Ready

There's one more thing worth highlighting — because in 2026 it makes a real difference.

Using a new library with an AI assistant — Cursor, Copilot, Claude — only works well if the AI actually knows the library. If it doesn't, it generates plausible-looking but wrong code: unsupported patterns, non-existent methods, broken configurations. You end up spending more time correcting the AI than you would have spent reading the docs.

php-opcua has addressed this problem explicitly.

Every package in the ecosystem ships three files designed specifically for AI model consumption:

File Content
llms.txt Structured summary: API, key patterns, core examples
llms-full.txt Complete documentation in LLM-optimized format
llms-skills.md Skill file for AI assistants with usage rules and patterns

Available for every package directly from the website:

https://www.php-opcua.com/llms/opcua-client/llms.txt
https://www.php-opcua.com/llms/opcua-client/llms-full.txt
https://www.php-opcua.com/llms/opcua-client/llms-skills.md

https://www.php-opcua.com/llms/laravel-opcua/llms.txt
https://www.php-opcua.com/llms/symfony-opcua/llms.txt
https://www.php-opcua.com/llms/opcua-session-manager/llms.txt
https://www.php-opcua.com/llms/opcua-cli/llms.txt

Enter fullscreen mode Exit fullscreen mode

And a centralized index for the entire ecosystem:

https://www.php-opcua.com/llms.txt

Enter fullscreen mode Exit fullscreen mode

What changes in practice? Point your AI assistant at llms-full.txt for the package you need, or load llms-skills.md as context, and from that moment the AI generates correct code: the right NodeId strings, the right fluent builders, the right typed DTOs, the right retry and security patterns. Zero tokens wasted correcting hallucinations about an API the model never had in its training data.

The library isn't just AI-compatible — it's AI-first by design.


Conclusion

The historical PHP gap for OPC UA still lives on in tutorials, forum threads, and industrial conference slides. But in practice, from 2026, it's no longer a real problem.

php-opcua is a mature, tested, documented, and actively maintained ecosystem. Zero C extensions. Zero gateways. Zero architectural compromises. The full OPC UA binary protocol, in pure PHP, with native integration for Laravel and Symfony.

Next time someone tells you "PHP isn't good enough for OPC UA", you have a concrete answer.


Resources: