56 links from the last 24 hours · 21 October 2026
For the past month or so, I have been on a digital declutter. I only realized this today, because this was not something I planned. I guess it just happened.
Accident Or Not, The No Kings Takedown Is Why You Shouldn’t Rent Your Megaphone From Zuck
This past weekend was the latest in an ongoing series of (massive) “No Kings” protests held around the country (and in some cases around the globe). The latest one was part of a “…
If you're running anything on PHP it's vital you upgrade - today's updates (across the entire PHP 8.x line) address two remote code execution holes, and there have been exploits …
LiteLLM 1.107.0 on PyPI ships a .pth credential stealer and a sitecustomize.py backdoor that run on every Python start. How the implant got in, what it steals, and indicators of compromise.
Can they write a function?
For a software developer position, there isn't a trick to finding the best candidate. Your criteria do not determine how solid the candidates will be. Everyone is submitting 500 applications a month n
Well this is delightful: I released Battle Drones yesterday under an Apache 2.0 License and there's already a French language fork which reskins the game to take place in steampunk …
Do minor curl vulnerabilities in the open
The curl project has decided to alter its vulnerability disclosure program procedure and starting October 26 2026, we insist that all vulnerability reports submitted to us that are deemed to be severity LOW or MEDIUM should instead be submitted as issues in ou…
Why didn't we use RoRegisterForApartmentShutdown to clean up the unmarshalable delegate? - The Old New Thing
Too many requirements, some of which bring us full circle.
Today's PHP Security Release, and How We're Strengthening PHP Security
Describing the story behind how critical security vulnerabilities were found and fixed.
Announcing DuckDB 2.0.0 LTS “Cinnamon Teal”
The DuckDB team is happy to announce that today we're releasing DuckDB version 2.0.0 LTS, codenamed “Cinnamon Teal” (Spatula cyanoptera). This is our biggest feature release so far, and it ships a polished version of the Quack protocol, asynchronous I/O, a fir…
Building operating systems that do one thing with OCaml and Solo5.
PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet | Wiz Blog
Core PHP engine flaws enable remote code execution and Heartbleed-style memory disclosure across the web.
sparqlite is a Rust-based SQLite loadable extension that stores RDF quads in ordinary SQLite tables and executes SPARQL 1.1 queries and updates natively inside the SQLite process. Its integer-encoded terms, …
Microspeak: Drain the slide, back-up slides - The Old New Thing
PowerPoint presentation jargon.
PHP
PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.
Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds
One of eMudhra's certificate authority private keys is the number 4. Not a number that starts with 4, or the number 4 followed by a few hundred random digits, just, 4... Another one is 56, and another is 115. I know, because I recovered all of them from their
How I got over 300 Tor exit nodes removed
On Friday Oct 2, 09:35am, 333 infected exit nodes started a coordinated campaign to intercept SSH connections and gather as much unencrypted data as possible.
This morning, two critical PHP Security Advisories were published: RCE via OOM corruption (9.2/10) RCE via stale global state (9.2/10) If you're running PHP for any service, you need to upgrade immediately to 8.2.35, 8.3.36, 8.4.27, or 8.5.12. And if you use R…
Release PHP 8.2.35 · php/php-src
The PHP development team announces the immediate availability of PHP 8.2.35. This is a security release fixing two critical vulnerabilities (CVE-2026-109618, CVE-2026-109619) that can allow unauthe...
Climate: The 1.5°C goal of the Paris Agreement is no longer viable
UNEP's Emissions Gap Report 2026 warns that exceeding 1.5°C is inevitable and calls for urgent emissions cuts to limit warming and reverse the trend.
The Future of CSS ✨ • Josh W. Comeau
Every year, browser vendors collaborate via the Interop project to synchronize their efforts on new HTML/CSS/JS features. This year, there’s a ton of super exciting features being considered! In this blog post, we’ll explore the CSS of the future, to get a gli…
PHP: News Archive - 2026
PHP is a popular general-purpose scripting language that powers everything from your blog to the most popular websites in the world.
We want to inform you of an upcoming PHP security release that addresses two critical vulnerabilities (both rated CVSS v4.0 9.2, Critical). The release is scheduled for Wednesday, 21 October 2026 at 14:00 UTC. We encourage all PHP users to prepare now so you …
This is very, very bad news: The private keys of eight eMudhra intermediate CA certificates have been compromised. They chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome …
Nicolas Mattia – Setting up SSH keys on macOS with Touch ID
A simple and secure way to create SSH keys on a Mac's Secure Enclave with Touch ID protection
For the past month or so, I have been on a digital declutter. I only realized this today, because this was not something I planned. I guess it just happened.
“Vibe coding” is a category error
Why the term “vibe coding” massively misrepresents and trivialises the fundamental transformation of software development as we know it.
you're still going to have a job in 5 years. — Whiteboard by /dev/fast
Automating coding is not the same as automating engineering. Engineering is not solved, and it's not even close.
ClickHouse Will Let You Be Wrong at Scale
So I've posted before how I think ClickHouse is great. Its columnar storage is fast, it has amazing compression. I won't bore you with those details, you can see them all here: https://matduggan.com/clickhouse-is-winning-the-observability-wars/ However all te…
Predicting the Past: Unveiling Internet Growth Insights
Explore the challenge of predicting the past in web data science, uncovering the effects of survivorship bias and hazard rates.
I found out a few days ago, that regardless of your permission settings on connectors, Claude auto-mode is able to use them. This violated my expectations, and exposed me to the lethal trifeca of AI agents.
My coding agent deleted a project without asking. The audit log says I did it.
An agent deleted infrastructure without asking, the platform's audit log attributed it to a human, and the hook that stops it from happening again.
Claude Code memory usage, measured: three sessions ran 32 processes and MCP servers outweighed Claude in two. A RAM budget for running sessions in parallel.
I Deleted 70,000 Comments
On 18 August I deleted every comment in a 29-day-old codebase: 71,660 lines across 742 files. Agents wrote most of them, and agents believed all of them. Here is where the reasons live now, what broke, and how the comments came back.
Why I Resist Generative “AI” – Esther Weidauer
Everything, from the ecological to the psychological to the weird
Why taste matters and how to develop it.
I Built a Stereo Vision Board for Hardware Hackers
This article was written entirely by a human, for humans. I tend to get excited about certain chips. This time, it was a microprocessor: The Rockchip …
My latest vibe coded game experiment is a Command & Conquer style RTS (Real Time Strategy) game called Battle Drones (play it here). Unlike my previous experiments, this one is …
I Took a Shower With My Personal Assistant | Spicer Matthews
My comparison of ChatGPT Dot, Grok Bot, and Autumn: natural voice, fewer permission prompts, and why my custom Claude Code assistant remains my primary agent.
Learn how Claude's prompt cache works and how to keep your token usage under control.
Developers who loved building things now spend their days supervising AI agents. Nobody asked them. What engineering leaders should be asking instead.
Why I started pricing flying lessons
What it actually took to get a driving licence in Germany, why I started reading about flying lessons instead, and the quiet problem with a system where the people selling the lessons also decide when you are ready.
A good redesign requires a plan and careful execution. Otherwise a designer risks breaking established user habits, which, in turn, make users angry.
Software engineer, tinkerer, builder
Optimizing for Human Wisdom
How I'm changing the way I work to build and preserve human wisdom now that agents handle most of the implementation
Voxtral 3: Mistral's voice agent SDK for real-time speech in 50+ languages — accurate transcription, emotional TTS, deep tool use. EU-hosted or self-deployed.
From Clinkipedia, the free AIncyclopedia
Should I build an MCP server or chat inside my app?
Why we gave Orbeon Forms’ Form Builder an MCP server instead of an embedded AI chat, what it costs us, and where we think this is going.
Recently I found an open source project that met most of my needs. However, there was a missing feature that I needed for my workflow. I looked for signs of life, last commit was nearly a year ago, oof. I was lucky to find someone else's PR for the exact feat…
Working notes on writing GPU kernels with Triton — tiles, program ids, offsets, masking, and the launch grid, with interactive figures.
Making a VGA Driver in SystemVerilog
One of my favorite labs in college so far has been my Digital Logic Design Lab. Two years ago the final few labs of the course involved building a VGA driver. While that might sound intimidating, it was a surprisingly attainable project. (Even if an inordinate…
Feedback at every step
Feedback doesn’t only come from customers. Every step of your delivery pipeline gives it, and smaller changes make it faster.
SOMETHING WORTH READING — MVNDY
A personal reflection on writing, perfectionism, and creative freedom, exploring ideas from Steinbeck, Barthes, Virginia Woolf, and Joan Didion.
Stars measure interest, not usage. After a year of MindRoom, with forks of a Matrix client, two Matrix servers and a Matrix web client, plus 126 workarounds for one AI framework, my rule is: depend on what millions of projects use every day, roll your own when…
2026-10-20 11:32 - CodeWithLLM
Updates and tips about using Large Language Models (LLM) for programming and development