Señor Developer. You can write shit code in any language or framework you want. Do whatever makes you happy.
Cocoverso
Joined March 2009
- Tweets15.9K
- Following1.2K
- Followers536
- Likes59.9K
Agustin Gomes retweeted
Lot of #PHP snark going around right now from folks who've either never written software, or never done it in PHP (in the last 20 years).
I've architected, designed and hand-coded copious amounts of software in Java/Spring/Hibernate, .Net/C# Entity Framework and PHP/Symfony/Doctrine, applying very similar patterns and better practices of completely stack-agnostic concepts such as:
- Test-Driven Development (and given half-day and full-day hands-on live-coding workshops at conferences worldwide)
- Onion/Hexagonal Architecture
- Domain-Driven Design
- Data Mapper ORMs
Beyond workshops, I have spoken on these topics at conferences worldwide as well.
I might argue that I am not completely devoid of clue when it comes to these stacks' capabilities.
In fact, I have hired, coached and cross-trained engineers across these 3 stacks.
And I can assure you PHP shines within these paradigms, with an extremely vibrant, mature and robust ecosystem of Application Frameworks, Security Frameworks and Tools, and Open-Source Software Components and Libraries.
PHP is not WordPress. WordPress is not PHP. If you care about quality software, PHP is a great home for you. So is Java. So is C#. So are other languages. If you suck at software you'll suck in any stack. If you're good, each stack has strengths you can play to.
NOW let's talk about security.
This vulnerability, is the very first RCE to this level in PHP's history. It was reported back in August. AI did help. A lot. (Wiz claims one researcher did in a week what would previously have taken a team months)
Previous PHP RCEs had limited attack surfaces:
- 2024 - Windows CGI Only
- 2019 - One specific nginx setup
- 2012 - CGI only
None of which applied to reasonably-better practice typical Linux + Nginx + php-fpm deployments.
This right here was ... unique, I think even across any stack. The only language-runtime equivalent to it was probably Windows IIS Code Red.
That's not to say other stacks didn't have framework-level vulnerabilities with devastating impacts, if memory needs refreshed:
Ruby — Rails CVE-2013-0156: every Rails app, default config, pre-controller, botnet-exploited. The strongest analogue in any stack.
Java — Struts 2 CVE-2017-5638 (Equifax). Log4Shell needed the app to log attacker input; Spring4Shell needed WAR-on-Tomcat + JDK 9+ + POJO binding.
Node — React2Shell CVE-2025-55182 (Dec 2025, CVSS 10, CISA KEV): default create-next-app exploitable, but Express/Fastify/Nest untouched.
.NET — MS10-070 padding oracle (2010) leaked web.config/machineKey on every ASP (dot NET) site; RCE was a derived second step. Kestrel/ASP.NET Core has never had an RCE.
Look ... let's drop the snark. LLM-driven vulnerability research and breaching frameworks are about to humble the absolute heck out of all of us. They already have.
If you think your stack is not at risk, think again.
Agustin Gomes retweeted
Last night's slopfest surrounding the bogus PHP exploit and the subsequent panic wave is a perfect example of why good cybersecurity researchers are still needed, why LLMs are not infallible, and why critical thinking cannot be automated away.
AI can accelerate research, but clanker confidence is not evidence and consensus built on unverified claims in the end is still just speculation.
Next time we might not be so fortunate, so maybe as a community we need to tighten and review how we handle patching and assume leaks will happen and be prepared to counter that.
Agustin Gomes retweeted
皆様に、今夜に対応して頂きたい大至急のお願いです。
多くのウェブサイトで使用されているPHPに関し、PHPのセキュリティチームが、重大な２件の脆弱性に関する注意喚起を行っています。
公開しているウェブサイトでPHPを使用しているか確認し、今夜、10月21日午後11時（日本時間）に公開される修正パッチについて、可及的速やかに適用できるよう準備をお願いします。
修正パッチを速やかに適用することが困難な場合は、例えばウェブサイト等を一時的に停止させることも、リスクを低減させるための有効策の一つと考えられます。
国家サイバー統括室のXアカウントでも関係する情報を発信していますので、そちらも参考にして下さい。
国家サイバー統括室(注意・警戒情報)（@cyber_forecast） / X
Agustin Gomes retweeted
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
Agustin Gomes retweeted
Of course it'd be better to have vulnerability in PHP at all, but I'm deeply moved by today's events:
1) The absolute profesionalism of everyone involved from @ThePHPF. Thank you!
2) The number & size of sites went off-line at 2PM UTC to patch their servers. PHP totally runs the world!
3) PHP in news reports in press and TV across the world.
Agustin Gomes retweeted
PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities. The rules are available to all customers, including free.
We are seeing early attacks emerging and are updating mitigations as new vectors show up.
This is a STOPGAP only. Patch as soon as @ThePHPF releases the update at 14:00 UTC today.
Agustin Gomes retweeted
🚨 UPDATE: PHP 8.5.12 may still be vulnerable to php2shell!
Researchers are reporting a successful double-free trigger on the newly patched release.
⚠️ The official fixes may be incomplete. A crash alone doesn't confirm RCE, but this deserves urgent investigation.
Don't assume you're safe just because you've patched.
#php4shell #php #cybersecurity
xitter.cf/_annieversary/status/2…
chat. chat... its not funny anymore
Readers added context they thought people might want to know
The original post has since been edited to specify that this was about an unrelated vulnerability that the user had discovered, not the recently patched vulnerability.
fedi.katze.sh/@elise/1174793…
Agustin Gomes retweeted
Sugerencias para enfrentar el dia de hoy en ciberseguridad con lo de la vulnerabilidad en PHP.
Primero: somos todos colegas, dejense de putear uno a otro. Esta falla como miles de CVE existian desde hace decadas. La IA la descubrio, ningun humano mortal, asi que nadie es mas que otro.
Segundo: Parchear no resuelve nada, incluso puede complicar mas las cosas, a quien le resuelve la vida parchear hoy? al minimo porcentaje que tenia todo actualizado hasta la semana pasada, y todo incluye codigo fuente y sistema operativo, dudo que sea el 5% con suerte. Si sos de ese minimo porcentaje, si parchea. Sino:
Tercero: muchos servidores corren muchos servicios al mismo tiempo, no tienen servicios distribuidos, entonces para que el exploit no te afecte por un ataque directo o de bots es preferible perder disponibilidad que integridad y confidencialidad, una de los tres pilares de la ISO 27001, y este debate sera algo que vendra a futuro. Yo elijo la indisponibilidad en este escenario caotico antes que poner en riesgo la otras dos. Por eso apaga Apache, NGINX u OpenLight Speed. No alcanza con un WAF, ahora. Con eso el servidor, menos las webs quedan operativos.
Cuarto: La falla viene desde PHP 5 que sigue recontra productivo como el 7, si bien dicen que el soporte solo es de 8.2 en adelante, es posible que se den dos escenarios debido a la gravedad el asunto: que en breve salga un update para versiones viejas de manera extraordinaria o que podamos aplicar un cambio de configuracion en PHP que permita que esa vulnerabilidad no se pueda explotar.
Quinto: Quienes piensen que dejar todo expuesto esta ok y un backup te salva, estan en un grave error, pueden crear persistencia, robo de informacion, inyectar codigo malicioso para terceros, es decir, solo vas a agrandar tu problema.
Sexto: PHP es un gran lenguaje, por algo es el mas utilizado en Internet, los detractores son personas que les molestan cositas como que la variable no tenga que obligatoriamente declararse por tipo o que simplemente su curva de aprendizaje sea facil. Ojo que Node.js hoy justamente tambien esta en el horno y asi otros lenguajes como .NET y IIS.
Septimo: no rompan mas las pelotas, si van a comentar: aporten y ayuden, si van a criticar y jamas en su vida gestionaron nada, corranse del camino, que no nos perdemos de nada.
Agustin Gomes retweeted
TL;DR: @ThePHPF security team had been working round the clock since august and with multiple parties to coordinate smooth patching...
only for people to disclose 2 days before scheduled release. I feel so bad for you guys 💔
Agustin Gomes retweeted
As it's already known, I will be releasing a lab on the CVE-2926-109618,9 PHP RCE upon embargo release. Until then, patch to the latest.
Agustin Gomes retweeted
There is a family stuck in ur balls.
your job is to figure out how to get it out
Agustin Gomes retweeted
Hoy es día de la madre en Argentina.
Mi vieja está preparando unos ravioles con tuco, y mirá si me voy a perder un día como hoy para shippear cosas con IA.
Dejémonos de joder con estas pelotudeces hermano.
El mensaje que están bajando estos CEOs/CTOs de mierda me está empezando a pudrir.
Esta industria sigue bajando constantemente el mensaje de que tenemos que desvivirnos por el laburo, por una empresa, por un rol o puesto.
HARTO me tienen.
Yo no soy ni pienso ser mi profesión, mis certificaciones, sueldo, etc. etc.
Construir una buena carrera profesional es importante, está bueno...pero no si el precio a pagar es alejarnos de la gente que queremos, de lo que nos gusta en la vida y de nosotros mismos.
Y el pelotudo que diga "Es que no tenés pasión" probablemente te quiera vender un curso para desarrollar con IA, o tenga su propia empresa y solo quiere laburar con gente que se deja negrear por 2 pesos.
Vercel CEO Guillermo Rauch (@rauchg) says the old work week is officially dead:
“You would think, ‘AI has arrived, & we're all working 2 hours a week.’”
“The opposite is happening. I get text messages at midnight from the CEOs and CTOs of these companies.”
“It’s more like 7/7/7: 7 days a week from 7 AM to 7 PM.”
Agustin Gomes retweeted
Codex didn't publish your .env to cloudflare, YOU did. You are responsible for whatever clanker generates for you.
This is why YOU READ THE CODE. If you can't read the code, you hire someone who can.
Infra providers should stop bankrolling oopsies like this so people learn that when there is accountability, humans are needed.
FINALLY found how my key got leaked and got the $90,000 bill from google
Opus 5.5 said codex had PUBLISHED MY ****ING .ENV TO CLOUDFALRE PAGES ‼️
Meanwhile codex couldn't find anything, refused to explain itself and flagged my chat for cybersecurity risk lol
Agustin Gomes retweeted
AI makes your work harder, not easier. I think of it as work density—the percent of time spent expending brain cells. The denser the work, the more exhausting it is. If you have 10 agents running at once, you have 10x the context swaps, each of which requires recovery time. The more density, the higher the recovery time. When you don't take time to recover, you burn out. Working with multiple agents is worse than normal multitasking because you're juggling more tasks.
There's nothing new about this. I can't think of a single "time-saving" workplace technology that saved anybody any time. Instead, it forces us to work harder. It increases density. The problem is compounded by moronic management that fires people because of the tech. In practice, firing 50% of your staff means that the remaining 50% have to do twice the work in the same time. It's exhausting. The utopian notion that AI will create leisure time is complete BS. It will just force us to cram more work into the time we have.
We need to just stop frantically pushing, pushing, pushing for more and more output and relax. It takes a conscious effort to counter that effect, so make the effort. You will not be "more productive" once you burn out.
ALT Post from Twitter: https://t.ly/ozBrG
Agustin Gomes retweeted
Your best performances will come when you are working in a way that is a full expression of you. The work becomes a natural display of your personality. This is when you not only get better results, but also love the activity — because in doing the craft, you feel alive.
Agustin Gomes retweeted
One of the key practices of a highly effective organization is that everybody works at a "sustainable pace." That term has been twisted around, but what it really means is that everybody comes into work every day rested, relaxed, and able to do their best work, and they stop when those conditions no longer hold.
Couple that thinking with the well-documented fact that nobody can work more than about six hours a day and be effective. If you're doing intensively intellectual or creative work, that number is closer to four. The eight-hour day dates back to 19th-century sweat-shop factory work. The crack-the-whip bosses wanted the line running 24 hours a day, but 12-hour days led to too many deaths and mistakes (not to mention worker anger), so they split the day into three equal parts. Eight hours. There is absolutely no reason to be sticking to that schedule in the 21st century, at least not for knowlege work. In fact, it's counterproductive to overwork people. The result is lower quality, more bugs, and much of the work will have to be redone.
If you're forced to work 8 hours, you'll spend 4-6 productive hours and fill the rest with mindless busywork. That busywork benefits nobody. It's theft.
Agustin Gomes retweeted
💥 Acaban de BORRAR la cédula de ALEX SAAB del Registro Electoral!!
Tranquilos, el antes y el después quedaron registrados incluso en la blockchain.
Hicieron exactamente lo que les dije que iban a hacer 😂
La de Camila Fabri, sigue apareciendo.
