Lead Software Engineer at GovTech. Founder, Singapore PHP User Group. Runs @JuniorDevSG and https://xitter.cf/t.co/Ioau8rFZGd. Ex Pivot.

Singapore
Joined March 2010
Michael Cheng 🇸🇬 retweeted
Lot of #PHP snark going around right now from folks who've either never written software, or never done it in PHP (in the last 20 years). I've architected, designed and hand-coded copious amounts of software in Java/Spring/Hibernate, .Net/C# Entity Framework and PHP/Symfony/Doctrine, applying very similar patterns and better practices of completely stack-agnostic concepts such as: - Test-Driven Development (and given half-day and full-day hands-on live-coding workshops at conferences worldwide) - Onion/Hexagonal Architecture - Domain-Driven Design - Data Mapper ORMs Beyond workshops, I have spoken on these topics at conferences worldwide as well. I might argue that I am not completely devoid of clue when it comes to these stacks' capabilities. In fact, I have hired, coached and cross-trained engineers across these 3 stacks. And I can assure you PHP shines within these paradigms, with an extremely vibrant, mature and robust ecosystem of Application Frameworks, Security Frameworks and Tools, and Open-Source Software Components and Libraries. PHP is not WordPress. WordPress is not PHP. If you care about quality software, PHP is a great home for you. So is Java. So is C#. So are other languages. If you suck at software you'll suck in any stack. If you're good, each stack has strengths you can play to. NOW let's talk about security. This vulnerability, is the very first RCE to this level in PHP's history. It was reported back in August. AI did help. A lot. (Wiz claims one researcher did in a week what would previously have taken a team months) Previous PHP RCEs had limited attack surfaces: - 2024 - Windows CGI Only - 2019 - One specific nginx setup - 2012 - CGI only None of which applied to reasonably-better practice typical Linux + Nginx + php-fpm deployments. This right here was ... unique, I think even across any stack. The only language-runtime equivalent to it was probably Windows IIS Code Red. That's not to say other stacks didn't have framework-level vulnerabilities with devastating impacts, if memory needs refreshed: Ruby — Rails CVE-2013-0156: every Rails app, default config, pre-controller, botnet-exploited. The strongest analogue in any stack. Java — Struts 2 CVE-2017-5638 (Equifax). Log4Shell needed the app to log attacker input; Spring4Shell needed WAR-on-Tomcat + JDK 9+ + POJO binding. Node — React2Shell CVE-2025-55182 (Dec 2025, CVSS 10, CISA KEV): default create-next-app exploitable, but Express/Fastify/Nest untouched. .NET — MS10-070 padding oracle (2010) leaked web.config/machineKey on every ASP (dot NET) site; RCE was a derived second step. Kestrel/ASP.NET Core has never had an RCE. Look ... let's drop the snark. LLM-driven vulnerability research and breaching frameworks are about to humble the absolute heck out of all of us. They already have. If you think your stack is not at risk, think again.
45
83
16
384
23,729
Michael Cheng 🇸🇬 retweeted
PHP 8.4.27 released - 89 fixes in 30 components, including security fixes (CVE-2026-109618, CVE-2026-109619). Changelog + downloads: php-net.pro/news/php-8-4-27-…
21
958
65
2,039
166,696
Want to see how this goes.
$5300 in $100s please. That's what we said at the bank this morning. See, whenever you have a free IRL event, you tend to get a lot of no-shows. Plenty of people sign up and RSVP, but ultimately far fewer show up. This isn't a big deal if you have unlimited space and anyone can just show, but if you want to have an event at a small venue, and you can only host, say, 80 people, you need to have a sense of how many are coming. That's why you require signup, that's why you require RSVPs. But still, many don't show. We've run into this with our own free events over the years. You "sell out" of space, but you end up with 15 extra seats because people don't show. Those seats could have been filled with people who really wanted to be there. We could charge, which might help, but we really want this to be a free event. So what to do? How can we find a way to bridge the gap between who says they'll show, and who will really show? How do we shrink the delta? We're trying something tomorrow. Tomorrow we have a Breakfast with Basecamp IRL event in Chicago. It's entirely free. As long as you show up. 53 registered. When you register you're charged $100. And if you show up, you get a crisp $100 bill at the door. So you're made whole, it's entirely free. If you don't show, you forfeit your $100. It costs you money not to be there. A little incentive. This isn't a new idea. Some restaurants have been charging for reservations, essentially asking you put down a deposit which can be applied to the meal if you show. If not, you lose the deposit. So we're doing the same thing, except for a free event, and rather than apply the deposit to the meal or ticket price (which we don't have), we just literally hand you back the cost of admission, with a smile. I'm really curious to see if it works. I'll comment back with the no-show rate and compare it to our last event where we didn't do this at all.
1
726
Michael Cheng 🇸🇬 retweeted
Come join us to see what is brewing at Singapore Polytechnic for Junior Devs SG Code & Tell this 14 July 2026, and you might just leave with a new trick or two. 🥡 meetup.com/junior-developers… – at Singapore
1
3
152
Michael Cheng 🇸🇬 retweeted
The President of Anthropic said something at Stanford that no other AI CEO will say publicly. She talked about what AI is doing to the people who use it, why she walked out of OpenAI, and what skills will actually matter when AI can do most of what we do today. 1/ What AI safety actually means
34
60
7
347
150,451
Michael Cheng 🇸🇬 retweeted
A kid from Singapore who grew up training to be a concert pianist became one of the most important AI researchers alive, quit Google to start a frontier AI lab with 20 people and $60 million, built a model that competed with GPT-4 in a year, then walked away from the unicorn he created and went back to Google to lead the team that just won the International Math Olympiad with an AI. His name is Yi Tay. Almost nobody outside the AI research world knows it. Here is the story. Yi grew up in Singapore. He earned a classical piano performance diploma from Trinity College London in 2012 and almost became a professional musician. He went into computer science instead, did his PhD at Nanyang Technological University, and joined Google Brain as a research scientist. There were almost no Singaporean researchers in frontier AI at the time. He used to say he was on an uncharted path. At Google he became the co-lead of PaLM-2, the brain behind Google's entire AI stack. He invented UL2, a pretraining method now used across the industry. He invented Differentiable Search Indexes. His work shipped inside Google Assistant, YouTube, and Search. When ChatGPT launched in late 2022, Yi made a decision that shocked the research community. He left Google. In 2023 he co-founded Reka with researchers from DeepMind and Meta. The headquarters was in San Francisco, but the team was scattered across Asia, Europe, and the US. They had no big-tech backing. They had 20 people total. They had $60 million in funding. For context, OpenAI had around 600 people working on GPT-4. Google Gemini had 950 co-authors on the technical report. Reka had fewer than 5 people on pretraining. Yi lived nocturnally for 639 days. Five cups of coffee a day. Takeout twice. He gained 15 kilograms. He had a newborn baby. He worked across time zones his entire team was spread across. He built infrastructure from scratch in places Google had taken for granted. In May 2024 Reka Core debuted at number 7 on the LMSYS leaderboard. The only GPT-4 class model on the planet that was not trained by OpenAI, Google, Anthropic, or Meta. A 20-person company with 5 people on pretraining had just shipped a frontier model. Alibaba Cloud, NVIDIA, and Oracle became partners. The company hit a $1.3 billion valuation. Then in November 2024 Yi did something nobody expected. He walked away. He posted a quiet note on his blog titled "Returning to Google DeepMind." After 639 days of building one of the most respected frontier labs outside the big four, he went back to the company he had left. He wrote that he had learned more than he ever thought possible. He did not explain much else. Google made an extraordinary bet on him. They let him build something nobody else in the industry has, a DeepMind lab in Singapore. Yi runs it with Quoc Le. The team focuses on reasoning, reinforcement learning, and post-training for Gemini. It started with a dozen researchers. It now has over 300. Last summer, Yi's team led the effort that won the International Math Olympiad gold medal with Gemini Deep Think. The model solved IMO problems in a live competition, the kind that fewer than a hundred humans on Earth can solve under time pressure. His team also drove the work behind Gemini's ICPC 2025 gold medal. Yi still lives in Singapore. He still plays piano when he has time. He calls himself a global citizen who does not identify with any local AI scene. He has been at Google for nearly 14 years if you count the Reka detour. He says the Singapore lab is just getting started. A pianist from Singapore co-led the model that powered Google AI, left to build a frontier lab with 20 people and beat models trained by armies, walked back into Google, and is now running the team that just taught a machine to win Math Olympiad gold. The most influential AI researcher you have never heard of is sitting in a Singapore office right now, training the next generation of models that think.
13
74
8
637
75,195
Michael Cheng 🇸🇬 retweeted
And the important dates.
1
57
Michael Cheng 🇸🇬 retweeted
More details on our code mentoring this year.
1
1
85
Michael Cheng 🇸🇬 retweeted
In collaboration with @womendevssg, we are organizing the 7th batch of JuniorDevSG Mentoring. This round, we are doing Code Mentoring: Pick a System Design Question, solve it and build it for real with guidance from mentors. Sign up here: linktr.ee/juniordevsg_mentor…
1
1
103
Michael Cheng 🇸🇬 retweeted
The afterparty before the official AIE afterparty: @FeatherlessAI afterparty with @taishiling @coderkungfu and SG tech community friends! Not in picture: da boss @picocreator
1
3
264
Michael Cheng 🇸🇬 retweeted
i can’t believe it. you can really just do things at @aiDotEngineer singapore
3
9
1
112
6,800
CityJS #Singapore starts tomorrow with a #SOLDOUT workshop with @HowDevelop - still some workshops left for the 5th and the main event!! Register now sngapore.cityjsconf.org #singaporetexh
1
3
224
Ready for the big 30 of JS in #Singapore One month to go for the biggest event in the city? Will you miss it? Free meetups, workshops and so much more! Get your ticket now cityjsconf.org
1
9
9
906
🎉 Just 2 months till #CityJSSingapore! We’re back for year FOUR in Southeast Asia and it’s bigger than ever: 🔥 20 inspiring speakers 🛠️ Hands-on workshops 🚀 Career-boosting sessions to level up your productivity Secure your spot now: singapore.cityjsconf.org #javascript #singapore
5
10
608