Dad, Dev, Founder. Pusher-compatible WebSocket service: https://xitter.cf/t.co/9fyADN0Y4m Display any data, anywhere (macOS/iOS/Android): https://xitter.cf/t.co/NRDxC0vETY
United Kingdom
Joined August 2010
- Tweets7.2K
- Following1.8K
- Followers1.8K
- Likes16.9K
Whatever OpenAI drops this week/month - it's a response to brilliant Opus 5.5.
I don't think they have any response to incoming Fable 5.5... right...?
Mark S retweeted
Calling it now.
AI is going to usher in a whole new era of software development. I’m calling it Software as a Service.
People will want to use these tools but they’ll realize they don’t want to spend the time to maintain and update them over time.
This will create a whole new category of businesses and entrepreneurs that can take on that task for businesses that would rather work on their core products.
AI is changing everything. This is a whole new paradigm of thinking about the way we interact with software.
Mark S retweeted
Here is Proton CTO's AI manifesto, that I obtained multiple copies of 404media.co/manifestos-fear-…
Mark S retweeted
“If you provide an API client that doesn’t include rate limiting, you don’t really have an API client. You’ve got an exception generator with a remote timer.” — Richard Schneeman
I do like Omarchy by @dhh but can't fault my Macbook at all. Setup is always super easy, works with all my devices. Never had an issue.
But I do like the idea of having something different, especially that works on older machines/VM.
I opened the box form @DHH and it's the Dell XPS 14 with @omarchy loaded on it!
Set up was very easy, fast and flawless, I think it took less than a minute on first opening it
Omarchy asks you lots of questions to set it up for you, kind of like an onboarding, but not in an annoying way like Windows would do these days with too many useless questions, every question here makes sense
It sets up your Git and your AI agent of choice like Codex, Claude Code or OpenCode
Everything worked flawlessly with no bugs at all, really smooth
Then you're inside, and you see the famous Omarchy wallpaper, and then it gets a bit hard (for me at least) because I had to figure out the shortcuts
Luckily @jankeesvw helped me figure them out but I'm still learning
I'll be setting up my SSH to my VPS servers so I can work from there. And also I'd like to see if I can use Claude Code to customize Omarchy to my own liking, like generating my own apps etc.
I'll report back!
Part 2 of the video is in the reply (after I fixed the power)
Running a code review from the session that didn't wrote the code is the way to do it.
You would be surprised how different it is...
Mark S retweeted
4 months ago I cloned Airtable for a client in 5 days because they refused to pay Airtable $500/mo
months later, I’m still maintaining it
every two weeks it’s another edge case, a UI tweak, or a "quick 10-minute request." They’ve easily spent 10x more in headaches than the $2,000 they would’ve paid Airtable
just proving that SaaS isn't dead. Cloning isn't enough, if you want it to be same quality as original it becomes a full time job
and at this point isn't it easier to just pay?
Mark S retweeted
JUST IN: Cloudflare CEO warns “every single week it's going to feel like the sky is falling” as AI increasingly uncovers critical cybersecurity vulnerabilities.
Mark S retweeted
If all the govs shutting down servers for a PHP update, all the hosters & enterprises terrified by the vuln, gave $100k, or just $50k a year to the PHP Foundation, things could look very differently. Go, make your employer sponsor *today* thephp.foundation/sponsor/ #php #phpc @ThePHPF
Mark S retweeted
This week has been quite a shitshow already, and there are still 2 days to go
Here’s a quick recap of the security mess we’ve seen in just the last few days:
1. PHP Core RCE (CVSS 9.2)
Two critical vulnerabilities (CVE-2026-109618/109619) allowing unauthenticated RCE. A huge number of PHP installations potentially affected, and there are already reports of reliable exploitation against patched versions. Great…
Useful links:
Official PHP advisory and patches:
php.net/archive/2026.php#202…
Practical hardening and mitigation guide by Vincent Schmalbach. nginx/Apache configurations, PHP settings, patch verification and compromise checks:
vincentschmalbach.com/cve-20…
Huntress analysis. What to monitor, suspicious child processes, webshells and post-exploitation activity:
huntress.com/blog/php2shell-…
Wiz technical deep dive. Exploit mechanics, memory disclosure, affected applications and the role of AI:
wiz.io/blog/php2shell-php-rc…
Corelight’s open-source Zeek and Suricata detection rules:
github.com/corelight/php2she…
2. GitLab RCE (CVSS 10.0)
CVE-2026-110264. An integer overflow in the regex compiler leading to unauthenticated RCE. Apparently affects around 12 years(!) of GitLab releases.
docs.gitlab.com/releases/pat…
3. Node.js / Brotli RCE
CVE-2026-111497. An out-of-bounds write in the Brotli decoder that can lead to RCE when processing malicious compressed data. Node.js 22, 24 and 26 affected.
nodejs.org/en/blog/vulnerabi…
4. DNS-over-QUIC DoS
CVE-2026-97206. A use-after-free in Unbound’s DNS-over-QUIC implementation. Remote attackers can crash affected multi-threaded DNS resolvers.
nlnetlabs.nl/projects/unboun…
5. eMudhra CA disaster
And then there’s this absolute PKI clusterfuck. Eight intermediate CA private keys turned out to be ridiculously easy to reconstruct.
Browser vendors have started blocking the affected CAs, but outdated clients and applications with their own trust stores could keep accepting certificates from them. Cleaning up this mess is a lot harder than just patching a server.
Google’s analysis and response:
blog.google/security/protect…
Mozilla’s public incident investigation, including the technical findings, timeline and eMudhra’s explanations:
bugzilla.mozilla.org/show_bu…
—
And I can’t help wondering how much of this sudden wave of discoveries has to do with the latest AI models getting better at code review and vulnerability research.
We now have models that can dig through massive codebases and potentially find bugs that have been sitting there for years.
I’m not saying these particular vulnerabilities were discovered using AI. I haven’t seen evidence for that. But I do wonder whether we’re starting to see some of the effects.
The eMudhra case is obviously a different story. That’s a spectacular failure of key management and quality control.
Anyway, quite a week. And it’s only Thursday…
🤖 Made with AI
Mark S retweeted
Lot of #PHP snark going around right now from folks who've either never written software, or never done it in PHP (in the last 20 years).
I've architected, designed and hand-coded copious amounts of software in Java/Spring/Hibernate, .Net/C# Entity Framework and PHP/Symfony/Doctrine, applying very similar patterns and better practices of completely stack-agnostic concepts such as:
- Test-Driven Development (and given half-day and full-day hands-on live-coding workshops at conferences worldwide)
- Onion/Hexagonal Architecture
- Domain-Driven Design
- Data Mapper ORMs
Beyond workshops, I have spoken on these topics at conferences worldwide as well.
I might argue that I am not completely devoid of clue when it comes to these stacks' capabilities.
In fact, I have hired, coached and cross-trained engineers across these 3 stacks.
And I can assure you PHP shines within these paradigms, with an extremely vibrant, mature and robust ecosystem of Application Frameworks, Security Frameworks and Tools, and Open-Source Software Components and Libraries.
PHP is not WordPress. WordPress is not PHP. If you care about quality software, PHP is a great home for you. So is Java. So is C#. So are other languages. If you suck at software you'll suck in any stack. If you're good, each stack has strengths you can play to.
NOW let's talk about security.
This vulnerability, is the very first RCE to this level in PHP's history. It was reported back in August. AI did help. A lot. (Wiz claims one researcher did in a week what would previously have taken a team months)
Previous PHP RCEs had limited attack surfaces:
- 2024 - Windows CGI Only
- 2019 - One specific nginx setup
- 2012 - CGI only
None of which applied to reasonably-better practice typical Linux + Nginx + php-fpm deployments.
This right here was ... unique, I think even across any stack. The only language-runtime equivalent to it was probably Windows IIS Code Red.
That's not to say other stacks didn't have framework-level vulnerabilities with devastating impacts, if memory needs refreshed:
Ruby — Rails CVE-2013-0156: every Rails app, default config, pre-controller, botnet-exploited. The strongest analogue in any stack.
Java — Struts 2 CVE-2017-5638 (Equifax). Log4Shell needed the app to log attacker input; Spring4Shell needed WAR-on-Tomcat + JDK 9+ + POJO binding.
Node — React2Shell CVE-2025-55182 (Dec 2025, CVSS 10, CISA KEV): default create-next-app exploitable, but Express/Fastify/Nest untouched.
.NET — MS10-070 padding oracle (2010) leaked web.config/machineKey on every ASP (dot NET) site; RCE was a derived second step. Kestrel/ASP.NET Core has never had an RCE.
Look ... let's drop the snark. LLM-driven vulnerability research and breaching frameworks are about to humble the absolute heck out of all of us. They already have.
If you think your stack is not at risk, think again.
Mark S retweeted
The PHP ecosystem had a pretty eventful 48 hours.
Two critical RCE vulnerabilities (CVSS 9.2), a leaked disclosure, and emergency security patches.
But here's what really caught my attention: one of the issues had surfaced during an external audit in 2024. The PHP Foundation later described the delay in resolving it as a “structural failure.”
The good part? They're looking at changes to security decision-making and investing more in security work.
Open source isn't maintained by magic. It takes people, time and funding, especially for the unglamorous work of keeping things secure.
If you run PHP in production, check your runtime and apply the appropriate security update. Updating Composer dependencies alone won't patch PHP itself.
Hopefully, this incident leaves the PHP ecosystem stronger than before. ❤️
