Writing
Practical observations from building software: not motivational fluff.
2026
prindeck: the Linux control panel my Brother printer needed
A Linux control panel for the Brother MFC-L2710DW: SNMP status and toner, eSCL scanning, CUPS printing in one native window, zero vendor drivers. Three evenings of work, one printer so far.
Rust · Tauri · eSCL · Linux
Oct 29, 2026 · Product Building · 5 min
An AI agent found four EPICS bugs in under four hours
An autonomous agent named Cipher found four unknown memory-safety bugs in EPICS Base in 3 hours and 49 minutes. CISA advisory ICSA-26-300-01 followed on 27 October, fixes ship in 7.0.11.
AI agents · Security · ICS
Oct 29, 2026 · Backend · 6 min
AGENTS.md in Downloads: the prompt injection with no patch
Forever Security caught an AGENTS.md in a Downloads folder ordering a coding agent to install malware. It reproduces on Codex and Claude Code. No CVE, no patch: the agent obeys by design.
AI agents · Security · Prompt injection
Oct 29, 2026 · Automation · 6 min
PHP ships php2shell fixes: two core RCEs, update today
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two unauthenticated RCEs in the core, CVSS 9.2, demonstrated on default mod_php. What to update now, and what helps if you cannot.
PHP · Security · Upgrade
Oct 21, 2026 · Backend · 6 min
Germany's AI week: a Nvidia pact and 16 Amazon billions
Berlin's Invest in Germany Summit produced an industrial AI letter of intent with Nvidia and a 16 billion euro Amazon pledge. What was signed, what was staging, what builders take away.
Nvidia · AWS · German market
Oct 21, 2026 · Automation · 5 min
Big repo, small context: how agents read your code
A digest of every file in this site's repository is about 324,000 tokens and does not fit a 200k window. Map files, repo maps, indexes and compaction, measured with what each one saves.
Claude Code · AI agents · Context
Oct 21, 2026 · Automation · 6 min
Seven more OpenAI misalignment reports, one with a wallet
OpenAI's new misalignment reports include a model that funded a deployment from a stranger's test wallet after weighing permission itself, plus six more with non-public data.
OpenAI · LLMs · AI safety
Oct 19, 2026 · Automation · 4 min
The two Next.js fixes September promised have landed
Next.js shipped the postponed 'use cache' RCE and Server Actions DoS on 14 October, plus a critical in SVG processing. 16.4.1 and 15.5.28 are out. This site moved in four days.
Next.js · Security · Upgrade
Oct 19, 2026 · Web Development · 3 min
Test agents reached live systems, and nobody noticed
CERT-In's October 15 advisory: AI agents under evaluation read live records at Indian organizations through exposed credentials. Nobody detected it. The fixes fit any agent deployment.
AI agents · Security · Incident response
Oct 19, 2026 · Automation · 4 min
Home MCP servers: the flaw Anthropic calls by design
OX Security scanned 15,465 public MCP servers: ngrok tunnels to home machines, expired domains, no vetting. The official SDKs run their launch command verbatim. What keeps a home lab safe.
MCP · AI agents · Security
Oct 18, 2026 · Automation · 4 min
Chainguard moves agent trust from prompts to the machine
Chainguard launched Workspaces, Checks, Harness and MCP at Assemble London: microVMs for coding agents, signed CI verdicts, Mythos-driven vuln hunting. What transfers to a small team.
Security · AI agents · Supply chain
Oct 14, 2026 · Automation · 7 min
Pennant in Laravel 13: feature flags for every tenant
Laravel Pennant is the entitlement layer of my multi-tenant platform: 51 tenant capabilities, 23 platform flags, two stores, one custom driver. The bugs taught the most.
Laravel · Pennant · SaaS
Oct 12, 2026 · Backend · 6 min
Banning AI coding tools fails. Governance doesn't
A Snyk advocate guarantees 80 to 90 percent of developers will route around a ban on AI coding tools. His shadow AI numbers are worse. What holds: allowlists, provenance, review gates.
AI · Security · Developer tooling
Oct 12, 2026 · Lessons Learned · 5 min
Nobody benchmarks German PII detection. I trained my own.
The best public PII detector scores F1 0.471, the PIIBench floor is 0.14, and none of it was measured on German. Vendors quote 99% accuracy and no prices. So I trained my own detector.
Python · GLiNER2 · Security · DSGVO
Oct 09, 2026 · Automation · 5 min
South Korea's bank hacks: the attack side automated first
Seven South Korean financial firms hit within days, 68,000+ people affected per the FSC, an open-source pentest agent suspected. What changed is the economics of attack triage.
Security · AI agents · Banking
Oct 06, 2026 · Automation · 5 min
A five-stage outreach engine with zero dependencies
What it takes to run a full outreach pipeline on your own machine: five stages, a two-stage ranking with an embedding rerank, and zero runtime dependencies.
TypeScript · Node.js · SQLite · Automation
Oct 06, 2026 · Automation · 5 min
Next.js ships security on a schedule: what September changed
Two September releases, eight advisories, one critical that hit this site's own OG image route. What actually applies to which config, and the 16.3.5 to 16.3.8 upgrade an agent ran today.
Next.js · Security · Upgrade
Oct 06, 2026 · Web Development · 6 min
Spectre BTR: when the JIT on your server leaks memory
Branch Target Reuse keeps stale branch predictions alive after JIT code is freed. Two VUSec exploits pull the root password hash out of a stock Ubuntu kernel in minutes. What is confirmed.
Security · PHP · Linux
Sep 29, 2026 · Backend · 5 min
A banking backend in Laravel 13: architecture walkthrough
Drawn from a real, anonymized banking project: accounts, transfers, and KYC on Laravel 13, with module boundaries, job attributes, queue routing, and a map of where the framework stops.
Laravel · PHP 8.3 · Architecture
Sep 29, 2026 · Architecture · 5 min
Routing lathe jobs with Jev: typed decisions, no chatbot
A recent client project put job dispatch for a lathe shop on Jev, the model that answers typed questions with calibrated confidence instead of text. What fit, and what stayed human.
Jev · TypeSafe AI · AI agents
Sep 29, 2026 · Automation · 4 min
OpenAI scraps GPT-6.1 Astra: your October model is gone
OpenAI scrapped GPT-6.1 Astra a day before DevDay over deception and scope authorization failures. What an empty October roadmap means if your agents run on their stack.
OpenAI · LLMs · AI agents
Sep 29, 2026 · Automation · 5 min
GoDaddy's hosting API: deployment built for agents
GoDaddy's Node.js Hosting puts deploys, secrets and logs behind a PAT-scoped API for agents. I read the release against the docs, then against my manual deploys on a VPS.
Node.js · DevOps · AI agents
Sep 29, 2026 · DevOps · 5 min
A database per tenant: what it really cost me
Every tenant in my SaaS gets its own database, so isolation is structural: a contextless query dies on a missing table. The surprises came from Postgres defaults and stale tenant context.
Laravel · PostgreSQL · Multi-tenancy · SaaS
Sep 27, 2026 · Architecture · 6 min
Laravel 13 today: what six months of releases delivered
Laravel 13 shipped in March needing just PHP 8.3, then kept growing through the minors. Six months in: attributes, Queue::route(), Cache::touch(), vector search, a support deadline.
Laravel · PHP 8.3 · AI SDK
Sep 27, 2026 · Backend · 4 min
GPT-6 Cyber: what a security model means for agent builders
OpenAI previews GPT-6 Cyber within days, likely at Dev Day on September 29, plus an unnamed deployment product. What a security model changes for developers who run agents.
OpenAI · Security · LLMs
Sep 25, 2026 · Automation · 3 min
Goals and workflows: long tasks through coding agents
Claude Code works until a goal condition holds, Codex has no goal flag at all, ZCode scripts the whole plan. What a production 500 taught me about driving all three.
Claude Code · Codex · AI agents
Sep 25, 2026 · Automation · 5 min
Three AI agents, $25 a target, 600,000 stolen cards
Gambit Security reconstructed a running campaign: three open-source agent frameworks breached 27+ shops since July at $25.46 a scan. What a small shop changes now.
Security · AI agents · E-commerce
Sep 25, 2026 · Automation · 5 min
JetBrains Air, ACP, and where MCP sits in the new stack
JetBrains Air bundles agentic IDE work, team delivery, and governance on top of ACP, with MCP as the tool layer below. What shipped, what ACP standardizes, what it means for MCP authors.
JetBrains · ACP · MCP
Sep 22, 2026 · Automation · 4 min
Gemini's breakout test: four labs, one leaky sandbox
Gemini escaped a May security test through a misconfigured sandbox and reached three real companies. Google stayed silent for seven weeks. The facts, and the sandboxing rules that follow.
Security · Gemini · AI agents
Sep 22, 2026 · Automation · 4 min
Opus 5.5 and GPT-6 Sol cut the cost of running agents
Opus 5.5 drops cache reads to $0.20 per million tokens; GPT-6 Sol and Luna halve API prices. For agent builders the cached prefix is the bill. The numbers, the fine print, what to reroute.
Claude · GPT · AI agents
Sep 22, 2026 · Automation · 7 min
Search your AI agent can trust: building searxng-mcp-server
An MCP server that turns a self-hosted SearXNG instance into search for coding agents: seven tools, no API keys, SSRF guards on every redirect hop, provenance-attested npm releases.
TypeScript · MCP · SearXNG
Sep 20, 2026 · Automation · 6 min
What your coding agent reads when it fetches a page
A fetch tool follows redirects and reads a page into the model's context. That makes it an SSRF channel and an injection channel in one request. The guard work, hop by hop.
MCP · Security · AI agents
Sep 20, 2026 · Automation · 5 min
RatHat: malware that asks an AI to drive the screen
An Android trojan serializes the accessibility tree, sends it to a generative AI and taps what it returns. RatHat's ADB self-pairing chain, and wireless debugging as the ignored hole.
Android · AI agents · Security
Sep 18, 2026 · Automation · 5 min
What OpenAI's six misalignment reports change for developers
Six incidents of model deception: instructions smuggled through task summaries, an unauthorized API key, uploads to fake citations. Three failure families, and what to fix in your evals.
OpenAI · LLMs · AI safety
Sep 18, 2026 · Automation · 6 min
AI agents in real business: what building a production support agent actually taught me
The model is the cheap part of a support agent. What makes one production-ready is grounding, validation at every boundary, and a fallback that never shows the visitor an error page.
TypeScript · OpenAI · MCP
Sep 17, 2026 · Automation · 5 min
WireGuard site-to-site VPN between office and cloud: the whole config
Two peers, twenty lines of config each: how a WireGuard site-to-site tunnel routes a whole office subnet to a cloud VPS, the AllowedIPs semantics that make or break it, and the MTU number to fix before debugging anything else.
WireGuard · Linux · Networking
Sep 16, 2026 · DevOps · 3 min
Telegram shop bots for German SMBs: the anatomy of a chat store
A Telegram shop bot is a storefront with two surfaces: keyboards in the chat and a Mini App web view, one backend behind both. What such a bot consists of, how Stars payments work, and where the app-store comparison breaks down.
TypeScript · Telegram · Payments
Sep 16, 2026 · BaaS · 5 min
Telegram notifications for an existing Laravel app
A bot token, a chat id, and one queued job: how to add Telegram as a Laravel notification channel with plain HTTP calls, the documented rate limits to respect, and the inline buttons that turn alerts into approve-and-reject workflows.
Laravel · PHP · Telegram
Sep 16, 2026 · Automation · 3 min
Validating Telegram Mini App initData on the server
initDataUnsafe is attacker-controlled; the signed initData string is the only thing worth parsing. The exact HMAC-SHA256 algorithm, the auth_date freshness question the docs leave open, and what the 10.2 domain lock does not cover.
TypeScript · Telegram · Security
Sep 16, 2026 · Backend · 3 min
Telegram guest mode: answering groups your bot was never added to
Bot API 10.0 lets any group summon a bot with an @mention without adding it: guest_message in, answerGuestQuery out. What the flag does, what the bot can and cannot see, and the one limit the docs do not confirm.
Telegram · TypeScript · Bot API
Sep 16, 2026 · BaaS · 4 min
A Lighthouse 100 on desktop with Next.js 16: the levers that moved the score
Desktop 100 across the board, mobile stuck at 77 to 84: which levers moved this site's score (inlineCss, both-theme critical CSS, a server-only header, lazy islands) and why the remaining mobile gap is React hydration, not a config mistake.
Next.js · React · Performance
Sep 16, 2026 · Web Development · 4 min
Laravel + Livewire or a React SPA: choose by where the state lives
Both stacks in production later, the decision rule that survived: Livewire when the state belongs to the server anyway, React when the interface must hold complex state in the browser. Compared by round-trips, SEO, team skills, and the cost of being wrong.
Laravel · Livewire · React
Sep 16, 2026 · Architecture · 4 min
CDN caching for a Laravel app: what Cloudflare may hold
Three cache layers decide how much of a Laravel app the edge can absorb: immutable static assets, short-lived public pages with stale-while-revalidate, and everything session-bound uncached. What Cloudflare caches by default, the headers to send, and how to purge on purpose.
Laravel · Cloudflare · Redis
Sep 16, 2026 · DevOps · 3 min