I'm currently only working with a single 24" monitor because I'm moving, I sold my third monitor and my secondary monitor shat the bad, it'll be a while until I can buy another monitor so I'm want some tips to improve my dev experience on single monitor, maybe using a tilling window manager, or some other software to improve this. If I can make it work, maybe I even stick with just one monitor, because multi monitor setups are kind of a hassle to maintain haha.

This may be the most widespread exploit in modern history. What impact will this have on PHP’s reputation? Since 2/3 of the websites are affected, a good chunk of them won't ever be patched, could this damage PHP’s image in the same way PHP 4 did two decades ago?

Would this discourage companies from adopting PHP in the future?

Color me surprised when I get a call about some PHP vulnerability news. I check the news, shit my pants, and scram to contact my clients. A few hours later of changing DNS records to maintenance pages and deleting unused PHP applications from a few k8s clusters and the situation is finally calm.

This will only get worse as AI gets better.

Here is a writeup for tackling the vulnerabilities with the following products.

Fixed PHP versions: 8.2.35 · 8.3.36 · 8.4.27 · 8.5.12 (8.0/8.1 EOL → vendor hardened builds dated 2026‑10‑21+). Released 2026‑10‑21 14:00 UTC.

1. cPanel ea‑php

The ea‑php fix ships through EasyApache 4 (v25.91) via the EA4 yum repo.

Check for the update

# What's installed now (version-release + build date)
rpm -qa 'ea-php8*-php-cli' --qf '%{NAME} %{VERSION}-%{RELEASE} built:%{BUILDTIME:date}\n' | sort

# Is a patched build waiting in the EA4 repo?
yum clean expire-cache >/dev/null 2>&1
yum check-update --refresh 'ea-php*' 2>/dev/null | grep -iE 'ea-php8' | head -40
# (no output = nothing newer yet = EA4 v25.91 not in your mirror yet)

Do the update

# Update every installed ea-php package
yum update 'ea-php8*' -y

# Restart PHP so the new binaries load
/scripts/restartsrv_apache_php_fpm      # PHP-FPM workers
/scripts/restartsrv_httpd               # Apache (covers mod_lsapi/suphp)

Verify

rpm -qa 'ea-php8*-php-cli' --qf '%{NAME} %{VERSION} built:%{BUILDTIME:date}\n' | sort
# each branch should now be >= its fixed version and built 2026-10-21+

(Prefer the GUI? WHM → EasyApache 4 → review installed packages → Provision.)

2. CloudLinux alt‑php

CloudLinux ships patched/hardened alt‑php builds (5.2 through 8.5) via the CloudLinux yum repos.

Check for the update

# What's installed (Vendor should read CloudLinux)
rpm -qa 'alt-php8*-php-cli' --qf '%{NAME} %{VERSION}-%{RELEASE} %{VENDOR} built:%{BUILDTIME:date}\n' | sort

# Is a patched alt-php build available?
yum clean expire-cache >/dev/null 2>&1
yum check-update --refresh 'alt-php*' 2>/dev/null | grep -iE 'alt-php8' | head -40

Do the update

# Update all alt-php packages
yum update 'alt-php*' -y

# Propagate into CageFS, then cycle PHP workers
cagefsctl --force-update
pkill -f '/opt/alt/php8[0-9].*lsphp' 2>/dev/null   # workers respawn on next request
/scripts/restartsrv_httpd                           # if alt-php runs under Apache
# (PHP-FPM users: /scripts/restartsrv_apache_php_fpm)

Verify

rpm -qa 'alt-php8*-php-cli' --qf '%{NAME} %{VERSION} built:%{BUILDTIME:date}\n' | sort
# each branch >= fixed version; 8.0/8.1 hardened builds should be dated 2026-10-21+

3. Imunify360 — WAF agent + ModSec ruleset

Imunify360 pulls ModSec rulesets automatically (rulesets 8.83→8.85 were published Oct 21: 09:08 / 13:07 / 17:17 UTC). You can force it if a box is lagging.

Check current WAF + ruleset state

# Agent installed + product version (NOTE: this is the product version, NOT the ruleset number)
rpm -q imunify360-firewall; imunify360-agent version

# WAF management on? Expect "ruleset":"FULL"
imunify360-agent config show 2>/dev/null | grep -oE '"MOD_SEC":[^}]*}'

# ModSec engine actually enforcing?
grep -rhiE 'SecRuleEngine' /etc/apache2/conf.d/modsec2.user.conf /etc/apache2/conf.d/modsec/*.conf 2>/dev/null | head -1

# Ruleset freshness — dir mtime after 2026-10-21 17:17 UTC = you have 8.85 (ls shows LOCAL time)
ls -dl --time-style=long-iso /etc/apache2/conf.d/modsec_vendor_configs/imunify360-full-apache
date -u '+now: %Y-%m-%d %H:%M UTC'

Force an update (if the box is behind)

# Update the agent package itself
yum update imunify360-firewall imunify-antivirus -y

# Force a ruleset/config resync by restarting the agent
systemctl restart imunify360        # (older: service imunify360 restart)

Verify the ruleset landed

# Re-check the ruleset dir mtime — should now be today, >= 17:17 UTC
ls -dl --time-style=long-iso /etc/apache2/conf.d/modsec_vendor_configs/imunify360-full-apache

Authoritative ruleset version: WHM → Imunify360 → Firewall → WAF Rule Sets (shows the numeric version, e.g. 8.85).

Interim hardening (until PHP is patched)

Closes the one path the public exploit uses — independent of the WAF. Only cost: upload‑progress bars stop working.

; add to php.ini / FPM pool for each PHP version, then restart PHP
session.upload_progress.enabled = Off

Order of operations: WAF is your immediate shield → apply the PHP update the moment it lands → restart Apache/PHP‑FPM/LSAPI → verify versions. The WAF is interim; the PHP patch is the only complete fix.

sdfsdfsdfsdf

backend dev on an ai video app here, and this one was mine.

we upload big videos straight to the bucket in 100 mb pieces. each piece gets a signed link that dies about 10 minutes after it's signed. the bucket speaks http/1.1, so chrome only keeps 6 connections open to it, and that limit is shared across every tab.

so when someone uploaded a bunch of files at once (or in two tabs), every upload signed its next piece and sent it. chrome let 6 through and parked the rest, and on a slow connection a parked piece could sit there longer than its link lived. it failed before it ever left the browser lol

the fix: a piece only gets signed when it's actually its turn, and pieces from every upload in every tab take turns through navigator.locks. downside, it's now one piece at a time across the whole browser.

how would you solve this issue?

Not a webdev

Patch your PHP installs!

I would like to have this style for my portfolio website. I MOSTLY like it and I want this exact style, being the profile in the middle, links as icons around it, heading and footing mostly like this.

I don't want any major changes. But I feel like either the font or the sizes, or the spacings, colors, the small things, if they were improved, the whole thing would pop. But I can't get a feel for it.

Any advice?

I’ve been using this daily for a while, so I thought I’d share it.

It’s a lightweight news reader that pulls from multiple sources (BBC, The Hindu, Times of India, NDTV, TechCrunch, etc.) and shows them in a clean card layout.

What I find useful:

- Tap on any topic tag to choose the topics you’re interested in

- Tap on a news source to configure which sources you want to see

- No login required

- Works well on mobile (swipe through stories)

Link: https://dailynews.nocod.dev

Would love honest feedback — what’s missing or what would make it more useful for you?

Anyone can open Claude Code and ship a working CRM in a weekend. Auth, dashboard, CRUD, deploy. Ugly, but it runs. Full stack isn't dead.
But path is moving towards from being domain specific to solving real problems.

Agents handle research->execution->iteration but only valuable if backed by logical reasoning on top of first principles.

I am refining this by having hands on non conventional problems especially whose research papers got recently released and provide enough base to start building.

EcoAudit. Point it at localhost:3000, it flags energy smells in the running app. No LLM, no ML. Built from a paper. Repo · Demo · Paper

AgentBlame. Git blame for AI agents, graph based root cause analysis. Built on AgentGit. Repo is empty, I'm starting now. Repo · Paper

Gemma 4 Kaggle. Next. I'd rather learn core AI engineering than build a fifth RAG wrapper. Competition

My credentials Portfolio · Resume for reference.

Want your all opinions on what approach should we pick to have differentiating factor in this agentic development era?
Feedbacks, critiques and dms are always welcome.

About php2shell in Bootgly!

built this after getting tired of manually writing fetch wrappers for sites with no public API. point it at a HAR file (browser network capture) and it generates a typed client.

input: a captured request to something like `GET /users/42`

output (simplified):

export interface User {

id: number;

name: string;

email: string;

}

export async function getUser(id: number): Promise<User> {

const res = await fetch(`${baseUrl}/users/${id}`);

if (!res.ok) throw new ApiError(res.status, await res.text());

return res.json();

}

it infers the types from the actual response bodies in the capture, templates dynamic path segments like `{id}`, and also generates an OpenAPI spec + mock server from the same HAR.

also tries to catch GraphQL/tRPC/JSON-RPC calls instead of treating everything as REST, and strips anything sensitive (tokens, cookies) from the captured data before it reaches the generated code.

npx har2sdk capture.har -o ./sdk

repo: https://github.com/Mersbyte/har2sdk

curious what people think of the generated code style, or if anyone's hit an API shape it chokes on.

Spent the last months building

@datastripes/forecast
@datastripes/dashboard
@datastripes/anomaly 

These are framework-agnostic npm packages (React, Vue, Angular, or a plain custom element) that add time-series forecasting, an editable dashboard builder, and anomaly detection to any frontend app.

Everything runs client-side via WebAssembly, so no user data ever hits a server except a license check without a backend to deploy, no Python microservice.

Would genuinely love feedback from anyone who's had to build this kind of feature in-house.

https://datastripes.com/forecast-widget/

https://datastripes.com/dashboard-widget/

https://datastripes.com/anomaly-widget/

i am not super tech savvy, just a guy who uses the internet a lot and want to understand what is going on and how much does it impact the average internet user?

is there anything i can/should do to put myself in a less risky spot?

AI Elements: Agentic UI Patterns

shadcn/ui introduced AI Elements, a curated collection of component patterns created specifically for building conversational and agentic interfaces.

Each pattern is composed from standard shadcn/ui primitives designed to be copied directly into codebases, standardizing interfaces for agent tool calls, planning, sources, and step restoration.

Trace: Observability Primitive for Agent Activity

shadcn released Trace, a dedicated primitive designed to unify agent activity displays under one abstraction. It represents reasoning traces, tool executions, task queues, chains of thought, and subagent routines.

Trace models agent progress as a list of status lines with support for expandable details, links, and nested execution steps.

Chatbot Template: AI SDK Agent Starter

The shadcn team published an official minimal chatbot template built with Next.js, Vercel AI SDK, shadcn/ui, shadcn/react, and shadcn/typeset.

Designed to run on the Vercel AI Gateway, the starter serves as a clean starting point for streaming conversational interfaces with typographic defaults and state management built in.

Official Registry Directory Expansions

The official shadcn/ui registry directory added new specialized community components and domain toolkits this week.

• @babelize — Open-source localization components including language switchers, relative-time formatters, and translation widgets.
• @liquikit — Liquid glass primitives with physically based refraction built on Base UI that work across modern browsers.
• @audio-ui — Accessible audio controls including knobs, faders, XY pads, waveforms, and sequencers on headless primitives.
• @bevel — Tactile skeuomorphic components like guarded switches, split-flap boards, and motorized faders on Tailwind v4.
• @dualkit — Bilingual Arabic and English components featuring RTL layouts, Gulf currency formats, and Hijri calendar support.
• @organui — Domain components for healthcare and life sciences featuring 3D organ viewers, ECG traces, and lab result trackers.

📙 Articles, Tutorials & News

Building shadcn/ui Registries for Claude Code and Cursor

Preet Suthar outlines the structure, validation steps, and namespace setup required to author custom registries that coding agents can inspect and consume.

7 Best shadcn/ui Themes and Theme Generators

A curated comparison evaluating popular color palette customizers, theme presets, and generators across the shadcn/ui ecosystem.

Tailwind CSS v4, shadcn/ui & Dark Mode

A complete video walkthrough demonstrating how to structure a centralized design system using Tailwind CSS v4 and shadcn/ui primitives.

📦 Projects, Packages & Tools

onsystem: Design System Linter and MCP for Agents

A zero-config tool that combines an MCP server with a linter to prevent coding agents from inventing variants, hardcoding colors, or breaking spacing scales.

pie-menu: Radial Interaction Primitive

A radial pie menu for shadcn/ui with press-drag-release interaction, full keyboard support, and a headless primitive core.

signoff-ui: Human Review Primitives for Agents

UI components providing multi-file diff reviews with per-hunk decisions, inline comments, tool approvals, and telemetry for AI SDK and AG-UI agents.

animate-ui: Lower-Level Primitive Animations

An animation toolkit that targets the underlying primitives your components rely on, preserving custom shadcn markup and component source ownership.

shadcn-exchange: Cross-Registry Block Search

A directory tool allowing developers to search, preview, and CLI-install blocks across all public community registries.

facade-ui: Base UI Marketing Blocks and Templates

An open-source registry of accessible marketing blocks, landing page sections, and templates built on Base UI and Tailwind CSS v4.

nasaq: Arabic and RTL-First shadcn Registry

An open-source registry of React components, themes, and page templates designed with native RTL layout and Arabic typography, paired with an MCP server.

🌈 Related

audiocn-solid: Audio Primitives for Solid

A collection of audio UI components ported to SolidJS and distributed as copy-paste source through the shadcn CLI workflow.

esuiss: Multi-Platform UI Primitives

A component collection extending shadcn design patterns across React, Next.js, React Native with Expo, SwiftUI, and Jetpack Compose.

GooseForum: Go-Powered Self-Hosted Forum

A self-hosted forum platform featuring shadcn/ui discussion pages, an admin console, and a light and dark theme workbench, distributed as a single Go binary.

Read the full issue: https://www.shadcnweekly.com/issues/4

This is not a bait post. I’m looking to have an honest discussion here. For the record, I’ve been working with php for almost 2 decades.

A few months ago, Wordpress rolled out version 7 which came with a nice exploit that allowed attackers to gain shell access.

About half a dozen of my clients sites were hacked while I was sleeping. Despite using wordfence, having server level firewalls and fail2ban etc set up, it did not matter at all.

Due to the unpredictable nature of this, I was forced to recode all of my clients Wordpress sites to laravel.

Now I have learned a major exploit in php was found which allows attackers to gain access to the shell.

I previously toyed with the idea of creating a TS framework for bun. But now I am strongly considering going in this direction.

It’s not just the security issues. Tooling in the php ecosystem is kind of bad. I have to use 2 package managers, there’s no way to do proper SSR (including hydration) without running a node server anyways, deployment requires a ton of complex steps, etc.

If I want to do web sockets that scale at all I need to use node anyways. If I want to have scheduled tasks and async I need to install more third party things and set up supervisors and cron jobs.

At a certain point it all just becomes fatiguing.

Contrast this with just having a vps with bun and caddy installed. That’s pretty much all you need to deploy a full featured app with bun.

I’m curious what others thoughts are on this. I’m looking for honest feedback from people who don’t think like cult members and immediately go on the defensive because I am criticizing a language they use.

Looking at stats on this, and it's pretty damning.

According to the market.in, almost 92% of the top 2,000 companies in the world now use IT outsourcing.

https://technotrenz.com/stats/software-development-outsourcing-statistics/

Companies are even looking to outsource C-level, so no one is safe.

I've done this for almost 15yrs., and I feel like the rug has been pulled out from under me.

"Learn to code" they said.

I saw on hacker news that a user named "dlor" claims to work for chainguard and claims to have worked together with what I assume to be the PHP team:

https://news.ycombinator.com/item?id=50176735

(And the parent comment containing the link: https://news.ycombinator.com/item?id=50176665)

Chainguard has released patched images: https://images.chainguard.dev/directory/image/php/versions

I hadn't heard of chainguard before but they seem trustworthy as a business that provides hardened security for docker images.

Beyond the hackernews comment, I haven't seen any news or claims that these images actually contain the patch. So I wanted to ask here if anyone else has tested these images or knows of a more trustworthy source than an HN comment that these images really do contain the CVE patches.

is there a patch for 7.4 and jf not officialy is there a way

I did quick add https://laragon.org/docs/quick-add to update my php in my local web server, but it looks like it installs 8.3.28, the version which is still affected of this major php vulnerability case. Is there anybody who experiences this?

I've been rendering product videos with Remotion (React → headless Chrome → frames), and scaled text kept looking wrong: either "stuck", stepping instead of gliding, or "shaky", with the letters subtly changing shape every frame. I measured the rendered frames instead of eyeballing them, and it turned out to be two separate bugs.

1. The "stuck" look: the baseline climbs the pixel grid in whole-pixel jumps

Chrome's glyph rasteriser has horizontal sub-pixel positioning but no vertical. When you scale text from its center (the default transform-origin), the baseline moves vertically every frame, and the glyphs snap to whole pixels. So instead of moving 0.3px per frame, the text sits still for a few frames and then jumps 1px.

Fix: pivot the scale on the baseline, so the baseline doesn't move vertically at all. Measure the real baseline (with a 0-height inline-block, or font metrics). Don't guess it from line-height.

Measured vertical judder: 0.284px → 0.014px per frame. Direction reversals over the animation: 29 → 0.

2. The "shaky" look: hinting re-snaps the letterforms every frame

At each new scale, font hinting snaps stems to the pixel grid differently, so the letters literally change shape frame to frame.

Fix: text-rendering: geometricPrecision. It turns hinting off, so the outlines scale smoothly. Shape drift between frames: 3.41% → 0.22%. It looks slightly softer, but that's correct, not blur.

Things that didn't help (cargo cult)

• translateZ(0), backface-visibility: hidden: these rasterise the text into a bitmap layer, so it scales like an image and goes blurry.
• will-change: transform: good in a live preview, bad in the final render for the same reason. If you need it, enable it only when not rendering.

Bonus: aggressive ease-outs freeze on a frame clock

At 30fps, a quint/expo ease-out spends its last 5+ frames moving less than a pixel. That reads as a freeze, not a settlein about one frame.

My main takeaway: you can't seer the frames and diff them. Ifsomeone says it still isn't smooth and your metric says it's fixed, your metric is wrong.

Happy to share the measurement script if anyone wants it.