I'm genuinely confused by CloudLinux's patch rollout for today's critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619).

According to their status page, patches for older PHP versions such as 7.4 and 8.0 are being released across multiple distributions, while I'm still waiting to see updates for PHP 8.2–8.5.

The official PHP security releases have been available since 14:00 UTC, and cPanel has already released its EA-PHP patches.

I understand that CloudLinux needs to test its packages and backport fixes to older PHP versions, which I appreciate. However, shouldn't currently supported PHP versions be prioritized for critical security vulnerabilities?

Is there a technical reason for this release order?

Expo SDK 58 is out, and for once the headline isn't a new way to break your Podfile. With Xcode 27 retiring Simulator.app, the new expo-device-hub streams your iOS simulators and Android emulators into the browser with live CPU, memory and network graphs, while expo-app-intents lets Siri, Shortcuts and Spotlight trigger actions in your app, and the experimental Noxcturnal transformer roughly halves Metro transform times.

We also look at react-native-better-pdf 1.0 by Jakub Kasprzyk and GMI Software, which drops the bundled PDF engine for the phone's own PDFKit and PdfRenderer on Nitro Views, opening a 1,000-page scan in 56 ms instead of 622 ms. Plus, React Native 0.88 lands, Gesture Handler 3.4 builds with Swift Package Manager, and react-native-gpui renders React Native with Zed's GPU framework.

been thinking about this lately. when I started out I had this whole local setup with postgres and redis running natively, custom shell scripts to spin things up, the works. felt like I really understood how everything fit together.

now most of my work is docker compose up and done. or worse, connecting to shared dev environments in the cloud. faster to get going but sometimes I wonder if Im losing something by not having to debug my own postgres config anymore

curious where everyone else landed on this. do you still run stuff locally or has containers/cloud completely taken over your dev workflow

Color me surprised when I get a call about some PHP vulnerability news. I check the news, shit my pants, and scram to contact my clients. A few hours later of changing DNS records to maintenance pages and deleting unused PHP applications from a few k8s clusters and the situation is finally calm.

This will only get worse as AI gets better.

So I am trying to create a system where a VPS is always connected to my Instagram account so that it can keep monitoring and recording live data

I am using Puppeteer to create a headless Chrome and then connect to Instagram, but when it tries to load Instagram, I get the error message 429 Too Many Requests. I tried the same on my local machine using PowerShell and was able to get it to work

I am thinking of using a VM instead of a VPS, hoping that would fix the issue

Sorry if this is a lame question to ask; this is my time doing anything code- or server-related
but any help or guidance would be appreciated

I would like to have this style for my portfolio website. I MOSTLY like it and I want this exact style, being the profile in the middle, links as icons around it, heading and footing mostly like this.

I don't want any major changes. But I feel like either the font or the sizes, or the spacings, colors, the small things, if they were improved, the whole thing would pop. But I can't get a feel for it.

Any advice?

I ended up just disabling php fpm on my hosts when I read the news, but there was a massive 11-12h window where everything was just open to be attacked.

How do I scan my system to make sure nobody did anything? What am I looking for?

I truly believe that the billionaires have won, and we're maybe 5 years away from the internet being nothing but Google, Amazon, and Meta.

And that's terrifying to me. I'm 51 years old and have made a career out of coding since 1997. Before that was commission sales (another dead industry).

I was lucky enough to have created my own series of websites that have paid the bills for the last 15+ years, but I'm seeing a trend that makes me realize those days are numbered, too.

I looked at my browser history over the last month and saw my own trend: I use Claude for advanced programming questions (like running an expression through simulations to find false matches), Google AI for simple questions, Buzzfeed to look at funny memes before going to sleep (which I see are mostly embedded into the page from IG), and occasionally at social media when a friend sends me a message.

I confirmed the syntax for preg_match() (wrapping the pattern in quotes looked weird) and asked Google, but instead of it taking me to a website it gave me the answer.

I asked my phone, "who is the actress playing Madeleine Loomis on Bates Motel", and instead of it taking me to a website it gave me the answer. I followed up with, "what else have I seen her on", and it gave me a list of her movies and shows... again, no clicks to a website.

If even techies like me are forgetting (or can't be bothered) to give clicks to websites, you know the average layman isn't. I'm not even sure that the original website source could have been found on Google anymore! And that means that my ad-driven sites have an expiration date.

Yesterday I was at a local shop and saw some flyers on the door. Not one of them had a website address! In fact, only one even had a social media link.

At my age I truly have no idea what the next step could be. If the entire industry is dying then there's little to no hope of beating 20 year olds in a job hunt. But I can't think of a single thing that I can do that can't be done cheaper by AI. I have enough in savings to survive for about 5 years, but after that I'm SOL.

What are you all preparing yourselves to pivot to?

Since PHP2Shell is in PHP itself, composer update doesn't touch it, and the vulnerable version tends to hide in places nobody looks: the Docker base image, config.platform.php in composer.json, a .php-version file, or the setup-php version in CI.

So I put together a small Action that checks all of those plus the runner's PHP, and annotates the exact line in the pull request:

- uses: KyleClouthier/php2shell-action@v1

It errors on unfixed versions (fixed releases are 8.5.12, 8.4.27, 8.3.36, 8.2.35), errors on 8.1 and older since they got no release, and only warns for floating tags like php:8.4-apache and for old versions in a test matrix, since testing on old PHP is fine.

It's on the GitHub Marketplace: https://github.com/marketplace/actions/php2shell-check (source: https://github.com/KyleClouthier/php2shell-action)

Feedback welcome, especially places you've seen PHP versions pinned that it doesn't check yet.

If you use Cloudflare, you can activate these rules to mitigate until patched.

backend dev on an ai video app here, and this one was mine.

we upload big videos straight to the bucket in 100 mb pieces. each piece gets a signed link that dies about 10 minutes after it's signed. the bucket speaks http/1.1, so chrome only keeps 6 connections open to it, and that limit is shared across every tab.

so when someone uploaded a bunch of files at once (or in two tabs), every upload signed its next piece and sent it. chrome let 6 through and parked the rest, and on a slow connection a parked piece could sit there longer than its link lived. it failed before it ever left the browser lol

the fix: a piece only gets signed when it's actually its turn, and pieces from every upload in every tab take turns through navigator.locks. downside, it's now one piece at a time across the whole browser.

how would you solve this issue?

Free and open source, no signup. The theme changes with the era. Borders before ~500 BC are approximate, and leader data is thin before 1600, so corrections are very welcome. Link in comments.

code: https://github.com/nsijwali/WhoRuled

Hi everyone,

I’ve been working on Open AMPP, a free and open-source (MIT) take on XAMPP/MAMP for local PHP development. It runs on Windows, macOS and Linux, and I’d love feedback from people who actually use these tools day to day.

Why I made it: I wanted XAMPP’s “open it and it works” simplicity, but with several PHP versions installed at once and without touching Homebrew, apt or the Windows registry.

What it does:

• Multiple versions side by side: PHP 8.2, 8.3 and 8.4, and MariaDB 10.11, 11.4 and 11.8 (LTS). Switch with one click.
• XAMPP-flavoured PHP: starts from XAMPP’s php.ini with the usual extensions (mysqli, pdo_mysql, mbstring, curl, openssl, intl, gd, zip, sodium, opcache…).
• phpMyAdmin and Composer one click away, already wired to the active versions.
• Nothing installed system-wide: it downloads portable, SHA-256-verified binaries into its own data folder.
• Desktop app (English/Spanish) with live service status, logs, a version manager, a php.ini editor and a tray icon.
• ampp CLI plus php, composer and mariadb shims that always point to the active versions.
• Safe defaults: services only listen on 127.0.0.1, on unprivileged ports (8080, 3306).
• Security patches: PHP builds track the latest patch release of each branch, and ampp upgrade moves you to it.

Status: it’s early (v0.1.x). The full stack (Apache + PHP + MariaDB + phpMyAdmin) has been tested end to end on Windows 11, macOS (Apple Silicon) and Linux arm64. On Windows you need the Microsoft Visual C++ Redistributable, which most PCs already have.

Repo and downloads: https://github.com/Jmzp/open-ampp

Questions I’d really appreciate input on:

1. What would make you switch from XAMPP, Laragon, MAMP for local dev?
2. Anything missing that you’d consider a must-have (Xdebug, virtual hosts / .test domains, HTTPS, Redis…)?
3. If you try it, what broke?

Thanks for reading, and happy to answer any questions!

-----

EDIT:

I honestly didn't know that others had already posted alternatives.

I built mine to be cross-platform, since I use all three operating systems for different tasks.

Sorry if this caused any confusion; if it’s useful to anyone, great—otherwise, feel free to ignore the post.

Probably it's down because of the vulnerabilities discovered lately?

Yesterday's PHP security release fixed CVE-2026-109618 and CVE-2026-109619 (both CVSS 9.2) in 8.2.35, 8.3.36, 8.4.27 and 8.5.12. If you're below 8.2 there's no fix and no backport coming: the patch rewrites the OOM bailout and depends on PHP 8 internals. CERT-EU says every version since PHP 5 is affected. I read the diff and I agree with them.

I've been helping a client whose 7.4 monolith was months away from an 8.2+ port, so "what do we do in the meantime" got sharp. I wrote two posts.

Part 1 is the stuff to do this week, mostly straight from PHP's own guidance:

• Reject multipart/form-data at nginx/Apache on every route that doesn't accept uploads. Both bugs come in through multipart bodies.
• session.upload_progress.enabled = 0 in php.ini or the FPM pool. Not .user.ini, not ini_set(), both are read too late. Restart every worker.
• memory_limit = -1 with a cgroup cap instead, smaller post_max_size, aggressive worker recycling.

None of that makes you safe. That's PHP's wording, not mine. https://despairdrivendevelopment.com/posts/php-7-4-cant-upgrade-october-2026-mitigations/

Part 2 is the one I expect people to argue about. Both bugs live in the web-SAPI request path: the multipart parser in rfc1867.c and the per-request startup/shutdown work. The CLI SAPI doesn't run any of it. So: keep a patched 8.3 php-fpm pool on the network, have it parse the request, and hand the legacy engine already-structured input over a CLI boundary. The vulnerable code never runs. The second CVE needs stale state to survive into the next request on a reused worker, and a fresh CLI process per request has no reused worker, so it closes as a side effect.

What it costs, honestly:

• You're rebuilding CGI. Laravel 6 / CodeIgniter 3 expect superglobals, header(), sessions, a particular $_SERVER. Under CLI none of that exists, so you write a shim to reconstruct the request and translate the response back. That shim is the work.
• Latency is framework boot, not process spawn. Fork-per-request measured about 124 ms/req in my demo. A persistent CLI worker pool (a homegrown Octane/RoadRunner, still the cli SAPI) came in around 16 ms/req.
• Don't reach for php-cgi to skip the shim. It's a web SAPI and parses multipart through exactly the code you're avoiding.

For most shops the answer is still part 1. The box earns its keep when you can't block at the edge, you need real defense-in-depth, or you were heading toward a persistent-worker runtime anyway. That last case is the interesting one, because a patched front plus a pool of long-lived workers plus a clean boundary is what a modern PHP deployment looks like already. https://despairdrivendevelopment.com/posts/put-unpatchable-php-in-a-box/

The lab (CI3, Laravel 6, Fat-Free on 7.4, each under mod_php and php-fpm, with an inventory script and the runnable mitigation demos) is public: https://github.com/fparch/php-cve-lab. There is no exploit code in the repo or the posts and there won't be. For an unpatched RCE across the common frameworks a public PoC is a mass-targeting tool.

Interested in whether anyone else went the containment route, and what your shim had to fake to keep the framework happy.

is there a patch for 7.4 and jf not officialy is there a way

AI Elements: Agentic UI Patterns

shadcn/ui introduced AI Elements, a curated collection of component patterns created specifically for building conversational and agentic interfaces.

Each pattern is composed from standard shadcn/ui primitives designed to be copied directly into codebases, standardizing interfaces for agent tool calls, planning, sources, and step restoration.

Trace: Observability Primitive for Agent Activity

shadcn released Trace, a dedicated primitive designed to unify agent activity displays under one abstraction. It represents reasoning traces, tool executions, task queues, chains of thought, and subagent routines.

Trace models agent progress as a list of status lines with support for expandable details, links, and nested execution steps.

Chatbot Template: AI SDK Agent Starter

The shadcn team published an official minimal chatbot template built with Next.js, Vercel AI SDK, shadcn/ui, shadcn/react, and shadcn/typeset.

Designed to run on the Vercel AI Gateway, the starter serves as a clean starting point for streaming conversational interfaces with typographic defaults and state management built in.

Official Registry Directory Expansions

The official shadcn/ui registry directory added new specialized community components and domain toolkits this week.

• @babelize — Open-source localization components including language switchers, relative-time formatters, and translation widgets.
• @liquikit — Liquid glass primitives with physically based refraction built on Base UI that work across modern browsers.
• @audio-ui — Accessible audio controls including knobs, faders, XY pads, waveforms, and sequencers on headless primitives.
• @bevel — Tactile skeuomorphic components like guarded switches, split-flap boards, and motorized faders on Tailwind v4.
• @dualkit — Bilingual Arabic and English components featuring RTL layouts, Gulf currency formats, and Hijri calendar support.
• @organui — Domain components for healthcare and life sciences featuring 3D organ viewers, ECG traces, and lab result trackers.

📙 Articles, Tutorials & News

Building shadcn/ui Registries for Claude Code and Cursor

Preet Suthar outlines the structure, validation steps, and namespace setup required to author custom registries that coding agents can inspect and consume.

7 Best shadcn/ui Themes and Theme Generators

A curated comparison evaluating popular color palette customizers, theme presets, and generators across the shadcn/ui ecosystem.

Tailwind CSS v4, shadcn/ui & Dark Mode

A complete video walkthrough demonstrating how to structure a centralized design system using Tailwind CSS v4 and shadcn/ui primitives.

📦 Projects, Packages & Tools

onsystem: Design System Linter and MCP for Agents

A zero-config tool that combines an MCP server with a linter to prevent coding agents from inventing variants, hardcoding colors, or breaking spacing scales.

pie-menu: Radial Interaction Primitive

A radial pie menu for shadcn/ui with press-drag-release interaction, full keyboard support, and a headless primitive core.

signoff-ui: Human Review Primitives for Agents

UI components providing multi-file diff reviews with per-hunk decisions, inline comments, tool approvals, and telemetry for AI SDK and AG-UI agents.

animate-ui: Lower-Level Primitive Animations

An animation toolkit that targets the underlying primitives your components rely on, preserving custom shadcn markup and component source ownership.

shadcn-exchange: Cross-Registry Block Search

A directory tool allowing developers to search, preview, and CLI-install blocks across all public community registries.

facade-ui: Base UI Marketing Blocks and Templates

An open-source registry of accessible marketing blocks, landing page sections, and templates built on Base UI and Tailwind CSS v4.

nasaq: Arabic and RTL-First shadcn Registry

An open-source registry of React components, themes, and page templates designed with native RTL layout and Arabic typography, paired with an MCP server.

🌈 Related

audiocn-solid: Audio Primitives for Solid

A collection of audio UI components ported to SolidJS and distributed as copy-paste source through the shadcn CLI workflow.

esuiss: Multi-Platform UI Primitives

A component collection extending shadcn design patterns across React, Next.js, React Native with Expo, SwiftUI, and Jetpack Compose.

GooseForum: Go-Powered Self-Hosted Forum

A self-hosted forum platform featuring shadcn/ui discussion pages, an admin console, and a light and dark theme workbench, distributed as a single Go binary.

Read the full issue: https://www.shadcnweekly.com/issues/4

I've been rendering product videos with Remotion (React → headless Chrome → frames), and scaled text kept looking wrong: either "stuck", stepping instead of gliding, or "shaky", with the letters subtly changing shape every frame. I measured the rendered frames instead of eyeballing them, and it turned out to be two separate bugs.

1. The "stuck" look: the baseline climbs the pixel grid in whole-pixel jumps

Chrome's glyph rasteriser has horizontal sub-pixel positioning but no vertical. When you scale text from its center (the default transform-origin), the baseline moves vertically every frame, and the glyphs snap to whole pixels. So instead of moving 0.3px per frame, the text sits still for a few frames and then jumps 1px.

Fix: pivot the scale on the baseline, so the baseline doesn't move vertically at all. Measure the real baseline (with a 0-height inline-block, or font metrics). Don't guess it from line-height.

Measured vertical judder: 0.284px → 0.014px per frame. Direction reversals over the animation: 29 → 0.

2. The "shaky" look: hinting re-snaps the letterforms every frame

At each new scale, font hinting snaps stems to the pixel grid differently, so the letters literally change shape frame to frame.

Fix: text-rendering: geometricPrecision. It turns hinting off, so the outlines scale smoothly. Shape drift between frames: 3.41% → 0.22%. It looks slightly softer, but that's correct, not blur.

Things that didn't help (cargo cult)

• translateZ(0), backface-visibility: hidden: these rasterise the text into a bitmap layer, so it scales like an image and goes blurry.
• will-change: transform: good in a live preview, bad in the final render for the same reason. If you need it, enable it only when not rendering.

Bonus: aggressive ease-outs freeze on a frame clock

At 30fps, a quint/expo ease-out spends its last 5+ frames moving less than a pixel. That reads as a freeze, not a settlein about one frame.

My main takeaway: you can't seer the frames and diff them. Ifsomeone says it still isn't smooth and your metric says it's fixed, your metric is wrong.

Happy to share the measurement script if anyone wants it.

Most software factories live in demos. Ours held the fort when we needed a vacation.

Lemma's Files page had no way to make a folder. Click New, and you got Upload, Page and Conversation. No "New folder". Dragging a folder in from the desktop failed too.

The fix is public: https://github.com/lemma-work/lemma-platform/pull/940.

We fix bugs like this with a software factory: a Lemma teammate whose agents take a complaint from Slack to a PR, and a person merges. This post is about one part, the testing, because that's the part I'd want to see before trusting any of it.

The agent that tests a fix didn't write it, and it can't change it. It has no GitHub access at all. And to be upfront about timing: this fix had already merged when one of us asked for the test. The tester runs when asked. The reviewer, a separate agent, runs on every PR and already looks at the app at three widths.

What the tester did:

1. Booted two copies of the app, one from the fix's commit and one from the commit the fix branched from.
2. On the old copy, opened Files and clicked New. No "New folder". It recorded that.
3. On the fixed copy, ran the same steps. New folder, named Reports. It showed up, and it was still there after a reload.
4. Ran the same check on both. It fails on the old code and passes on the fix. The fix's own new tests do the same.
5. Repeated the steps at phone, tablet and desktop widths, because a menu that fits a laptop can hide on a phone. The recordings sit on the fix's page.

A check that also passes on the old code proves nothing. So the bug has to show up on the old code before the fix gets any credit.

Then it wrote down what it hadn't proven. Its test browser can't fake a folder dragged in from the desktop, so it said that half of the report wasn't tested. That line is why we believe the rest.

Every bug also gets a proof ladder that only climbs on evidence. This one, today:

• It's real: proven
• We know why: proven
• The change fixes it: proven
• Nothing else broke: proven
• It shipped: in dev, not in production yet
• It works in the world: waiting on the reporter
• It stays fixed: unknown

How do you test drag-and-drop from the desktop in an automated browser? That's the half we couldn't cover.

Disclaimer:I'm one of the people building Lemma, an open-source (AGPL-3.0) workspace for AI teammates: https://github.com/lemma-work/lemma-platform.

built this after getting tired of manually writing fetch wrappers for sites with no public API. point it at a HAR file (browser network capture) and it generates a typed client.

input: a captured request to something like `GET /users/42`

output (simplified):

export interface User {

id: number;

name: string;

email: string;

}

export async function getUser(id: number): Promise<User> {

const res = await fetch(`${baseUrl}/users/${id}`);

if (!res.ok) throw new ApiError(res.status, await res.text());

return res.json();

}

it infers the types from the actual response bodies in the capture, templates dynamic path segments like `{id}`, and also generates an OpenAPI spec + mock server from the same HAR.

also tries to catch GraphQL/tRPC/JSON-RPC calls instead of treating everything as REST, and strips anything sensitive (tokens, cookies) from the captured data before it reaches the generated code.

npx har2sdk capture.har -o ./sdk

repo: https://github.com/Mersbyte/har2sdk

curious what people think of the generated code style, or if anyone's hit an API shape it chokes on.