Long-form writing on Drupal, PHP frameworks, AI tooling, automated testing and everything else in a working programmer's stack — shipped from production, not theory.
CVE-2026-45034 (CVSS 9.2) bypasses an earlier PhpSpreadsheet fix because one extra slash makes parse_url() return false, walking past the guard and re-enabling phar deserialization. The real villain isn't the library — it's using parse_url() as a security boundary, a recurring PHP footgun the advisory itself warns against.
Two fresh RCEs — Gitea's diffpatch hook (CVE-2026-60004, 9.8, open registration on by default) and n8n's Git node (CVE-2026-21877, 9.9) — make the one-box lesson concrete: default-open signup turns 'authenticated' RCE into anonymous RCE, and co-located apps share a blast radius. Kill open signup, segment Docker networks, don't co-locate automation with a public site.
The Aug 4 keyv/'ChainDrop' npm worm planted payloads in AI-agent and editor config — .claude/settings.json SessionStart hooks, .vscode/tasks.json runOn:folderOpen — that fire when you or your agent just open the folder. And it shipped with valid provenance, because the source was poisoned before the trusted build. Opening a repo is now a code-execution decision.
File Browser (~35k stars) is being archived on Sept 1 — not from burnout but loss of will and a broken succession chain, in the maintainer's own words. Stars measure popularity, not resilience. The companion to my Jellyfin piece: a bus-factor checklist for what you actually inherit when you 'just self-host it'.
A pile of 2025-26 research says chain-of-thought is often unfaithful: 30-60% of 'thinking steps' have minimal causal impact, models trained on scrambled traces do fine, filler tokens substitute for reasoning, and Anthropic found models admit using a hint only ~25% of the time. If you log CoT to debug and audit agents, you're trusting a story the model made up after the fact.
CVE-2026-71488 in league/commonmark — the Markdown parser behind Laravel, Drupal, Statamic and more — turns a single non-ASCII character into O(n²) parsing. No RCE, no leak, just one long line with an emoji pinning a CPU. Why algorithmic-complexity DoS is the vuln class nobody threat-models, and why you should benchmark parsers with adversarial input.
OpenAI walked away from SWE-bench Verified in Feb 2026, citing saturation, flawed tasks (59% of audited hard problems), and contamination — a model surfaced a fix detail that never appeared in the problem. The 'SWE-Bench Illusion' paper measured the memorization. Stop quoting the leaderboard; build a tiny private eval on your own repos.