Long-form writing on Drupal, PHP frameworks, AI tooling, automated testing and everything else in a working programmer's stack — shipped from production, not theory.
Wiz disclosed a symlink flaw (July 8) letting a malicious repo trick six AI coding assistants — Claude Code included — into writing to your ~/.ssh while the approval dialog showed a harmless filename. How it works, the CVEs, Anthropic's fair-to-note dispute, and why the approval prompt was never my real security boundary.
Drupal 11.4.0 (July 1) added an experimental native command-line tool, dr, built by a team that includes the Drush maintainers. What it can and can't do yet, why 'the death of Drush' is the maintainers' own stated goal, and why that's the good version of a project handing off — not abandonment.
Three core Jellyfin people, including the founder, stepped away in one week of July — mostly burnout, told fairly. The project isn't dying, despite the headlines. But it's a clean look at the bus factor of volunteer FOSS, and the unglamorous things a self-hoster should actually do about it.
On July 22 the Drupal security team shipped ten contrib advisories — five with no fix, just 'uninstall it.' What 'unsupported' actually means (including why they all read 'Critical' regardless of real severity), why it keeps happening, and the audit I now run on my own composer.json.
Final approval landed July 20. Training on legally-acquired books was ruled fair use; acquiring pirated copies was not. But the ruling says nothing about model outputs and creates no forward license — so for a dev using Claude to write code, it changes nothing in either direction. Separating the headline from the law.
Docker Engine 29 (out since November, security-patched to 29.6.2 in July) makes the containerd image store the default for fresh installs and adds an experimental nftables backend. On a single Coolify VPS the danger isn't upgrading in place — it's a from-scratch rebuild, and one firewall switch you should not flip on prod.
Gmail and Outlook now hard-bounce unauthenticated mail instead of junking it. Sending straight from a VPS is a reputation treadmill you lose. The fix is to relay but keep your own SPF/DKIM/DMARC — which is exactly where I found my own footgun: a live 'v=spf1 -all' with no relay include, my newsletter surviving on DKIM alone. Here's what each record does and how to not do what I did.