Long-form writing on Drupal, PHP frameworks, AI tooling, automated testing and everything else in a working programmer's stack — shipped from production, not theory.
I already wrote about PFA's footguns on RC3. With feature freeze behind it and GA set for 19 November, here's the quieter PHP 8.6 RFCs that will actually change day-to-day code: readonly property defaults, hardened session settings by default, a Duration class, and clamp().
Two moderate-severity advisories, patched together in Craft 5.11.2, show how a schema's Sites scope could be read around entirely: once through an element field missing its site argument, once by chaining prev/next across entries. Neither needed a login, a token, or any non-default configuration.
One unsanitized attribute parameter, combined with PDO's emulated prepares, let an unauthenticated request run stacked SQL statements against Craft's database — and the demonstrated impact was flipping user ID 1 to admin. It's a clean case study in why Drupal's entity-query discipline over raw SQL exists.
A captured passkey login request could be replayed indefinitely against Craft, because the server never saved the updated signature counter after a successful login. It's a good excuse to actually explain what a WebAuthn signature counter is for, hung on a real, named bug.
Drupal 11.3.0 bakes HTMX into core and rebuilds BigPipe on top of it, with claims of up to 71% less JavaScript and 26-33% more requests served at the same database load. I went through the release notes to see what that means for anyone who still writes #ajax callbacks, and whether Navigation is actually worth switching to yet.
Komodo is a Rust-based, fully open Docker fleet manager built around declaring stacks as TOML in a Git repo. Here's the actual architecture — Core/Periphery split, outbound-only agent connections, PKI auth — and what it costs you versus a Portainer-shaped dashboard.
The 2026-07-28 Model Context Protocol spec removed sessions, the initialize handshake, and SSE resumability entirely. If you're running an MCP server behind a reverse proxy, these are the breaking changes that will actually bite, not just a version bump.