Long-form writing on Drupal, PHP frameworks, AI tooling, automated testing and everything else in a working programmer's stack — shipped from production, not theory.
I've never configured a cipher on this blog, yet it negotiates hybrid post-quantum key exchange (X25519MLKEM768) by default — the same group as cloudflare.com — because Traefik's Go runtime switched it on. What that is, why it arrived for free, the caveats (it depends on the Go build; a 'hardened' curve config can silently disable it), and the honest 'it changes almost nothing for a public blog' verdict.
An AI agent wiped PocketOS's production database and its backups in nine seconds (April 2026). Strip out the AI and you find three ordinary failures: an overprivileged token that outlived its purpose, backups sharing a volume with the data, and no gate on destructive actions. Every 'rogue AI' headline is an IAM-and-backups failure in costume — and it's the exact fear from my Coolify-MCP post, realised.
Project Browser hit stable: browse contrib and click 'Add and Install', no Composer, no terminal. But it needs a web-writable codebase and is local-dev-only — and that limitation isn't unfinished, it's a security decision in disguise (a writable codebase is exactly what production hosts forbid). Why the catch is the most reassuring part.
Every time() and new \DateTime() buried in your logic is a hidden dependency on the one thing you can't pause — and it's why your time-sensitive tests are flaky. Inject Drupal's TimeInterface (already there) or Symfony's Clock (freeze and advance instantly in tests). Where Drupal's built-in falls short, and the discipline that makes 'what happens at midnight?' a test you can actually run.
Docker Hub's 100-pulls-per-6-hours (per IP) limit and slow cold pulls bite exactly when you're redeploying under pressure. A single-binary Zot pull-through cache fixes both. An honest comparison (Zot is more modern than registry:2, far lighter than Harbor — but not magically 'lighter' than registry:2), the real downsides, and whether one blog even needs it.
CVE-2026-71488 in league/commonmark — the Markdown parser behind Laravel, Drupal, Statamic and more — turns a single non-ASCII character into O(n²) parsing. No RCE, no leak, just one long line with an emoji pinning a CPU. Why algorithmic-complexity DoS is the vuln class nobody threat-models, and why you should benchmark parsers with adversarial input.
A pile of 2025-26 research says chain-of-thought is often unfaithful: 30-60% of 'thinking steps' have minimal causal impact, models trained on scrambled traces do fine, filler tokens substitute for reasoning, and Anthropic found models admit using a hint only ~25% of the time. If you log CoT to debug and audit agents, you're trusting a story the model made up after the fact.