Long-form writing on Drupal, PHP frameworks, AI tooling, automated testing and everything else in a working programmer's stack — shipped from production, not theory.
An ASE '26 paper reports that repos with committed AI config show about half the complexity growth after adopting coding agents. Tempting to read as 'write a CLAUDE.md, halve your mess' — but it's observational and the authors call it hypothesis-generating. A skeptical read, and the audit it actually suggests.
Drupal 12 is mostly 11.5 with the deprecations deleted — and the deletions include nine modules a lot of sites run (Search, Contact, Toolbar, Shortcut...). The upgrade is a Composer-require checklist, Contact is the one to check carefully, and the Dec 9 Drupal 10 EOL makes it a deadline for some.
The Craft 6 alpha ships built-in Model Context Protocol servers that let an AI inspect and edit content, the content model and project config. The interesting part isn't the AI — it's the permissions design: OAuth 2.1, an explicit 'Use Craft MCP' permission, public access off by default, and writes that land as drafts.
PHP 8.6 RC3's long deprecation list is just log noise. The sneaky changes are the filesystem functions that used to return false on a NUL byte and now throw a ValueError — a 500 you won't catch in a unit test. Plus where Drupal's 8.6 support actually stands.
SA-CORE-2026-014 (Oct 14) is a critical RCE in core's Field UI module that, per the advisory, isn't exploitable by core alone — contrib or custom code completes the path, and at least one needs no auth. Why 'am I patched?' beats 'is core vulnerable?', and the one-command mitigation.
An eager-loaded Matrix relation with orderBy and limit:1 returned the wrong row and said nothing. The fix adds an allowlist of 'safe' sort forms — the fingerprint of a security fix, because the same criteria-cleansing path produced two High-severity advisories this autumn.
Coolify holds every key on my VPS, so when it shipped seven releases in three days (one feature reverted 37 minutes after it landed), I wrote an update policy instead of clicking Update. Patch for security on its own clock; adopt features a beat late, after the hotfix storm settles.