Long-form writing on Drupal, PHP frameworks, AI tooling, automated testing and everything else in a working programmer's stack — shipped from production, not theory.
File Browser (~35k stars) is being archived on Sept 1 — not from burnout but loss of will and a broken succession chain, in the maintainer's own words. Stars measure popularity, not resilience. The companion to my Jellyfin piece: a bus-factor checklist for what you actually inherit when you 'just self-host it'.
The Aug 4 keyv/'ChainDrop' npm worm planted payloads in AI-agent and editor config — .claude/settings.json SessionStart hooks, .vscode/tasks.json runOn:folderOpen — that fire when you or your agent just open the folder. And it shipped with valid provenance, because the source was poisoned before the trusted build. Opening a repo is now a code-execution decision.
Two fresh RCEs — Gitea's diffpatch hook (CVE-2026-60004, 9.8, open registration on by default) and n8n's Git node (CVE-2026-21877, 9.9) — make the one-box lesson concrete: default-open signup turns 'authenticated' RCE into anonymous RCE, and co-located apps share a blast radius. Kill open signup, segment Docker networks, don't co-locate automation with a public site.
CVE-2026-45034 (CVSS 9.2) bypasses an earlier PhpSpreadsheet fix because one extra slash makes parse_url() return false, walking past the guard and re-enabling phar deserialization. The real villain isn't the library — it's using parse_url() as a security boundary, a recurring PHP footgun the advisory itself warns against.
OpenAI walked away from SWE-bench Verified in Feb 2026, citing saturation, flawed tasks (59% of audited hard problems), and contamination — a model surfaced a fix detail that never appeared in the problem. The 'SWE-Bench Illusion' paper measured the memorization. Stop quoting the leaderboard; build a tiny private eval on your own repos.
The single most misunderstood corner of Drupal, and the root of ~90% of 'stale content' and 'user B sees user A's data' bugs. The one-line model: stale = a missing cache tag, leaking = a missing cache context. How they bubble, why max-age:0 quietly poisons a whole page, and the debug header that finds the culprit in seconds.
Chroma tested 18 models: accuracy falls well before the advertised limit, and semantically-similar distractors hurt more than the raw token count — models even did better on a shuffled haystack than a coherent one. Plus RULER's 'effective context' and Lost-in-the-Middle. Why curated retrieval still beats stuffing everything in the window.