Long-form writing on Drupal, PHP frameworks, AI tooling, automated testing and everything else in a working programmer's stack — shipped from production, not theory.
On July 22 the Drupal security team shipped ten contrib advisories — five with no fix, just 'uninstall it.' What 'unsupported' actually means (including why they all read 'Critical' regardless of real severity), why it keeps happening, and the audit I now run on my own composer.json.
Final approval landed July 20. Training on legally-acquired books was ruled fair use; acquiring pirated copies was not. But the ruling says nothing about model outputs and creates no forward license — so for a dev using Claude to write code, it changes nothing in either direction. Separating the headline from the law.
Three core Jellyfin people, including the founder, stepped away in one week of July — mostly burnout, told fairly. The project isn't dying, despite the headlines. But it's a clean look at the bus factor of volunteer FOSS, and the unglamorous things a self-hoster should actually do about it.
A July 2026 Concordia benchmark (IssueTrojanBench) found 66.5% of malicious instructions hidden in GitHub issues bypassed every guardrail in Cursor, Claude Code and Codex — and nearly every block came from the base LLM refusing, not the agent's own safety layer. What that means if you point an agent at anything you didn't write.
Gmail and Outlook now hard-bounce unauthenticated mail instead of junking it. Sending straight from a VPS is a reputation treadmill you lose. The fix is to relay but keep your own SPF/DKIM/DMARC — which is exactly where I found my own footgun: a live 'v=spf1 -all' with no relay include, my newsletter surviving on DKIM alone. Here's what each record does and how to not do what I did.
My OVH renewal came in ~45% higher, and for once the host isn't being greedy: the world's affordable RAM is being fed to AI accelerators. Why DRAM contract prices nearly doubled, why 'just switch to Hetzner' doesn't help, why it won't ease before 2027 — and the actual tuning that made my 4GB box need less memory instead.
I shipped an llms.txt on this blog last week, then went looking for proof anything reads it. Google's John Mueller compares it to the old keywords meta tag; a 2026 study of ~38,000 AI-cited domains found zero citation advantage (p=0.85). Where it's genuinely useful, how to test it against your own logs, and why a helper file is a long shot on a web that already ignores robots.txt.