Blog
Insights on software development, security, and technology from our team.
One POST request now owns a default WordPress site. Patch to 7.0.2 today.
WordPress just patched wp2shell, an unauthenticated remote-code-execution chain in core that turns one crafted request into a full site takeover on a default install. It affects versions 6.8 through 7.0.1, and public exploit code is already circulating. Here's what web and security teams should do this week, and how to check if you were already hit.
A critical PhpSpreadsheet bug walked straight through its own patch
PhpSpreadsheet's fix for a phar deserialization bug got bypassed with a path carrying one extra slash. The new flaw, CVE-2026-45034, is a 9.2 critical: full remote code execution on PHP 7.x and a file-read primitive on PHP 8.x. Here is how the bypass works and what your team should do this week.
Laravel's AI SDK just dropped. So did six zero-days. Here's what matters.
Laravel shipped a first-party AI SDK with unified provider support and an Agent pattern. Meanwhile, Microsoft's February Patch Tuesday fixes six actively exploited zero-days. We break down what both mean for development teams right now.
AI just moved into your IDE. Here's what that actually means.
Laravel shipped a first-party AI SDK. Apple put autonomous coding agents inside Xcode. Both happened in the same week. We break down what this means for development teams building web and mobile apps, and where to be careful.
Laravel just shipped a first-party AI SDK. Here's what it actually means for your team.
Laravel released its official AI SDK on February 5, giving PHP developers a unified way to work with OpenAI, Anthropic, Gemini, and others. We break down what matters, what to watch out for, and whether you should adopt it now.
Laravel ships an AI SDK, Apple opens Xcode to autonomous agents, and we have thoughts
This week Laravel released a first-party AI SDK that unifies multiple AI providers behind a single API. Days earlier, Apple dropped Xcode 26.3 with built-in support for autonomous coding agents from Anthropic and OpenAI. Here's what both moves mean for development teams.
Symfony's Dual Release Strategy: Why Identical Features with Different PHP Requirements Changes Everything
Symfony 7.4 LTS and 8.0 launched simultaneously with identical features but different PHP requirements. This strategic shift forces teams to choose between long-term stability and modern performance.
The PHP Framework Wars Are Getting Interesting Again
Symfony 8.1 development is picking up steam while newcomer Doppar challenges the Laravel-Symfony duopoly. Here's what this means for development teams picking their next stack.