Sydney Arikan

Tech Policy, Enterprise Application Development, Application Security.

[Derek Devicemanager @IT_unhinged]

Security called me at 6:12 AM today.

"Patch every PHP server immediately."

I asked what happened.

"Two critical vulnerabilities. Remote code execution. No authentication required."

Cool.

How many PHP servers do we have?

According to inventory: 12

According to reality:

Nobody knows.

We found one running WordPress.

Three running old internal tools.

One under someone's desk.

Two inside vendor appliances.

A forgotten employee directory from 2016.

And a server named:

PHP-OLD-DO-NOT-TOUCH

Naturally, that one runs payroll exports.

Then we found a PHP 5.6 box.

I asked who owned it.

The documentation said:

BRIAN.

Brian left in 2019.

We called Brian.

He said:

"Oh wow, that's still running?"

Excellent.

By 8 AM, leadership joined the incident call.

CEO:

"Can hackers actually get in?"

Security:

"Potentially yes."

CEO:

"Without a password?"

Security:

"Yes."

CEO:

"Then why do WE need passwords?"

Not the lesson.

Finance asked if we could wait until the weekend to patch because downtime affects revenue.

Security explained that the alternative was letting strangers execute code on our servers.

Finance asked for a cost comparison.

At 9:17, someone suggested temporarily taking the vulnerable websites offline.

Marketing refused.

"Our campaign is live."

So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.

We finally patched everything we could find.

Then our scanner discovered another PHP server.

Hostname:

TEMP-PHP-2014

Uptime:

4,512 days.

Nobody knows what it does.

Nobody owns it.

Nobody can shut it down.

But every time we block network access, the warehouse stops printing shipping labels.

Security has classified it as critical infrastructure.

It is running PHP 5.4.

The vulnerability has existed longer than half our employees.

The emergency patch took four hours.

Finding out what PHP actually runs took eleven.

The internet isn't held together with code.

It's held together with servers everyone is afraid to turn off.

[skeptic 🖖 @3kept1c]

Contra todo pronóstico y sin aviso previo, Ondřej Surý ha aplicado los parches CVE-2026-109618 y CVE-2026-109619 tanto para PHP 5.6 como para PHP 7.4. En el log aparece: "Backported from 8.2.35". Nos ha salvado el culo a los que tenemos servidores Debian/Ubuntu.

[Sydney Arikan @sydneyarikan]

@MOSESNY43549594 @Code4jeph Yoh! Okay 😂😂😂 nimekubali iko shida basi

[Sydney Arikan @sydneyarikan]

@Code4jeph If someone is not willing to pay for your product, then maybe its to him a nice to have, not a must have. If you solve a pain point, the key word being pain, then perhaps they will pay

[Ershad Kunnakkadan @ershus]

Inspired by @dhh, we moved a high-traffic @gumroad endpoint from Rails to Go.

It only checks an email webhook's signature and queues a job, yet ran our full Rails app on 12 servers.

Go runs it on 3 smaller ones, in 11 MB of memory. 86% cheaper, saving about $14k a year.

[DHH @dhh]

You have no enemies, you say? Alas, my friend, the boast is poor, He who has mingled in the fray Of duty, that the brave endure,

Must have made foes.

If you have none,

Small is the work that you have done. You've hit no traitor on the hip, You've dashed no cup from

perjured lip, You've never set the wrong to right. You've been a coward in the fight.

"No Enemies" by Charles Mackay

[Sydney Arikan @sydneyarikan]

@kevvOH_ 🤣🤣🤣

[Tristan Marcus @TristanMarcus]

I agree with you Lauren, I think there is a bit of ego around having skills in the software engineering space and people will cling to them out of security to prove competency.

Call it elitism or whatever, but the skill compressions is an important piece of the puzzle if you advance at anything.

It doesn’t serve anyone to have the skill floor so high.

Part of first principles is to take what’s complex and make it stupid simple, then build on that.

In fact, isn’t that a software engineering skill?

[Eric S. Raymond @esrtweet]

It's true, there is a bit of a monastic atmosphere about a lot of math departments. There was at University of Pennsylvania when I was a theoretical
-math major back in the 1970s.

I've been pretty brutal towards the faction of mathematicians that wants to reject OpenAI's findings because they "didn't ask for this work to be done". I won't apologize for slamming their sense of entitlement and their claim to own mathematics as though it were some kind of holy ground not to be desecrated by clankers.

On the other hand, I have to say that I get it. When you're doing a thing that is so taxing that it demands complete concentration of the will - monastic devotion - it's easy to believe that people who don't partake of the discipline don't have the right to play where you do.

I'm a software engineer at a level where that takes monastic devotion, too. Maybe not to the intensity that pure mathematics does, but - I too have felt some sadness and some sense of loss as the Singularity bulldozes assumptions about programming that have surrounded me for 50 years.

And then the pragmatic part of me comes around and says "Yeah? Get over yourself. There's so much more we can *do* with the new tools..."

So here I am, leaning into AI-assisted coding pretty hard. Embracing the storm. It will not defeat me. I will ride it, master it; I will become the storm.

If you are in any knowledge-centered field, it's either embrace the storm or a collapse into stagnation and irrelevance as people with more courage and more flexibility power-zoom away from you, accelerating towards an unknown future.

Software engineers mostly seem to be handling this pretty well. A minority of open-source projects are prohibiting AI assisted contribution. I am confident they will quickly become laughingstocks.

I think and hope that most mathematicians, like most software engineers, are brave enough. Willing to bet there's an age split, too, with the younger ones much less fazed.

And me? Old, but too stubborn to quit. I was a mathematician once myself, I published research. I guess my message for upset mathematicians is: don't take counsel of your fears. You can do this. Be too stubborn to give up.

[DHH @dhh]

How many pencils, how many humans, how many hours would it have taken to recreate the Adobe suite by hand?

[Eric S. Raymond @esrtweet]

Aaand I've just learned that the developer behind this just didn't just nuke Photoshop - he has done open-
source clean room reimplementations of the entire Adobe suite.

Holy shit.

[Eric S. Raymond @esrtweet]

This is the doom I predicted a few days ago, coming for Photoshop. A clean-room open-source reimplementation.

No prizes for guessing that they decompiled Photoshop to source code, processed that to some kind of non-code specification language, then fed the spec to an LLM with an instruction to generate Rust.

Adobe just got nuked. And closed source is dead, dead, dead.

https://t.co/0sxtGNaPtq

[nunomaduro @enunomaduro]

the worst way to handle the AI era is rejecting it out of pessimism.. the second worst is blind hype.. stay curious, stay skeptical, keep your own judgment sharp!

AI won't replace people who think, it'll amplify them ✨

[Taylor Otwell @taylorotwell]

PHP is an implementation detail of Laravel

[Taylor Otwell @taylorotwell]

𝚞𝚜𝚎 𝚕𝚊𝚛𝚊𝚟𝚎𝚕::{𝙰𝚙𝚙𝚕𝚒𝚌𝚊𝚝𝚒𝚘𝚗, 𝚒𝚗𝚎𝚛𝚝𝚒𝚊};

𝚞𝚜𝚎 𝚌𝚛𝚊𝚝𝚎::𝚑𝚝𝚝𝚙::𝚖𝚒𝚍𝚍𝚕𝚎𝚠𝚊𝚛𝚎::𝙷𝚊𝚗𝚍𝚕𝚎𝙸𝚗𝚎𝚛𝚝𝚒𝚊𝚁𝚎𝚚𝚞𝚎𝚜𝚝𝚜;
𝚞𝚜𝚎 𝚌𝚛𝚊𝚝𝚎::𝚛𝚘𝚞𝚝𝚎𝚜;

[DHH @dhh]

Keep your mind flexible! Rust has an edge at the moment, but Rauch is spot on: We should rethink the entire stack from first principles given the transition to agent-led programming. Very little of what was will remain that way.

[DHH @dhh]

"It is difficult to get a man to understand something, when his salary depends on his not understanding it" — Upton Sinclair

I think this quote explains a lot of the coping that's going on, but I also think it's wrong! The failure to understand is what'll erase the paycheck.

[Sydney Arikan @sydneyarikan]

@Pohui512 @jasonfried @dhh 🤣🤣

[Sydney Arikan @sydneyarikan]

@StanleyMasinde_ @wizaj I never usually comment but been following your comments about omarchy for a while. Smells like smugness and a touch of arrogance