The Old Man and the Hammer
A retelling of the traditional “knowing where to tap” parable, which circulates in several versions. Quote Investigator
A large ship’s engine had broken down, leaving it stranded at the dock.
The owner brought in one expert after another. They inspected the machinery, checked the connections, replaced parts, and tried everything they could think of. Still, the engine would not start.
Every day the ship sat idle, the owner lost money. The cargo was ready. The crew was waiting. But nothing could move until someone solved the problem.
Finally, someone recommended an old engineer who had spent his life repairing ships’ engines.
He arrived carrying a worn tool bag.
The owner led him into the engine room and explained everything the other specialists had tried. The old man listened carefully, then began his inspection.
He examined the engine from top to bottom. He leaned close to certain parts, checked others with his hands, and asked the crew a few questions. The owner watched as he worked quietly, without rushing.
At last, the old man opened his bag and took out a small hammer.
He reached toward one particular spot on the engine and gave it a single, gentle tap.
Then he stepped back.
“Try it now.”
The crew started the engine. This time, it caught, settled into a steady rhythm, and kept running.
The owner was delighted. He shook the old man’s hand, thanked him, and hurried away to arrange the ship’s departure.
A few days later, the engineer’s invoice arrived.
Ten thousand dollars.
The owner stared at it.
“Ten thousand dollars?” he exclaimed. “He was barely here! All he did was tap the engine with a hammer.”
He sent the engineer a message requesting an itemized bill.
The old man sent back the following:
Tapping the engine with a hammer: $2
Knowing where to tap: $9,998
Total: $10,000
The owner read it twice.
He had watched the old man make one small movement. What he had not seen were the years of work that allowed him to choose that exact spot—and leave every other part of the engine alone.
The owner paid the bill.
The value wasn’t in swinging the hammer. It was in knowing where to strike.
1. Them I trust completely; it's their friends I'm unsure about.
2. Them we invited first, and everyone else came later.
3. Them, of all people, the coach chose to lead the team.
4. Them the jury believed, but not the other witnesses.
5. "Them" is the object form of "they," so it rarely starts a sentence.
The FBI continues to warn about two critical security flaws in PHP, a programming language used to build many websites and online services. Attackers could exploit these vulnerabilities to break into systems, putting sensitive information and business operations at risk. Security updates are available and should be applied immediately.
If you are a business owner or website operator, check whether your systems are affected. Contact your IT support team, website developer, or hosting provider for help identifying vulnerable systems and applying the necessary updates.
The FBI urges organizations to take the following steps now:
➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated.
➡️ Immediately update affected PHP installations following the guidance on https://t.co/JFOW6jG9Ws. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP.
➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation.
➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or https://t.co/ZWC7Se2YdU. Those reports help us identify the actors involved and warn other organizations before they become victims.
For the latest information on these vulnerabilities (CVE-2026-109618 and CVE-2026-109619), follow PHP’s announcements on https://t.co/JFOW6jG9Ws, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.
3% of “critical” software security bugs, in all of recorded history, have been found in the last month.
This is on pace to find another ~100,000 bugs this year alone, adding ~26% more vulnerabilities to the all time total
Do you realize how fucking insane that is?