PHP's two critical flaws, CVE-2026-109618 and CVE-2026-109619 PHP2Shell, were patched in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The advice everywhere was to update. I want to write about something less covered: how much you can honestly claim afterwards....

A file hash only means something if you trust the moment it was recorded. That sounds obvious, but it is the part of integrity checking that people most often skip. Here are the design decisions behind the baseline feature in Laravel Scalpelhttps://g...

I didn't set out to write a tutorial. This is closer to a log of what happened when I tried to wire a locally-hosted Qwen model into Claude's third-party inference gateway, and the things that quietly broke before it worked. Why bother with a local ...

I now run a small self-hosted watchtower that pings me on Telegram the moment something looks wrong on any Laravel app I manage. It didn't start as a plan. It started with a friend's text message and a server that had already been compromised for wh...

Here's a mistake I bet a lot of developers coming from traditional hosting will make on their first serverless edge project: assuming a local database file will just... work. I made that mistake building OptiQ, a sales-tracking app for small optica...