Actively exploited unauth RCE (CVSS 10.0) in Joomla JCE ≤2.9.99.4 via profile import, now in CISA KEV. Patch to 2.9.99.7, then hunt rogue profiles and webshells.
Composer 2.9.8/2.2.28 fix CVE-2026-45793: GitHub's new GITHUB_TOKEN includes hyphens that Composer's old regex rejects, leaking the token into CI logs as plaintext.
A paper claims that a single binary operator eml(x, y) = exp(x) - ln(y) combined with the constant 1 can express all elementary functions — arithmetic, trig, logarithms, even pi. I read the paper and tested it in 5 languages.
An unsafe deserialization vulnerability was found in PHPUnit's PHPT test runner. This article summarizes the risk to CI/CD pipelines and how to mitigate it.
How to implement Firebase Cloud Messaging (FCM) push notifications in a WebView-based Android app. Covers FCM token concepts, PHP/Kotlin code examples, and broadcasting to all users via topics.
Testing the new LSP feature in Claude Code v2.0.74 with a PHP setup. phpactor fails on Windows, intelephense installs but isn't recognized — turns out it's already filed as Issue #14803.
Why dependency management gets painful without a DI container. Explains automatic dependency resolution with Reflection and a practical repository-pattern example.
A story about dates going haywire in an AI-generated PHP script, plus a breakdown of timezone pitfalls in each layer — server, PHP, MySQL, and JavaScript.
