Señor Developer. You can write shit code in any language or framework you want. Do whatever makes you happy.
Cocoverso
Joined March 2009
- Tweets15.9K
- Following1.2K
- Followers536
- Likes60.2K
Agustin Gomes retweeted
Holy balls the latest update to macOS *ROLLED BACK* the eMudhra cert removal from /etc/ssl/!
What the hell are you doing over there, Apple friends?
Agustin Gomes retweeted
BREAKING: Employers worldwide are pulling back on AI as they navigate a flood of errors and low-quality work that sap employee time, raise privacy and security risks, and drive up costs, per the Guardian.
Agustin Gomes retweeted
Grave denuncia. Se perdió comunicación con el periodista Ricardo Tarazona tras ser amenazado por un "comunero" chavista.
Urgente | Periodista de El Carabobeño fue amedrentado por un “comunero” en Yaracuay mientras documentaba colapso de ambulancias en el municipio Urachiche
El periodista Ricardo Tarazona, perteneciente al medio El Carabobeño, fue víctima de amedrentamiento por parte de un “comunero” mientras realizaba labores de cobertura para la Alianza Nacional de Medios en el estado Yaracuy.
El comunicador se encontraba documentando sobre el colapso y la falta de ambulancias operativas en el municipio Urachiche, específicamente en la comunidad El Picure.
Durante la pauta, un sujeto que se identificó como miembro de una comuna irrumpió de forma violenta, descalificando el trabajo informativo bajo falsos señalamientos de índole político.
Lejos de atender el reclamo comunitario sobre la precariedad del servicio de salud pública, el agresor adoptó una actitud hostil y amenazó directamente al periodista con convocar a un grupo de motorizados armados, poniendo en inminente riesgo su integridad física. Tras estas intimidaciones, se perdió comunicación con Tarazona. #VPItv.
@eldiario
@ElTequeno
@diariodlosandes
Agustin Gomes retweeted
Every religion in history has promised miracles and warned of the apocalypse. Anthropic is the first to file both with the SEC.
Agustin Gomes retweeted
One hill I'll happily die on: the normalization of "ship fast" culture at the expense of proper SDLC has played a significant role in the quality of vulnerable code being pushed into production and the rise of CVEs and enshitification of software for the last several years.
We've systematically traded engineering rigor for velocity, security assurance for investor confidence, and long-term maintainability for quarterly growth. All things I wish we would second guess and reevaluate.
But the software overlords wanted products yesterday and they got them. And now the rest of us get to spend the next several years discovering exactly which corners were cut and figuring out how to deal with the immense amount of responsibility that's been dropped on our collective feet.
Agustin Gomes retweeted
今回のPHPの騒ぎで、一番偉かったのは、PHP 7.xとか5.xにバックポートした人でも何でも無く、LTSに頼らずに普段から粛々と計画的に最新版のPHPに追随してたエンジニアと、そのコストを承認した上司なんだよ。そういう運用だったら、PHPの最新版が出たら差し替えるだけだった。
Agustin Gomes retweeted
when you see an “expert” in the media talk about a topic you’re quite familiar with, it really makes you question all their other “experts” for all the other topics
Agustin Gomes retweeted
I think we've discovered another critical vulnerability:
CVE-2026-BURNOUT: AppSec Professional Exhaustion
Severity: Critical (CVSS 10.0)
Description: A vulnerability affecting security professionals exposed to a continuous stream of critical RCEs, zero-days, emergency patches, and Friday afternoon disclosures.
Impact: Sleep deprivation, excessive caffeine consumption, and an inability to enjoy weekends.
Attack vector: Reading security advisories.
Affected versions: All AppSec professionals, regardless of experience.
Mitigation: No known patch. Air-gapping may delay the inevitable. Total system collapse remains a possibility. 🔥
One of the first things I did when I started at my current organization, was to make the main backend compatible with PHP 8.1 and 8.2 at the same time.
In light of the disclosed PHP vulnerabilities, I'm satisfied I prepared the best I could 8 months ago.
Agustin Gomes retweeted
Lot of #PHP snark going around right now from folks who've either never written software, or never done it in PHP (in the last 20 years).
I've architected, designed and hand-coded copious amounts of software in Java/Spring/Hibernate, .Net/C# Entity Framework and PHP/Symfony/Doctrine, applying very similar patterns and better practices of completely stack-agnostic concepts such as:
- Test-Driven Development (and given half-day and full-day hands-on live-coding workshops at conferences worldwide)
- Onion/Hexagonal Architecture
- Domain-Driven Design
- Data Mapper ORMs
Beyond workshops, I have spoken on these topics at conferences worldwide as well.
I might argue that I am not completely devoid of clue when it comes to these stacks' capabilities.
In fact, I have hired, coached and cross-trained engineers across these 3 stacks.
And I can assure you PHP shines within these paradigms, with an extremely vibrant, mature and robust ecosystem of Application Frameworks, Security Frameworks and Tools, and Open-Source Software Components and Libraries.
PHP is not WordPress. WordPress is not PHP. If you care about quality software, PHP is a great home for you. So is Java. So is C#. So are other languages. If you suck at software you'll suck in any stack. If you're good, each stack has strengths you can play to.
NOW let's talk about security.
This vulnerability, is the very first RCE to this level in PHP's history. It was reported back in August. AI did help. A lot. (Wiz claims one researcher did in a week what would previously have taken a team months)
Previous PHP RCEs had limited attack surfaces:
- 2024 - Windows CGI Only
- 2019 - One specific nginx setup
- 2012 - CGI only
None of which applied to reasonably-better practice typical Linux + Nginx + php-fpm deployments.
This right here was ... unique, I think even across any stack. The only language-runtime equivalent to it was probably Windows IIS Code Red.
That's not to say other stacks didn't have framework-level vulnerabilities with devastating impacts, if memory needs refreshed:
Ruby — Rails CVE-2013-0156: every Rails app, default config, pre-controller, botnet-exploited. The strongest analogue in any stack.
Java — Struts 2 CVE-2017-5638 (Equifax). Log4Shell needed the app to log attacker input; Spring4Shell needed WAR-on-Tomcat + JDK 9+ + POJO binding.
Node — React2Shell CVE-2025-55182 (Dec 2025, CVSS 10, CISA KEV): default create-next-app exploitable, but Express/Fastify/Nest untouched.
.NET — MS10-070 padding oracle (2010) leaked web.config/machineKey on every ASP (dot NET) site; RCE was a derived second step. Kestrel/ASP.NET Core has never had an RCE.
Look ... let's drop the snark. LLM-driven vulnerability research and breaching frameworks are about to humble the absolute heck out of all of us. They already have.
If you think your stack is not at risk, think again.