Señor Developer. You can write shit code in any language or framework you want. Do whatever makes you happy.
Cocoverso
Joined March 2009
- Tweets15.9K
- Following1.2K
- Followers536
- Likes60.2K
Agustin Gomes retweeted
Holy balls the latest update to macOS *ROLLED BACK* the eMudhra cert removal from /etc/ssl/!
What the hell are you doing over there, Apple friends?
Agustin Gomes retweeted
BREAKING: Employers worldwide are pulling back on AI as they navigate a flood of errors and low-quality work that sap employee time, raise privacy and security risks, and drive up costs, per the Guardian.
Agustin Gomes retweeted
Grave denuncia. Se perdió comunicación con el periodista Ricardo Tarazona tras ser amenazado por un "comunero" chavista.
Urgente | Periodista de El Carabobeño fue amedrentado por un “comunero” en Yaracuay mientras documentaba colapso de ambulancias en el municipio Urachiche
El periodista Ricardo Tarazona, perteneciente al medio El Carabobeño, fue víctima de amedrentamiento por parte de un “comunero” mientras realizaba labores de cobertura para la Alianza Nacional de Medios en el estado Yaracuy.
El comunicador se encontraba documentando sobre el colapso y la falta de ambulancias operativas en el municipio Urachiche, específicamente en la comunidad El Picure.
Durante la pauta, un sujeto que se identificó como miembro de una comuna irrumpió de forma violenta, descalificando el trabajo informativo bajo falsos señalamientos de índole político.
Lejos de atender el reclamo comunitario sobre la precariedad del servicio de salud pública, el agresor adoptó una actitud hostil y amenazó directamente al periodista con convocar a un grupo de motorizados armados, poniendo en inminente riesgo su integridad física. Tras estas intimidaciones, se perdió comunicación con Tarazona. #VPItv.
@eldiario
@ElTequeno
@diariodlosandes
Agustin Gomes retweeted
Every religion in history has promised miracles and warned of the apocalypse. Anthropic is the first to file both with the SEC.
Agustin Gomes retweeted
One hill I'll happily die on: the normalization of "ship fast" culture at the expense of proper SDLC has played a significant role in the quality of vulnerable code being pushed into production and the rise of CVEs and enshitification of software for the last several years.
We've systematically traded engineering rigor for velocity, security assurance for investor confidence, and long-term maintainability for quarterly growth. All things I wish we would second guess and reevaluate.
But the software overlords wanted products yesterday and they got them. And now the rest of us get to spend the next several years discovering exactly which corners were cut and figuring out how to deal with the immense amount of responsibility that's been dropped on our collective feet.
Agustin Gomes retweeted
今回のPHPの騒ぎで、一番偉かったのは、PHP 7.xとか5.xにバックポートした人でも何でも無く、LTSに頼らずに普段から粛々と計画的に最新版のPHPに追随してたエンジニアと、そのコストを承認した上司なんだよ。そういう運用だったら、PHPの最新版が出たら差し替えるだけだった。
Agustin Gomes retweeted
when you see an “expert” in the media talk about a topic you’re quite familiar with, it really makes you question all their other “experts” for all the other topics
Agustin Gomes retweeted
I think we've discovered another critical vulnerability:
CVE-2026-BURNOUT: AppSec Professional Exhaustion
Severity: Critical (CVSS 10.0)
Description: A vulnerability affecting security professionals exposed to a continuous stream of critical RCEs, zero-days, emergency patches, and Friday afternoon disclosures.
Impact: Sleep deprivation, excessive caffeine consumption, and an inability to enjoy weekends.
Attack vector: Reading security advisories.
Affected versions: All AppSec professionals, regardless of experience.
Mitigation: No known patch. Air-gapping may delay the inevitable. Total system collapse remains a possibility. 🔥
Agustin Gomes retweeted
Lot of #PHP snark going around right now from folks who've either never written software, or never done it in PHP (in the last 20 years).
I've architected, designed and hand-coded copious amounts of software in Java/Spring/Hibernate, .Net/C# Entity Framework and PHP/Symfony/Doctrine, applying very similar patterns and better practices of completely stack-agnostic concepts such as:
- Test-Driven Development (and given half-day and full-day hands-on live-coding workshops at conferences worldwide)
- Onion/Hexagonal Architecture
- Domain-Driven Design
- Data Mapper ORMs
Beyond workshops, I have spoken on these topics at conferences worldwide as well.
I might argue that I am not completely devoid of clue when it comes to these stacks' capabilities.
In fact, I have hired, coached and cross-trained engineers across these 3 stacks.
And I can assure you PHP shines within these paradigms, with an extremely vibrant, mature and robust ecosystem of Application Frameworks, Security Frameworks and Tools, and Open-Source Software Components and Libraries.
PHP is not WordPress. WordPress is not PHP. If you care about quality software, PHP is a great home for you. So is Java. So is C#. So are other languages. If you suck at software you'll suck in any stack. If you're good, each stack has strengths you can play to.
NOW let's talk about security.
This vulnerability, is the very first RCE to this level in PHP's history. It was reported back in August. AI did help. A lot. (Wiz claims one researcher did in a week what would previously have taken a team months)
Previous PHP RCEs had limited attack surfaces:
- 2024 - Windows CGI Only
- 2019 - One specific nginx setup
- 2012 - CGI only
None of which applied to reasonably-better practice typical Linux + Nginx + php-fpm deployments.
This right here was ... unique, I think even across any stack. The only language-runtime equivalent to it was probably Windows IIS Code Red.
That's not to say other stacks didn't have framework-level vulnerabilities with devastating impacts, if memory needs refreshed:
Ruby — Rails CVE-2013-0156: every Rails app, default config, pre-controller, botnet-exploited. The strongest analogue in any stack.
Java — Struts 2 CVE-2017-5638 (Equifax). Log4Shell needed the app to log attacker input; Spring4Shell needed WAR-on-Tomcat + JDK 9+ + POJO binding.
Node — React2Shell CVE-2025-55182 (Dec 2025, CVSS 10, CISA KEV): default create-next-app exploitable, but Express/Fastify/Nest untouched.
.NET — MS10-070 padding oracle (2010) leaked web.config/machineKey on every ASP (dot NET) site; RCE was a derived second step. Kestrel/ASP.NET Core has never had an RCE.
Look ... let's drop the snark. LLM-driven vulnerability research and breaching frameworks are about to humble the absolute heck out of all of us. They already have.
If you think your stack is not at risk, think again.
Agustin Gomes retweeted
Last night's slopfest surrounding the bogus PHP exploit and the subsequent panic wave is a perfect example of why good cybersecurity researchers are still needed, why LLMs are not infallible, and why critical thinking cannot be automated away.
AI can accelerate research, but clanker confidence is not evidence and consensus built on unverified claims in the end is still just speculation.
Next time we might not be so fortunate, so maybe as a community we need to tighten and review how we handle patching and assume leaks will happen and be prepared to counter that.
Agustin Gomes retweeted
皆様に、今夜に対応して頂きたい大至急のお願いです。
多くのウェブサイトで使用されているPHPに関し、PHPのセキュリティチームが、重大な２件の脆弱性に関する注意喚起を行っています。
公開しているウェブサイトでPHPを使用しているか確認し、今夜、10月21日午後11時（日本時間）に公開される修正パッチについて、可及的速やかに適用できるよう準備をお願いします。
修正パッチを速やかに適用することが困難な場合は、例えばウェブサイト等を一時的に停止させることも、リスクを低減させるための有効策の一つと考えられます。
国家サイバー統括室のXアカウントでも関係する情報を発信していますので、そちらも参考にして下さい。
国家サイバー統括室(注意・警戒情報)（@cyber_forecast） / X