Co-Founder of @packagist / https://xitter.cf/t.co/J7OZsciXbE and Co-Creator of #composerphp - he/him - @naderman@phpc.social
Berlin, Germany
Joined January 2008
- Tweets7.8K
- Following1.2K
- Followers5.4K
- Likes23.3K
If all the govs shutting down servers for a PHP update, all the hosters & enterprises terrified by the vuln, gave $100k, or just $50k a year to the PHP Foundation, things could look very differently. Go, make your employer sponsor *today* thephp.foundation/sponsor/ #php #phpc @ThePHPF
The keyword here is *attempts* and this is getting a bit frustrating, @aws threat intelligence put out a similar statement. But all this is, are requests trying to find a way in, trying to corrupt memory. They don't describe anyone who actually figured out the rest of a chain for RCE. Now, is that concerning, cause clearly quite a few people jump to attacking with AI with even little info? Yes. Is it a sign there was any exploitation, successful RCE before disclosure? No.
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
So I guess now is the moment where I start thinking about the fact I'm supposed to give a talk on PHP supply chain security at @MeetMagento_DE tomorow and in the midst of all this haven't really prepared a talk yet? 😆 Guess worst case it's an AMA
Read the story around the security vulnerabilities fixed in PHP today that I wrote up for the PHP Foundation, what an exhausting last week in this process. Glad it's out, hoping you all update ASAP.
We have posted more information about today's security releases, including the sequence of events that led to the discovery, how the PHP security team is improving their processes, and what we need from you to continue this critical work. #php #security thephp.foundation/blog/2026/…
Nils Adermann retweeted
It's kinda crazy that I have a certificate for hosts I do not control, that actually works for so much software out there still. First time in my life :) Any other root CA incident I remember did not result in me actually being able to sign something.
Nils Adermann retweeted
If you rely on the volunteer maintained rpms.remirepo.net we urge you to move to distro packages or building from source now, so you can immediately apply updates. The repo will not have updates today.
Nils Adermann retweeted
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.
PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
Nils Adermann retweeted
Now in public beta, Claude Platform can send OpenTelemetry traces from the Messages API, Claude Managed Agents, and the Claude SDKs to your observability stack.
Nils Adermann retweeted
time and time again i fall into the trap of designing a big piece of infra with an agent, only to find out that my context window is smaller than the agent's.
i keep forgetting things that were already discussed, while clanker mcclankerface knows all the things.
Nils Adermann retweeted
Introducing Expand Fetch, a new way to scrape and crawl the web.
Your agent has never seen the web. No wonder it gets basic questions wrong.
Traditional Markdown APIs lose critical details. So we trained two System one models to change that:
Iris, a vision model that sees pages like you do, preserving tables, icons, and layouts.
X-Ray, a JSON model that uncovers the hidden data behind every page.
Every fetch also comes with a Wayback Machine. Every line links back to its source, so you can verify exactly what your agent saw.
Three products. One API.
On our benchmark of 1,094 questions across 326 challenging web pages, agents using Expand got 74% right. The next best API got 55%.
Available today at $1 per 1,000 fetches.
Try it at expand.ai
Nils Adermann retweeted
this is very easy to disprove, empirically from what we see since decades: We have open-source alternatives to most SaaS that you can self-host with a single Docker container. They are basically free and far easier than vibe-coding. Yet, many people still choose SaaS - why is that? Because ownership comes with responsibility and maintenance, both are expensive, economically and physiologically (stress).
Vibe coding costs even more than open source (tokens cost money, prompting costs time, stress costs), and also sometimes more than SaaS, because suddenly you own the bugs and the uptime.
Real fun when it breaks on a Sunday and you have to spin up some prompts to fix it instead of paying 12$ per month to a company that handles everything properly.
I think people use vibe coded currently because it's new and exciting, but eventually see the real costs it has and instead will go with the peace of mind option for a few dollars.
Nils Adermann retweeted
Here is Jeeves explaining how he works with us
He can see when I bookmark stuff on X and can use herdr on my AI shed to spin up “big agents”. I just wanted to see if the integration worked, but thought the video was actually quite good
I've now got a family assistant in the UK (where we don't have muse etc) that
- can order stuff on waitrose and Amazon for me
- can make and receive phone calls on a real 07 number
- sends an receives email on a real email address
- can use whatsapp (including a three-way DM session with me and my wife)
- can spend money from a prepaid debit card
- can update its own agent loop and programming
- stores its state in append only logs (git repos + durable streams)
- can make arbitrary websites for internal family use or publication
- can use my office network for TCP/IP egress (so I can use whatsapp web client)
- a bunch of lil esp32 devices like that @itopinion note screen or @fphofficial satellite smart speaker connected
- can control my browser when I allow it
- can control my computer when I allow it
- herdr plugin to wrangle my coding agents
- also connects to my X account, bank account statements, Yoto etc
- agent cannot see or leak any secrets for any of these third parties
- can use sandbox computers whenever it wants
- can connect to any third party MCP servers
- can be used as MCP server from claude, codex, muse, dot, etc
Almost everything in this system is "userspace" and can be changed by the agent itself (for better or for worse...)
All open source and self-hostable on any cloudflare account
All on a tiny set of core primitives
Looking for a few brave souls to have a go setting this up themselves
It's quite fun
Nils Adermann retweeted
It’s pretty weird that most code review tools do very little to guide a reviewer through reviews. More often than not, the code that is good to review first is not one that is the highest up in the alphabet. Even from a simple dependency graph, you should be able which code is the lower level and which is higher level. You could go either use-case first, or foundation first. Depending on the reviewer preference, the UI could change. And you could even weave the explanation through the diff, like how people write blog posts.
Nils Adermann retweeted
"we train on all of the data you allow to pass through us and we dont want to train on things that our users will object to"
thats actually what thats saying
either that or "we're gonna continue to roleplay that this machine is alive"
Nils Adermann retweeted
Grade sind PayPal-Phishing-Mails im Umlauf, die technisch NICHT als Fälschung erkennbar sind.
Es werden die Systeme von PayPal selbst missbraucht.
Einzig das "Notification" ist ein Hinweis.
1/5
Nils Adermann retweeted
I've published a new, general-purpose terminal specification that gives any program a way to tell the terminal what it's doing: idle, working, waiting, finished, or failed, and why. It is easy to implement on both sides. I've written more about why: mitchellh.com/writing/progra…
The problem this solves is generic and applies in compelling ways to all sorts of use cases (e.g. package managers, build tools), but it really rears a hideous head when it comes to AI and the "agentic inbox" problem.
I found over 250 different agent orchestrators (with various goals) that all individually implement a heuristic based approach to detecting whether things like Claude Code are working, blocked, done, etc.
If you look at @herdrdev's commit history, you can see around 10 compatibility changes to detect Claude Code within just the past 3 months. (This isn't a dig at Herdr! They're doing great work with what they have, and everyone else is doing the same thing).
Heuristics are not the way. And over-indexing on agentic use cases isn't the way, because this problem is really interesting for other tools too: Homebrew, Terraform, Cargo, etc. etc.
Proprietary protocols and out of band APIs are not the way. They have an O(N) integration problem and require extra work to work over SSH or within local VMs/containers.
The program status specification (OSC 7501) solves this in a reliable, deterministic way that is general-purpose and can be easily adopted by the entire industry.
Read more: mitchellh.com/writing/progra…
Nils Adermann retweeted
PHPStan 2.3.0 is out with massive leap in performance, generics improvements, detecting unused variables, improved closure type inference, inferring static variable types from assignments, and engine rewrite!
Nils Adermann retweeted
You love SLOs? You have opinions about burn rates? You've been waiting for someone to hand you a blank error budget?
Hi 👋 Let's define together what reliability really means at Laravel.
Senior SRE, remote, CET to US East.
apply.workable.com/j/6C1E9F5…
