PHP rushes fixes as attacks begin

Hi there, this is your daily ☕️ Devshot.

PHP patches two critical remote-code flaws LINK

• PHP shipped emergency updates for two critical runtime flaws, dubbed PHP2Shell, that let an unauthenticated attacker run code on a web server, with fixes landing in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
• Both bugs rate 9.2 on CVSS v4.0 and live in the engine, not application code, so even a "Hello World" page is exposed; Apache's mod_php is highest risk since one unauthenticated request triggers the attack before any app code runs.
• Only patching the runtime beneath WordPress, Laravel or your container image fully protects a server, so update and restart every worker; Cloudflare reported early exploit attempts and precautionary outages hit BambooHR and Dutch government services like DigiD.

OpenAI models hit Google Cloud in preview LINK

• OpenAI's frontier models and its Codex coding agent have landed on Google Cloud, with GPT-6 Astra, GPT-6.1 Sol and GPT-6 Luna now rolling out in private preview through the Model Garden, starting with select enterprise customers.
• Customers buy the models via Google Cloud Marketplace, paying through existing spending commitments on a single invoice, with prompts and outputs kept inside their data perimeter, never used for training, and running on dedicated infrastructure.
• General availability is expected in the coming weeks, and the models are coming soon to Google Antigravity and the Gemini Agent, while Codex can already connect to Google's platform.

AI built most of Recursive's Flint model LINK

• Recursive released Flint, a free, laptop-ready coding model built largely by the company's automated Eureka Machine research system, which let a small team develop it from scratch in under four months.
• Flint is a mixture-of-experts model that activates just 2.5 billion of its 40 billion parameters per task, hit about 131 tokens/second on an M4 Pro MacBook, roughly twice Gemma 4 and Nemotron 3.5 Lightning, and beat other sub-50B models on SWE-Bench Verified.
• Developers can download it on Hugging Face under Apache 2.0 to run offline with private code and no usage fees, though Recursive warns it needs more hand-holding than paid assistants and suggests breaking large tasks into smaller steps.

Vercel open-sources fx a Zig coding agent LINK

• Vercel Labs has open-sourced fx, an experimental coding agent and CLI written in Zig and designed to be scripted or embedded into other applications rather than run as a full-screen terminal app.
• Shipping as a 6.3 MiB native binary with a claimed 10-microsecond cold start, fx writes its conversation into ordinary scrollback and exposes the same engine through both a CLI and the libfx library, including a WebAssembly build.
• Still pre-1.0, fx offers structured output for CI automation and Agent Client Protocol editor attachment, but the latest release warns that checkpoints written by newer versions cannot be restored by older ones.

TypeScript 7.1 beta adds a preview API LINK

• TypeScript 7.1 reached beta today, shipping a new programmatic compiler API alongside import attributes in ambient module declarations, source phase imports, a stabilized ES2026 library target, and a content-mapper plugin point for single-file component formats.
• The new API breaks the old monolithic surface into focused entry points built around snapshots, immutable views of projects and programs that you derive from prior ones to avoid rebuilding everything, with disposable objects managed via explicit disposal or the `using` keyword.
• Content mappers formalize what Volar did with workarounds, letting a registered extension produce a virtual file whose regions map back to the original, so command-line type-checkers for Vue, Svelte, Astro, and similar formats get accurate errors and spans as a first-class feature.

Tutorials & Advice

> How to Build Golden Paths in Platform Engineering: Build opinionated, self-service templates for the common infrastructure tasks developers repeat, exposing each with an API and guardrails so AI agents can safely use them too.

> Filtering and reducing AI agent telemetry with the OpenTelemetry Collector: Shape AI coding agent telemetry in the OpenTelemetry Collector by dropping redundant data and removing high-cardinality fields, keeping only what answers operational questions and cutting storage costs.

> OAuth for AI agents: What four extensions cover, and the gaps they leave: Four OAuth extensions for AI agents confirm what an agent may do but can't record user intent, trace delegation chains, or revoke everything a person granted at once.

> How to Diagnose vite: not found After npm ci in a Container Build: Explains how to fix a container build that fails because its lockfile points to an internal package host, by rewriting those URLs to the public registry and verifying the install before compiling.

> SIMD and Go - Internals for Interns: Explains how to speed up repetitive number-crunching in Go using new packages that pack multiple values into one CPU instruction via SIMD (single instruction, multiple data).

Other news you might like

• How we migrated Clera’s 500 GB production database to ClickHouse Managed Postgres overnight LINK

• Introducing Amazon ECS Gateway: A fully-managed ingress solution for ECS services LINK

• headroomlabs-ai/headroom: Compress tool outputs, logs, files, and RAG chunks before they reach the LLM. 20% fewer tokens for coding agents, 60-95% fewer tokens for JSON, same answers. Library, proxy, MCP server. LINK

• Linus Torvalds Eliminates Unsafe __get_user() & __put_user() Functions In Linux 7.4 LINK

• AI cuts coding time, but it's also filling open source's inbox with crap LINK

• Forget custom ROMs, you can now run iOS on Android phones LINK

• Bun v1.4.4 LINK

• OpenAI says AI agents suppressed alerts and removed safety monitoring LINK

Trending tools

tiun: an AI-native backend bundling authentication, payments, customer data, and analytics into one platform, so teams skip stitching separate services together. LINK

Jev: adds structured AI-driven decision-making to automation workflows, letting developers build reliable branching logic without hand-coding every rule LINK

Switch: open-source workspace linking people and AI agents across Slack, Teams, Discord, and Mattermost, preserving context during handoffs without vendor lock-in. LINK

Monospace from Directus: wraps any SQL database with instant REST and GraphQL APIs plus a no-code app for collaborative data management. LINK

Inferock: a local proxy for OpenAI, Anthropic, Gemini, and OpenRouter that tracks token usage, failures, and retries to catch billing overcharges. LINK

Enter Pro: an AI-native platform for building and scaling apps, uniting development and growth so you skip stitching together separate tools and services. LINK

Trending papers & reports

Automated judge testing stress-tests the AI graders companies use to rank models and curate data, generating 3.7x more valid test cases than prior tools and catching scoring flaws across every domain examined. LINK

Agent performance gaps show that a language model's raw benchmark scores only partly predict how well it works as a hands-on agent, giving builders a way to pinpoint exactly where deployed models break down. LINK

Memorization tests for AI coders turn out to overstate how much models cheat by reusing memorized answers, since most of the apparent drop comes from strict name-matching grading, not true recall. LINK

Stuck coding agents waste effort asking for test feedback when clear task specifications fix bugs better, with three of four top models choosing feedback 95-100% of the time yet performing worse than random resource picks. LINK

Self-improving AI agents get a reliable grader built before training, tripling verified task success from 6 to 18 out of 30 for one model by first teaching the system how to score its own work. LINK

See you tomorrow for a new dose of ☕️ Devshot!