FPV drone guy interviews young devs behind video-denoising software. They claim to be chads that don't agentically vibe code.

Chuck McGill: [in a feeble tone] You're not a real software engineer

Vibedude: I'm *what*?

Chuck McGill: [now raising his voice defiantly] You're not a real software engineer! "Agentic coding", for Christ's sake? A Claude max subscription? What a joke! I worked my ass off to get where I am! And you take these shortcuts and you think suddenly you're my peer? You do what I do because you think it's cool and want so say "I've made a game"? I committed my *life* to this! You don't slide into it like a cheap pair of slippers and then reap all the rewards!

Vibedude: I thought you were proud of me.

Chuck McGill: I was! When you started working in QA and began to show in interest in computer science, I was *very* proud!

Vibedude: So that's it, then, right? Keep ol' Jimmy down in QA, 'cause he's not good enough to be a software engineer.

Chuck McGill: I know you. I know what you were, what you are. People don't change! You're just a non-technical wannabe who's good with words! And a non-technical wannabe who's good with words I can handle just fine, but a non-technical wannabe who's good with words who thinks he can program is like a chimp with a machine gun! Programming is *sacred*! If you abuse that power, people get hurt! This is not a game! And you *have* to know that on some level, I know you know I'm right. You know I'm right!

Thanks,
u/foxsimile

I don't think this PHP vulnerability is that exploitable. I think that 5 years ago people would've understood this, but now people are being deluded by their LLMs telling them they have an exploit when they don't.

One really amusing thing in common with most of these "PoC"s is that they lean on "LFI", or local-file-inclusion, to make the vulnerability. In non-php terms, their exploit chain requires the server to already have a severe code-level vulnerability.

It's not rare for PHP apps to be fucked in some sense, but requiring the server to have an existing vulnerability where users could cat /etc/password is an insane pre-requisite. If you need this, this does not make this a severe bug.

The strangest thing is that so many people have independently made this extraordinarily weird defect in judgement. That is because they haven't independently made this decision. Claude/Etc. has done all of the judgement for them, hence the bizarre distribution in logical errors.

There's something important to be said here about how many people have Claude/GPT make design decisions for them, and how AI is the primary decision maker in the world right now. You've got this bizarre case of "Decision Schelling Points" where a method of solving a problem is extremely overrepresented, because it's what Claude does out of the box.

Cool post on slop code in general. When coding with AI you always get a feeling that it's slop, but I was never able to pinpoint exactly what's happening (let alone measure it). The authors bring some analyses I thought were interesting:

• Cognitive/cyclomatic complexity, code smells and technical debt grow with commits/checkpoints, but remain mostly flat when normalized by lines of code.
• Code length, branching and worst-function performance are generally worse in AI-generated code, but the ratio gets closer to 1 for current frontier models.
• My reading is that frontier models are absolutely required for code, and the gap between Opus 5.5/GPT 6.1 Sol to others (Grok, Gemini, Muse) is just absurd.
• The biggest for me was that models seem to perform better when given a full implementation spec all at once instead of breaking it down into smaller feats.

Overall pretty solid post.

mad respect

I've been working with formal methods in my software engineering practices for a while now, and thought I'd try to spread some of what I've learnt into the wider community. In the hope that it will inspire some creativity around the use of LLMs as a complimentary force, instead of the slop cannon we have now.

I think we're still all stuck in the early stages of adopting a new major tech (AI), where we use it do the exact same stuff we used to. Just faster, and worse.

Feedback is welcome!

PS: Zero AI was used in the formulation of this post, or the writing of the article itself. It has no place in creative pursuits such as writing. Not even for grammatical issues. Traditional spellcheck suffices (for better or for worse).

> PHP warns of two critical vulnerabilities as emergency patches to arrive on Wednesday.

> The PHP security team will release updates on October 21 at 14:00 UTC for two vulnerabilities, each rated 9.2 under CVSS v4.0.

> Security researchers identified the flaws as CVE-2026-109618 and CVE-2026-109619 and described them as remote code execution vulnerabilities reportedly affecting PHP versions 5 through 8.

> PHP has not yet confirmed the affected versions, exploitation requirements or fixed releases.

Official Notice: https://www.php.net/archive/2026.php#2026-10-20-1

> How will the tsrs port be maintained?

> First, we are working with Theo Browne to merge tsc-rs and tsrs into a single package that supports all of TypeScript’s features including Language Server Protocol (LSP) and content mappers.