Insights

Deep technical analysis of AI coding tools from someone who builds on them every day.

Part ofDocumentation

php2shell: Check Your PHP Servers

21 Oct 2026

CVE-2026-109618 and CVE-2026-109619: unauthenticated RCE on every PHP web SAPI. Fixed versions, stopgaps, a public header check and an agent skill that checks the runtime.

PHPCVESecurity

State of WebMCP Security, October 2026

11 Oct 2026

600 sites scanned headless, enumeration only. Who registers WebMCP tools, how many write tools lack consequentialHint, Shopify's platform default, and what site owners should do.

WebMCPSecurityData

Claude Code Source Exposed

Mar 31, 2026

512K lines of TypeScript analyzed. Hidden features, architecture deep dive, security audit, and what it means for AI tool builders.

ArchitectureSecurityFeatures

7 Hidden Limits & CLAUDE.md Overrides

Mar 31, 2026

File read caps, tool result truncation, context death spirals, and the employee-only gates. Every claim verified against the source. Includes a drop-in CLAUDE.md.

VerifiedCLAUDE.mdPractical