Proved my old-school tech prowess today:

Asked an engineer to scrape a list of company email addresses off of a website we use internally. After 10 minutes, they were still refining an LLM prompt to do it.

I used devtools to grab the JSON data, copied it into Word, edited out the surrounding array structure, then copied that into Excel to sort alphabetically, deleted the numeric keys. Ta da! Took me about 3 minutes.

I really, really worry that basic computer literacy is nearly dead.

"Simply hate fun"? A new WordPress 7.2 feature that sends visitors to a random post will be switched on by default. It's prompted developer backlash, a jab from Cloudflare's EmDash team, and pushback from Matt Mullenweg.

🔗 https://www.therepository.email/developers-push-back-on-wordpress-7-2s-new-random-endpoint-being-on-by-default

Hearing more and more stories of "nobody knows how to work on our codebase anymore after 1.5 years of agents, and management is asking for us to get more involved in the code after initially telling us to go agent native due to quality issues, but nobody really knows how to anymore"

Responses:
- Shock!
- Surprise!
- Wasn't this the goal?

I really like to own my own content so I've added self hosted code bins to my site.

You can't save anything but you can mess around with the code in the bin. I've used @rem's Loop Protect and @davatron5000's MicroLighter to make that look and play nice. https://peterwilson.cc/code-bin/self-hosted-code-bins/

I'm not that surprised how many developers don't recognise this risk with AI coding agents (Claude Code, Cursor, Codex…), sandboxed or not:

An agent that can write to your repo can plant code in .git/ that later runs on YOUR machine:
• .git/hooks/* (pre-commit, post-checkout…)
• .git/config: core.fsmonitor, core.pager, core.sshCommand, diff.external, "!" aliases

core.fsmonitor runs on a plain `git status`, which your shell prompt (starship, oh-my-zsh), VS Code, JetBrains IDEs and git GUIs run automatically. Just cd-ing into the repo or opening it can trigger it.

.git/ isn't tracked, so none of this shows up in git diff or code review. For sandboxed agents it's the easiest way out.

After an agent session, check from outside the repo before opening it (no output = OK):
find REPO/.git/hooks -type f ! -name '*.sample'
grep -inE 'fsmonitor|hookspath|pager|sshcommand|external|textconv|filter|!' REPO/.git/config

#git #AI #infosec

The trillion dollar monsters are all focusing on *finding* issues at high speed in large volumes. Hardly any of them care about *fixing* these problems with any sense of quality.

Ugh, just what I needed. One of the sites I maintain in my spare time got hacked. Thousands of spam posts.

Could have been much worse though, it looks like it was just one editor's account that was accessed. Probably a poor password. There appear to be no shady plugins or backdoors or anything.

PSA: In cases like this, also check for application passwords on user profiles. There were quite a few of those too, and I imagine they added all the spam through the REST API.

#WordPress #security

#WordPress 7.2 is adding a (customizable) /random/ endpoint that returns a set of random posts. It's enabled by default (which it shouldn't imo) and getting some vigorous debate on the announcement post:

https://make.wordpress.org/core/2026/11/05/your-content-is-going-to-get-more-random/

next.js is the cybertruck of javascript frameworks in that it will also stop production

Ah, GitHub is previewing a new PR overview page / UX... Hold onto your butts.

Assuming we spend an average of 4 hours per vuln report, we just yesterday got ourselves **four weeks** of full-time work.

Every panel I go on: "Gina but isn't open source inherently less secure than closed source?"

Meanwhile, MS Paint does remote code execution now 💀

https://www.techzine.eu/news/security/145581/paint-vulnerability-allows-rce-patch-is-hard-to-find/

#opensource #foss #cve #mspaint

Free beer: costs nothing. Free speech: you're allowed. Software licenses picked the second one, which is why the free software booth is the one handing you an invoice. 🍺 https://courtneyr.dev/2026/11/04/free-as-in-freedom/ #opensource #WordPress

The high level issue remains internet2shell

The ticket https://core.trac.wordpress.org/ticket/30465 was created 12 years ago. It concerns “Dashboard alert if a plugin/theme was removed from the WordPress repository.” Well-known developers have weighed in on this.
Right now, a notification about a plugin being removed from the WordPress repository would be more important than ever.
#wordpress #plugin

How long ago was the last time you added a PNG8 image to a website?

I've spent a long time pondering the difference between a "script" and a "command" in Unix.

Am increasingly convinced that commands come with man pages. Scripts do not. #sysadmin

Wow, #Postman is now basically malware: https://github.com/postmanlabs/postman-app-support/issues/14370

I hereby award this as the best worst email I've received in 2026. I'm so glad that they told me that it's not a cold pitch. I'm honoured that they found me through my podcast '{video/article}', and they're right the recent episode '{piece_title}' was really good!

Imagine if real engineers said “we asked an AI because checking the integrity of the steel that went into that bridge was slow and boring”. Grow up and do your job, computer touchers