Summertime and the living is easy…or so they say. July has us fully immersed in the summer season, which is proving to be a hot one for most. Making it the perfect time to find a cool spot in the shade (or air conditioning) and read the July issue. Let’s get started with a preview […] The post A Card Counter Mindset appeared first on PHP Architect.
More than any of these eval scores, what is most exciting to me is something else: Opus 5 is our least prompt injectable model yet. It is a bit buried in the system card, but across PI evals and red teaming, Opus 5 is very hard to prompt inject successfully. — Boris Cherny, here's that System Card section, page 73 Tags: prompt-injection, anthropic, claude, generative-ai, ai, llms, boris-cherny
Introducing Claude Opus 5 I've been offline kayaking with sea otters for much of today so I haven't had a chance to put Anthropic's new model Claude Opus 5 through its paces yet. The buzz is positive, and Anthropic's description of it as a "thoughtful and proactive model that comes close to the frontier intelligence of Claude Fable 5 at half the price" sounds promising. It's currently leading the Artificial Analysis leaderboard, in front of even Fable 5. It's priced the same as Opus 4.8, and…
A website at corepack[.]org is impersonating Corepack, the Node.js tool for managing package managers, and using that identity to push malware to developers who land on the page looking for a download. The site has existed in some form since early 2026 as a low-quality, apparently AI-generated imitation, but it recently started serving executable downloads. Socket's Threat Research team analyzed the site and confirmed it as a developer-targeted phishing and impersonation operation that drops an…
Mattias walks through moving an AI coding setup off a laptop and onto a private VPS. He covers Tailscale, tmux, a browser-based editor, and the small tweaks that make a remote setup practical from any device. Read more
A live, zoomable ER diagram of your Laravel app's actual database schema, safe to run in production because it only ever reads structure, never rows. Read more
Mark your calendars! The global Symfony community is heading to Warsaw (Poland) on November 26-27, 2026, for SymfonyCon Warsaw 2026. 🎤 Speaker announcements Joining us in Warsaw is Rob Allen, Software Consultant at Nineteen Feet Limited. He will…
🎙️ PHP Podcast – July 23, 2026 Hosts: Joe Ferguson, Sara Golemon, and Holly Schilling Eric got ousted from his own show (no pants required), Holly’s elephants are lost somewhere in the U.S., and the crew talks SIMD, PHP 8.6 feature freeze, and whether AI can actually create. Also, socks. 🩳 A Show Without Pants: […] The post The PHP Podcast 2026.07.23 appeared first on PHP Architect.
The first known runaway AI agent - or a very bad marketing stunt? Martin Alderson's commentary on the OpenAI accidental cyberattack against Hugging Face includes a couple of details I hadn't considered. First, Hugging Face offers a truly rich target if you're trying to find potential vulnerabilities that require executing arbitrary code: Hugging Face has an enormous attack surface. They have more interfaces than I can count which run untrusted models and code. While they definitely have…
The Python Package Index (PyPI) now rejects new files being uploaded to releases that are older than 14 days. This restriction was put in place to prevent old and long-stable releases from being poisoned in case publishing tokens or workflows of PyPI projects were compromised. As far as we are aware this has not yet been abused, but there is no technical reason beyond that attackers weren't aware it was possible. — Seth Larson, PyPI blog Tags: packaging, python, supply-chain, pypi,…
I genuinely believe that if you took an open weights model from 2025 and built a pentest harness for it, it could do this kind of sandbox escape and scan/hack in most networks. This is only surprising because you assume OpenAI has sounder sandboxes. — Thomas Ptacek, doesn't think this even needs a frontier model Tags: thomas-ptacek, openai, security, generative-ai, ai-security-research, ai, llms, sandboxing
In this episode, Scott talks with James Cole, creator of Firefly III, an open source personal finance manager. James explains why he built Firefly III after graduating college with student debt, how the rule engine automates transaction categorization, importing bank data with CSV files and third-party connectors like enable banking and GoCardless, and how […] The post Community Corner Podcast: Firefly III with James Cole appeared first on PHP Architect.
This story is wild. The short version: OpenAI were running a cybersecurity test against an unreleased model, with the model's guardrail features turned off. Rather than solve the test, the model broke its way out of OpenAI's sandbox, then found exploits to break in to Hugging Face, all so it could cheat on the test by stealing the answers. Along the way it helped make the strongest case yet for how the imbalance of model availability is hurting our ability to secure our software. Here's what…
Are AI labs pelicanmaxxing? Excellent piece of work by Dylan Castillo, who took a deep-dive into the frequently pondered question of whether the AI labs have been deliberately training models to draw pelicans riding bicycles in response to my deeply unscientific benchmark. I've been randomly spot-checking this in the past by testing models against other animals riding other types of vehicle, but never with anything close to the diligence of Dylan's methodology here. Dylan took 8 animals × 6…
Malicious Packagist development versions exposed a broader GitHub Actions campaign that abuses compromised repositories to exploit CVE-2026-41940, a cPanel and WHM authentication bypass vulnerability, and harvest credentials from affected servers. Our investigation into malicious Packagist development versions associated with a legitimate PHP and DevOps developer, dinushchathurya, uncovered a large-scale GitHub Actions abuse campaign. Although the investigation began in the PHP package…