AI-Assisted Security Patching Expands as PHP and Ruby Flaws Prompt Urgent Fixes

Key Takeaways

1. Developers are using AI and volunteers to backport PHP security fixes from 8.2 to 5.x, while a new Ruby warning urges immediate upgrades.
2. A PHP configuration change is recommended to block a low-probability RCE path, with only non-default serialize_handler setups potentially affected.
3. One developer recommends moving VPS servers off the public internet using Tailscale and Cloudflare Tunnel as AI finds more exploits.
4. A SaaS user argues paid services absorb patch responsibility, while a developer was blocked from Daybreak Blue access despite buying a required Yubikey.
5. A client-side technology breakdown weighs Web, cross-platform, and native options, with AI reducing the cost of writing two native codebases.
6. Mole CLI released a Windows version, added official Skills for agents, and now covers over 800 Mac and 400 Windows apps with 72.5K stars.

1. Security Patches and AI-Assisted Remediation

1. Arvid Kahl highlighted that volunteers and their agents backported PHP fixes from the oldest supported version, 8.2, all the way to 5.x from a decade ago, and suggested re-evaluating AI systems for all security fixes. He also noted a similar Ruby security issue, citing a post that said GitLab vulnerabilities had moved to Ruby with multiple 10.0-severity flaws and urging immediate patching. A reposted view said these CVEs should humble programmers who think they are stronger than AI, arguing that human-AI combination is unstoppable rather than either side being superior. 1 2 3
2. Kahl mentioned another vulnerability and expressed relief that many people had disabled the relevant setting by Wednesday night. A cited post recommended setting session.upload_progress.enabled to 0 before the next PHP release to block a low-probability RCE path (CVE-2026-115560), while continuing existing advice for CVE-2026-109619; only non-default applications that switch serialize_handler to "php" at runtime may be affected. 1
3. @levelsio advised VPS users to move servers off the public internet and onto a Tailscale network with Cloudflare Tunnel, arguing that AI is finding more exploits and SSH key login alone is insufficient. He described the attack surface as websites/apps and servers: the former goes through Cloudflare Tunnel with WAF enabled by default on the free plan so the server no longer responds on ports 80/443, while the latter sits in a private Tailscale network with all常规 access blocked by firewall, achievable on Hetzner by creating an empty firewall. He acknowledged this is not a perfect solution and added that Tailscale is based on open-source WireGuard, can be self-hosted by an AI assistant, and that both Cloudflare Tunnel and Tailscale are 100% free and likely to stay free due to enterprise upsell. 1 2 3

2. SaaS Responsibility and Access Hurdles

1. Jack Ellis argued that recent exploit incidents show the value of SaaS: his company pays for about 20 SaaS services, and if self-hosted, it would have to handle all security patches itself this week; now a small monthly fee lets the provider's team do that work. He said the pay for “a week of work” was good but did not specify the amount or the work. 1 2
2. Tony Dinh said he applied for Daybreak Blue access on @thsottiaux's advice and even bought the Yubikey required for access, but was blocked at the final step; he asked to be let in and stressed the access would be used only for defensive purposes. 1

3. Client-Side Technology Trade-offs and Tooling Updates

1. Tw93 summarized client-side technology choices: Web-shell solutions are fastest to develop but weak in performance; cross-platform options like React Native, Flutter, and Electron sit in the middle, with Electron bundling Chromium and Node.js for installers over 100 MB and high memory use but better multi-platform consistency; Tauri and Wails use system WebViews to shrink package size but require compatibility code because WebViews differ across platforms. Native development has high upfront cost but the best performance and experience; he argued AI lowers the cost of writing two native codebases, shifting新增 cost to dual-platform debugging and verification. He proposed an “impossible triangle” of R&D efficiency, experience, and performance, and said selection should depend on the scenario: pure web browsing can use Web, system-level access or distribution/interaction priorities call for native, and large workloads with business-effect priority can use cross-platform. 1
2. Tw93 gave examples: Miaoyan, a pure Swift Mac Markdown app, uses JavaScriptCore to run JS for Markdown formatting instead of writing a complex engine in Swift; in Pake, Rust calls JS to render Toast notifications and the web side calls back to Rust's download capability; Miaoyan's split editor uses the C library cmark-gfm to mark line numbers, with JS calculating scroll position and syncing the Swift editor via a message channel; in Kaku, terminal input “#+natural language” passes through zsh escape sequences to Lua, then Rust requests a model to generate a command and fills it back into the command line. He said engineers should combine language ecosystems by scenario without bias, and that AI reduces such hard practices but knowing language traits still helps correct AI when it goes off track. 1
3. Mole CLI open-source update: the Windows version iterated through 7 versions to align with the Mac version and released a正式版 installable via scoop; it added official Skills for Mac and Windows that agents can install to help clean up and uninstall software; mo slim can remove Intel code from universal apps; it synced uninstall/cleanup rules for over 800 Mac apps and over 400 Windows apps, and the project reached 72.5K stars. 1

4. AI Agents in Sales and Product Strategy

1. Tibo described a user replacing half of an SDR team with a single Squad agent: the agent triggers when a new lead arrives, filters personal email domains, researches the company via its website, founder LinkedIn and X, and public data, scores against the ideal customer profile, selects an email angle, stores results in CRM or a spreadsheet to avoid duplicate research, and sends a short brief with identity, likely paid tools, fit rationale, and a draft; the user replies send, edit, or skip, and nothing goes out without confirmation. The agent also maintains a document recording which angles get replies, improving later emails; Tibo said sales teams usually do this manually only for the best leads, while the agent covers every lead. 1
2. Tibo said he has shifted from “writing prompts for agents” to “building systems and letting agents own systems”: for each task he builds a system with his chief of staff agent, then creates a new agent in Squad to own that system; he currently has 1 chief of staff agent plus 5 Squad agents, and added one that day to aggregate feedback from Slack, email, customer calls, and production logs. His view is that when things do not go as expected and awaited success does not appear, one should keep shipping and acting because opportunities are often seen and seized only when one is moving. He said he will run a set playbook for the next 3 months but did not specify it. 1 2 3
3. Jon Yongfook said he built an AI wrapper video junk app in under 24 hours and immediately realized there is no business there: several big players are already undercutting each other and margins are squeezed to almost nothing. He argued that products for the “agent economy,” such as Tinyfish providing web browsers for agents, are a future direction but will be brutally winner-take-all, lowest-price-wins, with zero switching cost—a VC-funded game not for indie developers; he will focus on use cases that still need humans, even if that may only apply for a few years. He also said he uses Claude for UX interaction design by generating a dozen variants and picking the one that “feels” best, joking that a human doing the same would throw a keyboard at him. 1 2 3