throwaway82931

I'm checking by ssh'ing into my environment, and this is what I see as of 21:41 UTC, several hours after the patches were published:

    [email protected]:~$ php -v
    PHP 8.4.26 (cli) (built: Sep 23 2026 06:24:29) (NTS)
    Copyright (c) The PHP Group
    Built by Perforce Zend (www.zend.com)
    Zend Engine v4.4.26, Copyright (c) Zend Technologies
        with Zend OPcache v8.4.26, Copyright (c), by Zend Technologies

I keep hoping for either a change in the version or the build date, but nothing yet. The incident status page says they're deploying, but there haven't been further updates about how far along they are.

I've used Cloudflare rules, thanks. I've chosen to be a little more conservative:

    (any(http.request.headers["content-type"][*] contains "multipart"))

I help manage a few sites hosted on WPEngine, and taking them down is not an easy call to make. After making sure that our environments had the latest everything (WordPress version, PHP version, all plugins and themes on the latest), I contacted WPEngine support briefly.

They're on top of it as I would expect any major PHP hosting service to be. After asking if there was anything I could do to prep for php2shell (seemingly not), I just pleaded to be first in line when they apply patches and let them go.

How are others in similar situations handling this?

I have a Kaiser Permanente health plan via the ACA. I assume based on capitalist incentives that Kaiser would fire my primary care physician for prescribing outside the official guidelines.

But I've been thinking about this for a while and I'll talk to him anyway about the prospect of going on a low-dose GLP-1. If he's unreceptive then I'll ask about how to find a trustworthy out-of-network physician who isn't bound by the same incentives.

All my immediate family members are obese. I'm not (BMI 24.5, borderline overweight at the high end of normal, highest lifetime BMI was 29.5), but that's through strenuous, exhausting effort over decades. I also exercise regularly, though I've learned over time how disconnected exercise is from weight management.

At my weight, I'm not a candidate for going on a GLP-1. I'm sure I could find an unethical doctor to prescribe it if I looked hard enough, but I don't want to have the downsides hidden from me.

My weight has been steadily ratcheting up over the years, since I don't have as much room in my life as I used to for living with the discomfort of caloric deficit. If that continues, I will probably become a candidate for GLP-1s, like my immediate family members, just after a decade or so of possibly unneeded striving.

Lots of people are in situations far worse than mine, so I don't feel unlucky — but it would be nice if there were a clearer path forward. While lowering risk for Alzheimer's is not a priority for me, other effects of GLP-1s sound extremely enticing — especially reports of reduced food craving.

Yeah, I way overperformed on this test because it was multiple choice. There were 11 words I didn't know at all, and another 8 where I was uncertain to varying degrees. My score of 99/100 does not reflect my actual ability. Even the one I got wrong was a misclick.

> when I have my 2 programmers in office

I'd like to think that you see "my 2 programmers" as "my team" but I've come to expect phrasing like "when we have our 2 programmers in office". That perspective emphasizes that we're all in this together, rather than serfs working for the benefit of the lord.

The "my programmers" phrasing plays into my prejudice that one reason you like having "your programmers" in office is the exhilaration you feel in seeing them at your beck and call.

Indeed, passkeys would seem to represent a step forward from single-device to single-account.

What bothers me about the rest of this thread is not that "grunts" are seen as fallible, but that management is implicitly infallible. Blaming everything on the "grunts" is irresponsible garbage in an industry where leadership, of necessity, often doesn't have a deep understanding of what's going on and the ability to make generally correct decisions with incomplete information is a critical management skill.

You’d think from this thread that the messes inevitably originate from ”grunts” wandering off the reservation. In my experience the source has often been “innovation” imposed from above, in the form of buzzword-driven development championed by semi-technical leadership enamored of this poisonous “grunts can’t be trusted” ideology.

For what it's worth, I'm actually a senior IC who's cleaned up plenty of messes over decades and who enjoys migrating legacy systems. In my experience, it's the management-level architecture astronauts who don't understand loose coupling who do the most harm. The damage done by low level individuals can be contained if they're working on properly isolated subsystems (which of course requires competent management to set up).

And I'm cynical all right. I used to believe that I could be part of a "we're all in this together" team. But I've realized how rare that is after bad experiences at multiple companies where management sees an antagonistic relationship with engineering as inevitable — because they agree with you that "grunts can't be trusted".

> they are usually right.

This message encapsulates why so many software jobs are terrible. Put your heart and soul into doing your best, earnestly combat NIH and pursue meaningful productivity, and _still_ the culture is such that at many companies, there will never be trust because the prevailing culture is that management is "usually right" that grunts can't be trusted.

I've worked for good bosses that aren't like this, but they're hard to find.