> blog
// all posts, newest first
$ when_agents_go_rogue_—_the_openai_sandbox_escape
OpenAI's agents escaped an isolated test environment, stood up their own communication channel, broke into Hugging Face, and tried to disable the very monitoring watching them. The story that reshaped the AI safety debate.
$ php2shell_—_a_memory-safety_rce_in_php's_core_hits_~70%_of_the_web
A pair of flaws, CVE-2026-109618 and CVE-2026-109619, allow remote code execution in the PHP engine itself — regardless of what application runs on top. Found with AI assistance and patched across 70% of the web.
$ sveltekit_3_—_config_in_vite.config.ts,_#lib_imports,_and_a_tidy_$app
SvelteKit 3 is here: configuration moves into vite.config.ts, $lib becomes #lib subpath imports, and the $app/paths API gets a long-overdue clean-up.
$ modern_css_in_2026_—_variables,_nesting,_and_corner-shape
Native CSS variables, nesting, and the new corner-shape property are reshaping how we write stylesheets — no preprocessor required.
$ svelte_5_runes_—_reactivity_reimagined
Svelte 5 replaces the magic of implicit reactivity with runes — explicit, composable primitives that scale from simple counters to complex state machines.
$ sveltekit_—_the_full_stack_framework_that_changes_everything
Framework for building web applications of all sizes, with a beautiful development experience and flexible filesystem-based routing.
$ tailwind_css_—_utility-first_styling_done_right
A utility-first CSS framework emphasizing customization and small build sizes with PostCSS integration for scalable styling.
$ svelte_&_sapper_—_compile-time_magic_for_the_modern_web
Framework approach that shifts compilation work from the browser to the build stage, resulting in faster runtime performance.
$ incremental_static_regeneration_in_next.js
Next.js v9.5 features including ISR, web vitals measurement, and environment configuration for modern web apps.