// blog

Writing

Thoughts on AI engineering, developer tools, and building things that are actually useful.

·4 min read

PHP2Shell Explained: The Bug Under Most of the Web

PHP2Shell (CVE-2026-109618 and CVE-2026-109619): two decade-old PHP bugs, found with AI by two teams in a month. What happened, why it matters, and which versions fix it.

securityaiphpvulnerabilities
·7 min read

OpenAI Wants a Humanoid Robot. An LLM Won't Be Enough.

Robots can talk now, but they still can't pass the butter. The four things a useful robot needs besides a language model, and a rough idea for wiring them together.

airoboticsllmsagents
·5 min read

The Death of Software? What Actually Died

AI decompilation turned games and apps inside out in three weeks. Software didn't die. The lock did: the cost of reading a program you were only meant to run.

aisoftwarereverse-engineeringagents
·4 min read

AI Will Write Its Own Tests. Who Marks Them?

Once AI writes its own benchmarks, who marks the exam? We have already handed over the marking, the checking and sometimes the understanding. Two examiners are left.

aibenchmarksevaluationagi
·2 min read

Benchmarks Won't Measure AGI. They'll Lead to It.

No single benchmark can tell us when AI reaches human level. But every new benchmark covers a bit more of what we do, until AI is smart enough to write its own.

aibenchmarksagi
·3 min read

What If We Can't Switch AI Off?

Two thoughts on rogue AI: data centres in orbit that we can't unplug, and an AI with a heartbeat that never stops waiting for the next prompt.

aiagiai-safetyagents
·4 min read

How AI Replaced My Job (Not Really)

A year of shipping production systems without writing code. What actually changed in the job, what I learned, and the quiet fear underneath all of it.

aiengineeringcareeragents
·2 min read

Making Websites AI-Readable

How I built itsmesherry.com to be optimized for AI model ingestion: llms.txt, structured data, semantic HTML, and why this matters for the next era of the web.

aiwebseollms
·3 min read

Why I Built an AI Code Auditor

The story behind claude-audit: why existing code review tools fall short, and what changed when I stopped sending Claude a summary and let it read the code itself.

aisecurityopen-sourceclaude