Listen: YouTube · Spotify · Apple Podcasts
Summary
PHP is 31, runs most of the web, and finally made the front page of the Wall Street Journal. All it took was an unauthenticated remote code execution bug. Danielle opens with a goodbye: AWS is ending support for Infrastructure Composer, which grew out of Stackery, the startup she worked at. Chris walks through a week of vulnerabilities: an eMudhra CA private key that was the number 4, PHP2Shell and the Chainguard embargo fight, a Node.js RCE, and the Railway and TiDB breaches. Gunnar brings the one piece of good news, Lambda Web Functions, and asks whether serverless is still meant for humans to understand, or only for agents. And Ken looks at Claude Code agent teams and mods, which the docs say plainly aren't sandboxed.
Burst Mode: Danielle on Eric Mann's Longhorn PHP keynote, The Commit You Can't Take Back, and the day a PM added "destroy" to the dropdown. Chris on the crappy state of MCPs. Ken on recursive self-improvement and why you should write evals instead of prompts. And Gunnar on Mistral, which answered last episode's "are they still around?" with a trillion-parameter model named after a cat meme: Le Chonk.
Timestamps
Main topics
-
0:00: Intro, brought to you by PHP -
0:35: Check-ins: retro gaming, an MCP gateway, ProductFest -
3:49: Infrastructure Composer end of support (Danielle) -
12:28: The Vulnpocalypse: eMudhra, PHP2Shell, Node.js and more (Chris) -
29:57: Lambda Web Functions: is serverless still for humans? (Gunnar) -
42:24: Claude is teamin' and modin' (Ken)
Burst Mode
-
52:06: Burst Mode -
52:32: The Commit You Can't Take Back (Danielle) -
54:53: The crappy state of MCPs (Chris) -
57:03: Recursive self-improvement (Ken) -
1:00:48: Mistral is still around: Le Chonk (Gunnar) -
1:05:25: What we're looking forward to -
1:08:32: Wrap
Links
Check-ins
Infrastructure Composer end of support
- AWS: Infrastructure Composer end of support
- Danielle Heberling: Pour one out for Infrastructure Composer
- Kiro CLI 3.0
The Vulnpocalypse
- Chris's source: the Bluesky mega thread
- Google: compromised eMudhra intermediate CA certificates
- WSJ: AI found a bug that puts up to 70% of websites at risk
- PHP Foundation: today's security release
- AWS: PHP2Shell exploitation seen in MadPot before disclosure
- Socket: the PHP embargo dispute
- Node.js October 2026 security releases
- Railway security disclosure
- PingCAP (TiDB) security update
Lambda Web Functions
- AWS News Blog: Announcing AWS Lambda Web Functions
- Aidan Steele: Some notes on Lambda Web Functions
- Aidan Steele: Lambda Web Functions as queue consumers
- Bref: serverless PHP on AWS Lambda
Claude is teamin' and modin'
- Claude Code: agent teams
- Claude Code: mods overview
- GeekWire: Amazon blocks Meta's Muse AI assistant
- ABA: Ninth Circuit on Perplexity's Comet agent
- Forklog: OpenClaw deletes a Meta researcher's emails
The Commit You Can't Take Back
The crappy state of MCPs
Recursive self-improvement
Mistral Large 4 (Le Chonk)
- TechCrunch: Mistral's new 1T model
- Artificial Analysis: Mistral Large 4
- Decrypt: Le Chonk and the cat meme
- Crypto Briefing: Aleph Alpha Kolibri
Wrap
Hosts
- Gunnar Grosch: https://gunnargrosch.com
- Danielle Heberling: https://danielleheberling.xyz
- Chris Farris: https://chrisfarris.com
- Ken Collins: https://metaskills.net
Follow the show
- Website: https://yellsatcloudpod.com
- YouTube: https://youtube.com/@yellsatcloudpod
- Bluesky: https://bsky.app/profile/yellsatcloudpod.com
- Twitter / X: https://twitter.com/yellsatcloudpod
Top comments (0)