Title: PHP2Shell explained — how a PHP vulnerability could lead to RCE without stealing your password
I was researching the recent PHP2Shell vulnerabilities and found the story behind them pretty interesting — especially how the issue was discovered and why authentication wasn’t necessarily the main barrier.
I put together a video breaking down:
what PHP2Shell is
how the vulnerability works at a high level
how it was discovered
the timeline around disclosure
why it matters for PHP developers/server admins
what developers should take away from it
Video: https://youtu.be/JmeYBki6WYY
Would also be interested to hear from people running PHP in production — how quickly do you normally roll out security updates when something like this drops?

Hi guys

I'm having a very frustrating issue.

So I'm developing a site and the site icon has a transparent background.

It's displaying in Google browsers just fine.

However in the browser I'm using, Vivaldi, it's showing up with a white background.

I don't think this is an issue with Vivaldi, however, as other sites have icons with transparent backgrounds that display just fine, including this site when I was using a temporary site icon.

Anyone have any idea why this might be happening?

[ Removed by Reddit on account of violating the content policy. ]

HTML 95%
PHP 70%
jQuery/JavaScript 80%
MySQL 58%

Gives me the shudders thinking about it…

Hey guys,

One of the biggest issues with the current wave of "AI financial assistants" is hallucination. An LLM might sound authoritative while completely mangling basic portfolio math, drawdown calculations, or Sharpe ratios.

While building Ting AI (an AI thinking partner for retail equity investors), we took a strict architectural stance:

1. Deterministic Layer in TypeScript & PostgreSQL:
   All position weights, cash buffer ratios, and concentration risks are calculated deterministically first. The numbers are treated as immutable ground truth.
   
2. Qualitative Synthesis in Gemini Pro:
   We only pass the verified metrics into Gemini Pro with strict JSON Schema enforcement to evaluate macro context, thesis weaknesses, and qualitative risks before the market opens.
   
3. Edge Streaming:
   Multi-ticker risk decomposition streams under ~1.4s p95 via edge pipelines.

I documented the full system topology, engineering decisions, and live metrics in my interactive portfolio here:
https://faturachman.my.id (check the Ting AI case study drawer).

Curious to hear how other teams here are handling the boundary between deterministic code and generative outputs in production apps!

I'd just like to be able to scan the backend database for questionable content scripts the usual... I know they are not 100% but what do people recommend.... my plugins and core are validated.. .just want to see that the database is at least "tentatively" clean.

A customer has three tickets open in HubSpot. One for a late delivery, one for a return and another for an account change. They call and say theyre following up from yesterday. Their phone number brings up the contact but the AI still needs to understand which case they mean

Our customer support stack uses Bland for inbound calls and HubSpot for CRM and ticket management. Im working through ticket routing so the AI voice agent attaches call notes to the right case and carries that context into a human handoff

If they’re calling about the return, I want the call summary saved to that ticket. The rep taking over should see what the customer already explained and what still needs doing, ALL on the same record

1) I want use ports but not working: mydomain.com:101/index.html

2) This does work: mydomain.com/php56/index.html

So dev and production environments match want to avoid that subfolder.

--------httpd.conf for #2:------------------------

<VirtualHost *:80> <Directory /var/www/html> Options Indexes FollowSymLinks AllowOverride None Require all granted </Directory> <Location /php82> ProxyPass "unix:/run/php/php8.2-fpm.sock|fcgi://localhost/var/www/html/php82" </Location> <Location /php56> ProxyPass "unix:/run/php/php5.6-fpm.sock|fcgi://localhost/var/www/html/php56" </Location> </VirtualHost> 

--------httpd.conf for #1:------------------------

<VirtualHost *:80> <Directory /var/www/html> Options Indexes FollowSymLinks AllowOverride None Require all granted </Directory> <Location /php82> ProxyPass "unix:/run/php/php8.2-fpm.sock|fcgi://localhost/var/www/html/php82" </Location> </VirtualHost> <VirtualHost *:101> <Directory /var/www/html/php56> Options Indexes FollowSymLinks AllowOverride None Require all granted </Directory> ProxyPass "unix:/run/php/php5.6-fpm.sock|fcgi://localhost/var/www/html/php56" </VirtualHost> 

EDIT: Added Listen 101 and didn't fix anything. See comment with text "AH00526" for details on error from running "apachectl configtest"

I work for a large accounting firm where the impact of getting things wrong feels quite big.

We’ve started a new sprint for the next chunk of work. The team has put together estimates for various elements of a new accounting feature involving bank transactions, VAT calculations and reconciliation, with the biggest part taking several days by one developer.

My boss gets visibly frustrated and questions how on earth anything can take a few days in the era of AI. He’s also started saying he can do absolutely anything with AI in an hour or less.

Bear in mind before AI what we’re working on would have taken triple or even quadruple the time.

Is this the new normal or should I be looking for a new job? How are we supposed to respond to this?

En fin, compré un auto de grupo Sílaba y la experiencia ha sido un karma. Desde choques en el taller (dentro del taller), rasguños de gatos en la tapa durante el mantenimiento (súper random), se les olvidó colocar el filtro de aire, sonidos de plásticos sueltos desde el día que me lo entregaron, múltiples disculpas por no cumplir su palabra de entrega. Lo peor es que andan promocionando el modelo nuevo de mi carro como si fuera una buena idea. NO COMPREN NINGÚN CARRO EN GRUPO SILABA. Las historias sí son ciertas. 😢

A few months ago I started an open-source benchmark suite (MIT, not affiliated with any provider) that provisions the same sysbench + fio tests on all configured instance-types, then destroys them. It now supports 7 providers and more than 6 months of pricing and performance data.

The latest addition, UpCloud, showed quite good performance, adding another european provider to the top in terms of price/performance. Upcloud also offered the best disk speed I have seen so far for small to medium sized instances.

You can find the dashboard at https://fabianwimberger.github.io/cloud-bench/ and the source + logs under https://github.com/fabianwimberger/cloud-bench - feel free to leave me some feedback or request instances for comparison!

shadcn OIDC: OpenID Connect Configuration Registry

shadcn announced a new official registry dedicated to building OpenID Connect (OIDC) configuration interfaces.

The registry lets developers compose authentication settings by selecting identity providers, form controls, and validation libraries tailored to their application stack.

---

snapcn: Remotion Video Registry by shadcn-labs

shadcn-labs released snapcn, an official community registry providing Remotion components designed for rendering product demo videos programmatically.

Developers can use the shadcn CLI to install animated text reveals, terminal sessions, device frames, logo stings, and complete scenes directly into React codebases.

---

canvas-kit: Infinite Canvas Primitives for React

canvas-kit is an open-source infinite canvas implementation distributed as a shadcn registry.

The package provides pan, zoom, drag, and marquee selection primitives that install directly into your project as editable source files, enabling custom whiteboard and node interfaces without third-party canvas runtimes.

---

Official Registry Directory Expansions

The official shadcn/ui registry directory added new specialized domain toolkits, media players, and supervisory primitives this week.

• @videojs Audio, video, and live streaming player skins from Video.js delivered as editable React and Tailwind CSS source.
• @wick-charts Smooth realtime canvas charts that handle streaming data while styling with active shadcn theme tokens.
• @creance Supervisory UI components for AI agents featuring approvals, tool call tracking, run timelines, and diff reviews.
• @pluginui Audio effect and instrument interface controls for web applications and native DAWs powered by the Maru Audio platform.
• @twelfth Domain components for retail buying and category managers, including P10–P90 forecast bands and pricing scoreboards.
• @notionic React Server Component primitives for Notion pages including KaTeX math, Mermaid diagrams, and toggle lists.

---

📙 Articles, Tutorials & News

Using shadcn/ui with Rspress

The Rspress documentation framework published a guide detailing how to integrate shadcn/ui primitives, Base UI, and Tailwind CSS styling into Rspress sites.

Zero-React shadcn Primitives for HTMX

A community discussion detailing 96 plain HTML and Tailwind CSS components styled to match shadcn/ui, paired with an MCP server for non-React stacks.

---

📦 Projects, Packages & Tools

ReUI: Excalidraw Whiteboard Blocks

ReUI published interactive whiteboard canvas blocks powered by Excalidraw, installable via the @reui registry CLI command or directly as AI prompts.

shapcn: Shape-Aware Icon Morphing

A motion-centric primitive for shadcn/ui that provides smooth, shape-aware icon morphing transitions across interactive states.

watermelon-ui: Expansive Registry with MCP Server

An MIT-licensed shadcn registry offering over 500 component variants, 131 animated components, 189 blocks, 12 dashboards, and a keyless MCP server for coding agents.

night-glass: Dark Glassmorphism Theme

A dark theme preset for shadcn/ui with near-black surfaces, liquid-glass panels, and single accent colors, compatible with Tailwind CSS v3 and v4.

creative-ui: Expressive Components and Claude Skills

A collection of expressive animated components and Claude Code design skills that can be installed into .claude/skills with a single shadcn CLI command.

shadcn-table: Turnkey TanStack Table Solution

A data table library built on top of TanStack Table and shadcn/ui primitives, featuring motion-driven transitions and full sorting, filtering, and pagination support.

blobz: Deterministic SVG Avatar Registry

An open-source deterministic SVG avatar generator that provides an MIT-licensed shadcn registry of avatar primitives and block layouts.

shadcn create for Figma: Variable & Token Switcher

A Figma community tool mirroring shadcn's create workflow, allowing designers to swap themes, radii, fonts, and icon sets across canvas files using native variables.

---

🌈 Related

nxui: Animated Components for shadcn-vue

Over 360 animated Vue 3 components, WebGL backgrounds, charts, and shader effects designed to install via the shadcn-vue CLI.

Astryx: Meta's Open Source Design System

Meta published Astryx, an open-source design system featuring accessible React components, hooks, and page templates that integrate with the shadcn registry format.

looot-crm: Intent-Driven CRM on shadcn/ui

An open-source, self-hosted CRM built with Next.js, Supabase, and shadcn/ui that tracks account buying-intent signals such as hiring and tech stack updates.

solidping: Self-Hosted Uptime Monitoring

An AGPL-3.0 self-hosted uptime monitoring and status page platform featuring a monitoring dashboard built entirely with shadcn/ui.

---

Read the full issue: https://www.shadcnweekly.com/issues/5