I'm about three-quarters of the way migrating my application infrastructure from ArgoCD to Flux, and man, is it difficult. I had to use both Claude and ChatGPT pretty extensively to parse the absolute mountain of error logs I was getting and correct the pile of bugs that I had inadvertently introduced while setting it up the first time around.

I'm too far into this process to back out, but just in case I finish this process and then realize that I actually didn't want to migrate, which platform is actually used more commonly in the industry, so I should actually spend more energy learning it?

Note, even though I do mention that I used two AI models quite a bit, I only used them for parsing logs and deciding what to do. All of the code is actually handwritten.

A friend of mine owns a restaurant, and one of their employees was responsible for managing the website and domain.

Unfortunately, the employee forgot to renew the domain, and it expired. Someone else has since registered it. i guess it was on autobuy as it was gone the same day. On Godaddy.

The new owner kept a copy of the restaurant's original website, including its branding and content, but added gambling links throughout the site.

The website still looks like it belongs to the restaurant, which could mislead customers and potentially damage the business's reputation.

Is there a way to recover the domain or force the new owner to remove the restaurant's content?

Has anyone dealt with something similar? Any advice would be appreciated

I'm researching how freelancers and small agencies who sell websites to local businesses prospect today.

If you've sent a prospect an AI-generated redesign preview (instead of only an audit or a plain message):

1) What tool or workflow did you use?

2) Did it raise your reply rate compared with a normal message? Roughly how many did you send and how many replied?

3) What annoyed you (quality, cost, time per prospect)?

4) Which channel do you use to reach local businesses (email, WhatsApp, Instagram DMs, calls)?

Disclosure: I'm exploring a possible tool in this area, so I'm biased. I'm not selling or linking anything here.

I have a WordPress website used to booking appointments and this was created by a company. I hired a while back.
Now I want to redesign the website, but I’m a complete beginner.
I want to test my ideas without affecting the live website. Should I use staging or duplicate
Elementor draft? ChatGPT says duplicating has more risks, but it seems like I have to pay for staging.

So I do believe that web dev has changed dramatically in the last year or so and that one probably needs to expand their skills and a front end web developer is probably less of a safe long term career than I believed in the past due to AI. This is a shame as I loved the craft and challenges of front end development.

when I see online everyday how AI is going to remove the need for devs I do tend to end up believing this is the case. But then in my day to day job I see that this just isnt the case.

there have been a few recent examples. So people believe you can one shot things. Like the recent adobe reverse engineering. It looks great at first sight as the UI looks like adobe. All of a sudden you believe adobe will be out of business but when you try it out it full of bugs and doesn’t Really work, essentially smoke and mirrors. Also you look at the code and realise it’s completely unmaintainble due to bad decisions made up front by people who aren’t really experts in web development.

there is something I was thinking about also, when non technical people say “oh but the app already works, what do you actually do at work all day”. It kind of sounds true but in reality it is so far rrom the case - there are always bugs to fix, features to add, packages to update. sure, ai can help with this, but in a big app for example a package update can break something, Claude wont neccessarily catch this, but it will be us Mere mortals who will get a call and need to fix this.

also I have seen vibe coded projects where non experts in managerial roles who are creating software, which they are so proud of despite having no idea how it actually works. Then things start going wrong and things are breaking, it’s not the manager who is fixing it but the devs have to. and since the code has no owner and it’s a complete mess everyone is just one shotting the fixes and adding to the pile of 💩

this post is a little scattered but I’m hoping it makes some sense and people can see what I’m trying to get at

When RoadRunner 3 came out, some people took it as the beginning of the end. Right here on r/PHP:

So EOL for RR soon?

Rumors travel fast, and by now some folks are pretty sure RoadRunner is dead.

Well. Tomorrow is Halloween, and that's a chance to resurrect RoadRunner. 🎃

So I made an interactive pixel-art quest for it. It's a multiplayer game: you make a little pixel character, and everyone's characters walk around the same shared scene, so you see what the others do in real time.

The bar is already open: https://halloween.roadrunner.dev

It starts in a viking bar. The owl behind the counter swears RoadRunner can be brought back: something about pumpkins, a ritual, and a magical place nearby. Grab a mug, find someone to clink with (no clink, no drink: house rules), shoot some flies and listen to the owl's gossip.

🪰 Rumor has it that everyone who swats 100 flies before the ritual starts will get a superpower.

🕓 Saturday, Oct 31, 16:00 UTC: the ritual

Your local time

That's when the doors to the pumpkin patch open and we go through the whole story together, live, with the owl leading the way. What happens after that… you'll have to be there. No spoilers.

Join the crowd, clink mugs with strangers and help with the ritual 🍺

Missed it? Play it again. And again.

After the live event I'll step down as the game master and switch the game to autopilot for a week. No moderator needed: hit the goal of a scene and the story moves on by itself. Bring your friends and play the whole thing from the bar to the very end, then start over, as many times as you like.

You don't need to play. Watching is fine, and it works on your phone. More people means a bigger ritual and more beer.

How it works

The backend is PHP. The stack:

• PHP with the Spiral framework
• RoadRunner: HTTP, KV, locks, jobs, metrics (no nginx)
• Centrifugo for WebSockets
• Valkey and in-memory KV storage
• Prometheus and Grafana
• PixiJS on the frontend

All of it runs on one VDS: 2 × 3.3 GHz CPU, 2 GB RAM, 15 GB NVMe. By my estimate that's enough for about 200 active players. Let's find out tomorrow 😈

How it all fits together, with diagrams and code: https://halloween.roadrunner.dev/how-it-works

Live metrics in Grafana: https://halloween.roadrunner.dev:3000/d/hellowin/hellowin

Yes, the irony of running "RoadRunner is dead" on RoadRunner is intentional.

See you at the bar. 🍺🎃

GoDaddy's customer support is the worst. I have worked in customer support for various software firms for almost thirty years and I know what customer support should be. GoDaddy's attitude towards their customers can be summed as 'get lost.'
I have been unable for several days to log in to GoDaddy. I waited, thinking it would clear up but it didn't, so I finally contacted customer support. Customer support turned out to be an AI bot that said the problem was my browser (Chrome) and suggested several workarounds that didn't work. When I finally got in touch with a human he put me on hold for 30 minutes and then hung up. I called back and was put on hold for so long when someone finally answered, I'd forgotten what I was calling about so I just said I wanted to close my account. He gave me a different number to call and when I called that there was no answer. I'm disgusted.
GoDaddy may be alright if you're highly technical and don't need assistance, but it's a very hard system to use and there are many bugs which they refuse to fix. It's also very expensive compared to alternatives. The smartest thing to do is to stay as far away from GoDaddy as possible.

I'm probably like a lot of you who have tried lots of crms and inevitably fall back to old patterns, or get so behind on logging notes and activity that I dread going back in. I think I finally solved this forever for me.

I have Claude review my emails and proposals three days per week, then follow some instructions about making recommendations for updates to companies, people, and deals. Then in the morning when the notification comes in I just look through the list, confirm or ask for adjustments, and then let Claude do the updating.

Honestly, I haven't spent much time in the CRM interface in a while! And I'm so happy about it. Because my records and data are spotless, and the grunt-ish work of updating is all handled by Claude. For now that data is becoming more useful because I use it as context for Claude to do more research and other things.

I can't see myself ever going back to manually using a CRM with the exception of some special occasions, like setting up different kinds of lists or workflows for special pushes or new product releases or things like that.

• YouTube Preview: https://www.youtube.com/watch?v=4zbtD8bmw7E

It had to happen eventually, didn't it? =)

I've been voluntold to analyse our Datadog costs because our bills keep going up, and we're paying extra for new features if we go over the committed spend. It's a bit mismanaged across the org. Naturally, I need billing data to do the analysis (and do some MI outside of Datadog).

These endpoints all return 403 Forbidden:

• /api/v2/usage/historical_cost
• /api/v2/usage/estimated_cost
• /api/v2/cost_by_tag/monthly_cost_attribution

I'm an Admin with all relevant billing and usage permissions. Other usage endpoints work fine, and I can see usage data in the UI.

We buy Datadog through a reseller, and I suspect our organisation is a child org under the reseller's parent org. I think that explains why I can't access historical cost data through the API.

Our reseller has gone quiet for quite some time. I've contacted Datadog Sales and Support (I have no idea why we have a direct connection via a shared Slack channel even though we're not direct customers), but they've basically ghosted me.

We're paying for the service, our bills are increasing, and I'm trying to understand where the money goes. Why is accessing our own cost data such a nightmare?

Has anyone dealt with anything similar?

Hello WordPressers :)

I was tasked to look into two compromised WordPress sites. The people who own them, tried to remove the virus but failed. I wanted to describe what the virus was doing.

Overall this is a self-propagating, self-healing, obfuscated, hidden executor virus with size-padding evasion tactics.

It generated the following files and directories:

• /home/foobar/public_html/wp-content/.sc_494g1672
• /home/foobar/public_html/wp-content/.gk_eb46c3gc
• /home/foobar/public_html/wp-content/.kk_cb505c82
• /home/foobar/public_html/wp-content/ab743742.zip
• /home/foobar/public_html/wp-content/uploads/2026/10/ab743742.zip
• /home/foobar/public_html/wp-content/plugins/agile-beacon-go
• /home/foobar/public_html/wp-content/plugins/hyper-proxy-cue
• /home/foobar/public_html/wp-content/plugins/nexus-curator-rig
• /home/foobar/public_html/wp-content/plugins/swift-keeper-dex
• /home/foobar/public_html/wp-content/mu-plugins/.bt_hyper-proxy-cue
• /home/foobar/public_html/wp-content/mu-plugins/.pv_hyper-proxy-cue
• /home/foobar/public_html/wp-content/mu-plugins/.sd_hyper-proxy-cue
• /home/foobar/public_html/wp-content/mu-plugins/.swm_hyper-proxy-cue
• /home/foobar/public_html/wp-content/mu-plugins/hyper-proxy-cue.php
• /home/foobar/public_html/mu-plugins/hyper-proxy-cue.php

Each compromised site received its own hash, thus the ab743742 you see above is the unique hash for this compromised site. The value re-appears in several places.

The virus infects the functions.php of the current theme, it adds a variable with the contents of the ab743742.zip file. When the site runs, the variable contents are gzdecode'ed gzinflat'ed and stored as the above zip file, which gets extracted under the plugins directory.

The virus generates a self-preserving "must-use" plugin under the mu-plugins directory.

The virus creates its own admin user in the SQL table wp_users and modifies WordPress files so that its own admin user is invisible.

Finally, the virus creates the .sc_[HASH VALUE] directory under wp-content which stores a specially crafted PHP cli script. This script is executed via exec() or other similar function, once its loaded the script deletes itself so it only remains resident in memory. This monitors all the above files and re-generates the whole infection.

At first glance, the virus tries to access a master server and receives instructions. In this case, it started adding hidden URLs inside the generated WordPress pages.

A few interesting things about this virus:

• It uses token_get_all() to validate its own PHP syntax before making modifications to the site, so that does not corrupt the site and get noticed.
• It uses function_exists() to test for various functions, so it can understand what it can do to its host server.
• It generates a padding size for modified files, so that it matches the target size and avoid detection from scanners that check file size.
• It generates various "sidecar" files with quality markers in MD5, a version file, rate limits (regenerate itself every 4 minutes) and a write race/lock flag.
• It executes hidden commands from wp-content/.sc_[HASH VALUE}.php files that act as commands imported from its master control server.

The following strings can used to grep/search for the infection:

• SCV:
• SC_TH_BEGIN
• hyper-proxy-cue
• _sc_fam
• _sc_commit

Let me know if you need more details!

EDIT with information about the plugin*

The plugin has its own replication and cleanup code. It detects the presence of itself by looking for the string /* SCV:x.x.x */ where x.x.x is the version number of the virus. If there is a newer version then it overwrites itself.

It replicates by scanning various directories like /home, /var/www. It also modifies advanced-cache.php and object-cache.php.

The main code does:

• List Ethereum JSON-RPC endpoints and contract addresses.
• Receives an Ethereum contract with remote commands.
• It sends server information like domain, plugins, admin users+passwords, session cookies, etc.
• It receives remote code and executes it.
• It has some obfuscated code to detect legitimate plugins, it modifies some of them.

Interestingly, it uses wp_generate_auth_cookie() to generate an admin session that sends this back to its control server, thus the attacker can login to wordpress without knowing the password of the admin.

On the front-end side, it adds Javascript code that runs its own Service Worker for intercepting web traffic.

It does various other things that I can't be bothered to write about :)

Hello PHPers :)

I was tasked to look into two compromised WordPress sites. The people who own them, tried to remove the virus but failed. I wanted to describe what the virus was doing.

Overall this is a self-propagating, self-healing, obfuscated, hidden executor virus with size-padding evasion tactics.

It generated the following files and directories:

• /home/foobar/public_html/wp-content/.sc_494g1672
• /home/foobar/public_html/wp-content/.gk_eb46c3gc
• /home/foobar/public_html/wp-content/.kk_cb505c82
• /home/foobar/public_html/wp-content/ab743742.zip
• /home/foobar/public_html/wp-content/uploads/2026/10/ab743742.zip
• /home/foobar/public_html/wp-content/plugins/agile-beacon-go
• /home/foobar/public_html/wp-content/plugins/hyper-proxy-cue
• /home/foobar/public_html/wp-content/plugins/nexus-curator-rig
• /home/foobar/public_html/wp-content/plugins/swift-keeper-dex
• /home/foobar/public_html/wp-content/mu-plugins/.bt_hyper-proxy-cue
• /home/foobar/public_html/wp-content/mu-plugins/.pv_hyper-proxy-cue
• /home/foobar/public_html/wp-content/mu-plugins/.sd_hyper-proxy-cue
• /home/foobar/public_html/wp-content/mu-plugins/.swm_hyper-proxy-cue
• /home/foobar/public_html/wp-content/mu-plugins/hyper-proxy-cue.php
• /home/foobar/public_html/mu-plugins/hyper-proxy-cue.php

Each compromised site received its own hash, thus the ab743742 you see above is the unique hash for this compromised site. The value re-appears in several places.

The virus infects the functions.php of the current theme, it adds a variable with the contents of the ab743742.zip file. When the site runs, the variable contents are gzdecode'ed gzinflat'ed and stored as the above zip file, which gets extracted under the plugins directory.

The virus generates a self-preserving "must-use" plugin under the mu-plugins directory.

The virus creates its own admin user in the SQL table wp_users and modifies WordPress files so that its own admin user is invisible.

Finally, the virus creates the .sc_[HASH VALUE] directory under wp-content which stores a specially crafted PHP cli script. This script is executed via exec() or other similar function, once its loaded the script deletes itself so it only remains resident in memory. This monitors all the above files and re-generates the whole infection.

At first glance, the virus tries to access a master server and receives instructions. In this case, it started adding hidden URLs inside the generated WordPress pages.

A few interesting things about this virus:

• It uses token_get_all() to validate its own PHP syntax before making modifications to the site, so that does not corrupt the site and get noticed.
• It uses function_exists() to test for various functions, so it can understand what it can do to its host server.
• It generates a padding size for modified files, so that it matches the target size and avoid detection from scanners that check file size.
• It generates various "sidecar" files with quality markers in MD5, a version file, rate limits (regenerate itself every 4 minutes) and a write race/lock flag.
• It executes hidden commands from wp-content/.sc_[HASH VALUE}.php files that act as commands imported from its master control server.

The following strings can used to grep/search for the infection:

• SCV:
• SC_TH_BEGIN
• hyper-proxy-cue
• _sc_fam
• _sc_commit

Let me know if you need more details!

EDIT with information about the plugin

The plugin has its own replication and cleanup code. It detects the presence of itself by looking for the string /* SCV:x.x.x */ where x.x.x is the version number of the virus. If there is a newer version then it overwrites itself.

It replicates by scanning various directories like /home, /var/www. It also modifies advanced-cache.php and object-cache.php.

The main code does:

• List Ethereum JSON-RPC endpoints and contract addresses.
• Receives an Ethereum contract with remote commands.
• It sends server information like domain, plugins, admin users+passwords, session cookies, etc.
• It receives remote code and executes it.
• It has some obfuscated code to detect legitimate plugins, it modifies some of them.

Interestingly, it uses wp_generate_auth_cookie() to generate an admin session that sends this back to its control server, thus the attacker can login to wordpress without knowing the password of the admin.

On the front-end side, it adds Javascript code that runs its own Service Worker for intercepting web traffic.

It does various other things that I can't be bothered to write about :)

I also posted this in /r/Wordpress but the post was removed by the moderators, so I'm posting on /r/PHP to raise awareness

Escucho a mucha gente decir que la economia esta mal, pero a mi parecer la economia esta "normal" solo que la gente quiere comparar los tiempos normales a los picos de abundancia economica.

Ejem: comparar los tiempos de ahora con los tiempos de martinelli, osea 2009 que se podria decir que eran un par de años de mucha abundancia, ya que la economia global estaba saliendo de un receso

Eso, agregándole a que las personas hoy en día quieren gastar como si aun estuviéramos en esos tiempos les hacen pensar que las cosas estan "mal" .

No es por nada, pero el poder adquisitivo, siendo los bienes raices la excepcion, ha aumentado a comparacion de hace 20-30 años atras.

Y tambien, Panama no ha tenido una recesión economica fuerte fuerte como la han tenido otros paises

Esta consulta quizá sea un poco boba; pero ante la duda prefiero no dudar.

Básicamente me gustaría saber si compró snacks en algun chinito antes de ir al aeropuerto, podré entrar con ellos al avión? Digamos que van en mi mochila de artículos personales.