transcript
show notes
PHP is 31, runs most of the web, and finally made the front page of the Wall Street Journal, thanks to an unauthenticated remote code execution bug. Danielle opens with a goodbye: AWS is ending support for Infrastructure Composer, which grew out of Stackery, the startup she worked at. Is AWS good at developer experience, and what happens to the startups that build it? Chris walks through the Vulnpocalypse: an eMudhra CA private key that was literally the number 4, PHP2Shell and the Chainguard embargo fight, a Node.js RCE, the Railway and TiDB breaches, and why long-lived access keys keep showing up in every incident. Gunnar brings the one piece of good news: Lambda Web Functions. Bring your own HTTP server, pay for active CPU, and every existing Lambda function is now an Event Function. It's the fourth Lambda compute model in under a year, so is serverless still meant for humans to understand, or only for agents? Ken looks at Claude Code agent teams and mods, the part of the docs that says mods aren't sandboxed, and Amazon blocking Meta's Muse agent from shopping.
Burst Mode: Danielle on Eric Mann's Longhorn PHP keynote, The Commit You Can't Take Back, and the day a PM added "destroy" to the dropdown. Chris on the crappy state of MCPs: one Google account per user, a Google Form to get access, and Copilot credits to read your own email. Ken on recursive self-improvement and why you should stop writing prompts and start writing evals. Gunnar on Mistral, which answered last episode's "are they still around?" with a trillion-parameter model named after a cat meme: Le Chonk.
Timestamps
0:00 - Intro, brought to you by PHP
0:35 - Check-ins: retro gaming, an MCP gateway, ProductFest
3:49 - Infrastructure Composer end of support (Danielle Heberling)
12:28 - The Vulnpocalypse: eMudhra, PHP2Shell, Node.js and more (Chris Farris)
29:57 - Lambda Web Functions: is serverless still for humans? (Gunnar Grosch)
42:24 - Claude is teamin' and modin' (Ken Collins)
Burst Mode
52:06 - Burst Mode
52:32 - The Commit You Can't Take Back (Danielle Heberling)
54:53 - The crappy state of MCPs (Chris Farris)
57:03 - Recursive self-improvement (Ken Collins)
1:00:48 - Mistral is still around: Le Chonk (Gunnar Grosch)
1:05:25 - What we're looking forward to
1:08:32 - Wrap
Links
Infrastructure Composer end of support
PHP Foundation on the PHP2Shell release
Socket: the PHP embargo dispute
Google on eMudhra
Announcing Lambda Web Functions
Aidan Steele on Lambda Web Functions
Claude Code agent teams
Claude Code mods
The Commit You Can't Take Back (Eric Mann, Longhorn PHP)
agentgateway
Anthropic: When AI builds itself
Mistral Large 4 (TechCrunch)
Node.js October security releases
AWS: PHP2Shell seen in MadPot before disclosure
Aidan Steele: Web Functions as queue consumers
Bref: serverless PHP
Amazon blocks Meta's Muse (GeekWire)
Full show notes, all sources and the transcript: yellsatcloudpod.com
