I have no evidence beyond "source: trust me, bro", but if you're running PHP in production, be ready to update as a priority.

These CVEs reportedly relate to remote code execution in all affected PHP versions from PHP 5 onwards.

These are the two reserved CVEs for the reported upcoming announcement:

CVE-2026-109618

CVE-2026-109619

Comments URL: https://news.ycombinator.com/item?id=50167754

Points: 265

# Comments: 60

https://www.linkedin.com/posts/ali-hamie_im-an-engineer-at-m...

> I'm an engineer at Meta and I never felt this uncomfortable doing my job. I'm writing code these days and it all feels like a black box. This new standard of shipping with AI is moving so fast that if we're going to spend our time checking each line of code, it's going to take forever. That means you can end up with systems you've built where you don't truly understand how all the code works. You understand the high level, but not every detail. And maybe this is becoming the new standard. It goes against every instinct of being a software engineer. I'm used to understanding what I'm building. Now I'm trying to figure out how much I need to understand before I'm comfortable moving forward. Are other engineers feeling this too?

How are you handling this?

Comments URL: https://news.ycombinator.com/item?id=50151036

Points: 601

# Comments: 731

The platform prompted me for a payment. Since I am in a Spanish-speaking region where localized systems and keyboards handle dots and commas differently, I typed 5.04.

Anthropic’s input system completely failed to sanitize or validate the data. Instead of throwing a formatting error or converting it properly, it silently stripped the decimal internally and instantly charged my credit card $504.00 USD instead of $5.04 USD.

To make matters worse, there was no confirmation modal or review screen summarizing the final amount before processing the transaction. It was a single-click, instantaneous overcharge.

Anticipating the Obvious Skepticism: Before anyone suggests "you should have checked your regional settings" or "just wait for the chargeback":

1. Users are not the QA team: In financial software, a system is never supposed to guess or automatically manipulate a numerical input without explicit validation. If an input is ambiguous due to locale differences, the application must reject it or ask for clarification, not execute a 100x overcharge.

2. Scale of the vulnerability: This time it was $504.00, which is an unfair and frustrating burden for independent developers. But because this pipeline completely lacks a confirmation screen and basic input sanitization, the exact same bug could happen to someone typing 50.00 and end up charging them $5,000.00 or more instantly. It is a systemic financial risk.

3. The Chargeback Illusion: Yes, I have already initiated a chargeback with my bank in Costa Rica. However, banking processes here are slow and take up to 120 days to resolve. In the meantime, the $504.00 has already been deducted and charged to my credit card statement. I am forced to pay for Anthropic’s engineering mistake out of my own pocket right now.

The Support Wall: I filed an official complaint on the exact same day, minutes after it happened. I wasn't met with a human; I was blocked by an automated support BOT. The bot repeatedly and rigidly denied the refund, closing the ticket by citing generic policies without a single human ever looking at the fact that the overcharge was caused by a technical bug in their own platform.

As developers, we build systems that process people's money. Omitting a confirmation screen on a financial transaction, failing to sanitize localized numerical inputs, and then hiding behind unyielding AI support bots to keep money that doesn't belong to you is completely unacceptable.

If anyone from Anthropic's billing or engineering team is reading this, please look into this bug and review my case. It is a critical flaw that is actively harming international developers who are just trying to build on your ecosystem.

Pura vida!

R.S.G.

Comments URL: https://news.ycombinator.com/item?id=50121562

Points: 91

# Comments: 36

So far, I'm really struggling to see the value add of a junior engineer given how good the models have become. A senior with Max plan beats three junior hires (very rough estimate).

Having spoken with a few peers (founders), they have expressed similar feelings. I want to hire juniors and see them grow, but I feel my bar of expectations is at an all time high, and perhaps unrealistic.

Comments URL: https://news.ycombinator.com/item?id=50118474

Points: 13

# Comments: 27

But if the app is not even created by a programmer whats stopping prompt injection from including some virus in the app?

Aren't we completely blind to security issues at that point?

Comments URL: https://news.ycombinator.com/item?id=50090796

Points: 19

# Comments: 25

Personally, I'm stuck in Microsoft hell because Azure admin emails cannot be changed and support is both uncaring and powerless.

Comments URL: https://news.ycombinator.com/item?id=50089577

Points: 166

# Comments: 118

So much so that, a la industrial revolution, there will be lots of layoffs and SWEngs without a cause. This is obviously quite a pessimistic view of where the industry is going, and maybe I'm just looking for some reassurance or discussion - my question is at what point do a large amount of SWEngs have to find something else to do and re-train?

Comments URL: https://news.ycombinator.com/item?id=50085133

Points: 24

# Comments: 29

Comments URL: https://news.ycombinator.com/item?id=50085114

Points: 41

# Comments: 74

Given that LLMs are RL'd to the max with everything that can be given a wrong/right answer (code/maths), what currently is stopping Anthropic, OpenAI et al. from internally building (and maybe buying) datasets of good and bad architecture, and RL'ing that?

Given that LLMs were a fancy autocomplete back in 2024, and now people are talking about building "software factories" with the agents, what in your mind is the stop to this development? Why software architecture would be hard for agents still in a year or two?

Just thinking because I see more and more examples of software developers ignoring this and saying "humans still have a place in guiding the agents and designing the architecture". I think (businesswise) the need for actual software programmer skills is 90% out in a few years I think, and product lead etc people will be favored more as they have more people skills.

it was a good run.

Comments URL: https://news.ycombinator.com/item?id=50084969

Points: 45

# Comments: 83

There is nothing creative about AI. Show HN might as well be renamed “Prompt HN.” These promoters always say, “Prompting makes me efficient; I don’t have to write code by hand anymore.”

Great. What has your “efficiency” gotten you? Yet another note-taker with an “AI” suffix? I could take notes in 1990.

Where did the actual engineers go? Surely they aren’t all selling ads at Facebook’s spyware empire? Where are the transistor, the C programming language, Emacs, and SQLite developers of our time?

Comments URL: https://news.ycombinator.com/item?id=50081189

Points: 38

# Comments: 26

Comments URL: https://news.ycombinator.com/item?id=50067325

Points: 128

# Comments: 127

Comments URL: https://news.ycombinator.com/item?id=50049047

Points: 18

# Comments: 26

I have been flashing DD-WRT to my routers for many years. My current setup is an Archer C9 that connects via cable to an Archer C8, which then wirelessly bridges to an R7000. All of them run DD-WRT. If I had "fun money," I would buy a low-power SFF PC with dual NICs, run OPNsense or OpenWrt, and use the wireless routers strictly as access points. Since I don't have that much to spend, I look for older DD-WRT friendly routers, usually under $30, on Craigslist or Facebook Marketplace, and flash them myself.

I see that Ubiquiti and MikroTik make quality routers with proprietary OSes for around $65 new. Protectli and Netgate offer pfSense routers starting at $259.00. The GL.iNet Flint 2 is $169.00, and the OpenWrt One is $89.

According to ResellBot (because eBay now requires a login to see sold listings with prices), the sold "DD-WRT Routers" generally go for under $160. These include the WRT3200ACM, Netgear AC1750, Linksys EA9300, and Linksys R7350.

When I asked an AI how I would go about judging interest, building, raising funds, and manufacturing, it seems doable but expensive (said $125,000 minimum in total made up of $30,000 for regulatory approval, engineering and protoyping $10,000+) and time-consuming just to get to a "golden prototype" for demos.

So if I were a "hacker" and wanted an open-source router, depending on my funds, I would either:

1. Flash DD-WRT to an existing router (used or new).

2. Buy one with it already installed, like the OpenWrt One or a Protectli device.

3. Get an SFF PC and build my own.

I remember when some comments about DropBox said it was a waste because any hacker could make that. I also know DropBox was marketed to the average person and businesses. I don't really see how a hacker friendly router could take off like that unless hackers are choosing the hardware and setting up the networks for average people. And I assume that most people setting up the networks want different qualities like brand name recognition, ease and speed of purchasing equipment (Walmart or BestBuy), and the ability to point a customer or family member to the number of solid reviews and articles saying it a good router to qualify their choices.

So, do you actually want a router that you can buy with DD-WRT pre-installed?

Comments URL: https://news.ycombinator.com/item?id=50039291

Points: 162

# Comments: 151

Comments URL: https://news.ycombinator.com/item?id=50038458

Points: 58

# Comments: 155

Or do you think people should be allowed to just film anyone and everyone and upload it to YouTube, have everyone's faces scanned, etc? As currently in most places.

Comments URL: https://news.ycombinator.com/item?id=50038168

Points: 10

# Comments: 25

Comments URL: https://news.ycombinator.com/item?id=50037859

Points: 28

# Comments: 44

Comments URL: https://news.ycombinator.com/item?id=50029896

Points: 24

# Comments: 50

What about the third possibility? What if GPT 3.5 -> Sonnet 3.5 -> Opus 4.5 -> Astra / Opus 5.5 just keeps going for the next few years? Based on my experience, that will eat all software and software-related meetings. Once lab researchers focus on fields other than software, they will eat those nearly as quickly.

This feels like the real contrarian position in 2026. What does the US economy, which is >70% service-based, look like in the next 3 to 5 years, if this happens?

Does a couple labs having control of that percentage of the GDP make an economy? What if it happens too quickly? Is this the real reason why they are talking about "pacing the frontier" all of a sudden? Maybe this impossible "pacing" is due to the fact that the labs' own economists pointed out that collapsing your country's economy might not be a good idea?

What does unemployment look like in the next few years in this scenario, in the USA?

Comments URL: https://news.ycombinator.com/item?id=50020096

Points: 16

# Comments: 33

This summer she graduated from the University of Dar es Salaam with a degree in Language Studies, and last week she told me she'd been accepted into a Master of Arts in Swahili program there. Roughly 2% of people from Njombe ever finish a university degree. Her goal is to get a PhD and then to bring it back to the region.

Her entire 18-month master's program (tuition, registration, fees, books, supplies) comes to 3,060,000 TSh, about $1,161.

Since this worked out, I kept adding students as I could afford to, and in 2021 I registered it as a 501(c)(3), the Tanzania Education Project. It supports five students from Ibumila now, school fees and healthcare. I kept it small while I was finishing my PhD because I didn't want commitments I couldn't personally guarantee for a decade; I've since started a postdoc, so it feels like the right time to grow past my own paycheck. The long-term goal is that every kid in the village has access to education and healthcare. I sometimes think of this project as a slow experiment. How much could the village itself change over someone's lifetime if the kids have access to education?

https://tanzaniaeducationproject.org/ is the website. Nobody takes a salary, and aside from bank fees the money goes to the students. If anyone wants to fund Anwarite's master's specifically, it's here: https://www.gofundme.com/f/send-anwarite-to-her-masters-prog...

Happy to answer any questions or take any tips you all might have about doing this sort of thing.

Comments URL: https://news.ycombinator.com/item?id=50006366

Points: 778

# Comments: 245

Comments URL: https://news.ycombinator.com/item?id=50004396

Points: 13

# Comments: 27