Developer, author, speaker & trainer. Author of many books & courses. Vanilla Web book! OpenAI Codex Ambassador. Google GDE. Español @maxifirtman @codemiadot
Buenos Aires, Argentina
Joined November 2008
- Tweets23.4K
- Following1K
- Followers29.2K
- Likes10.1K
Pinned Tweet
🔴 NEW BOOK 🔴
I’m writing a new book and the early access version (MEAP) is already available.
👉 50% off for a limited time
Includes continuous updates and the final version (print or ebook).
This is my 15th book 🙂
Link and details below 👇
Maximiliano Firtman retweeted
Just in case you needed a reminder, here is why half the internet still runs PHP.
Maximiliano Firtman retweeted
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
Maximiliano Firtman retweeted
Security called me at 6:12 AM today.
"Patch every PHP server immediately."
I asked what happened.
"Two critical vulnerabilities. Remote code execution. No authentication required."
Cool.
How many PHP servers do we have?
According to inventory: 12
According to reality:
Nobody knows.
We found one running WordPress.
Three running old internal tools.
One under someone's desk.
Two inside vendor appliances.
A forgotten employee directory from 2016.
And a server named:
PHP-OLD-DO-NOT-TOUCH
Naturally, that one runs payroll exports.
Then we found a PHP 5.6 box.
I asked who owned it.
The documentation said:
BRIAN.
Brian left in 2019.
We called Brian.
He said:
"Oh wow, that's still running?"
Excellent.
By 8 AM, leadership joined the incident call.
CEO:
"Can hackers actually get in?"
Security:
"Potentially yes."
CEO:
"Without a password?"
Security:
"Yes."
CEO:
"Then why do WE need passwords?"
Not the lesson.
Finance asked if we could wait until the weekend to patch because downtime affects revenue.
Security explained that the alternative was letting strangers execute code on our servers.
Finance asked for a cost comparison.
At 9:17, someone suggested temporarily taking the vulnerable websites offline.
Marketing refused.
"Our campaign is live."
So for the next hour, the company officially decided maintaining a landing page for 20% off webinar registration was more important than preventing remote server takeover.
We finally patched everything we could find.
Then our scanner discovered another PHP server.
Hostname:
TEMP-PHP-2014
Uptime:
4,512 days.
Nobody knows what it does.
Nobody owns it.
Nobody can shut it down.
But every time we block network access, the warehouse stops printing shipping labels.
Security has classified it as critical infrastructure.
It is running PHP 5.4.
The vulnerability has existed longer than half our employees.
The emergency patch took four hours.
Finding out what PHP actually runs took eleven.
The internet isn't held together with code.
It's held together with servers everyone is afraid to turn off.
Maximiliano Firtman retweeted
If you are wondering whether your website is affected, we have packaged a Codex skill to help check.
Point your Codex at this repo to guide you through it: github.com/openai/php2shell-…
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.
Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.
Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.
This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
openai.com/index/coordinated…
Readers added context they thought people might want to know
Wiz Research wasn't the first one to discover the exploit. An independent researcher first discovered it: x.com/calif_io/statu…
PATCH THE PLANET, TODAY: PHP 🐘
Today’s disclosed PHP patch is the product of AI research from Patch the Planet, a team led by OpenAI.
More info: patchtheplanet.org/
At least one vulnerability was found by GPT-5.6 Sol. openai.com/index/coordinated…
🔥 PHP SECURITY FIXES RELEASED
This is mandatory for every PHP service out there.
If you can't update it right now, there are some rules you can apply in the meantime. Older versions of PHP, not receiving security fixes anymore, are also affected.
php.net/archive/2026.php#202…
Maximiliano Firtman retweeted
The PHP project has released fixes for 2 critical vulnerabilities affecting servers that host PHP applications. Site owners and technical teams should confirm their hosting provider’s update plan and update PHP immediately. Versions before PHP 8.2 no longer receive security updates. These issues are not specific to WordPress, and no WordPress update is required. wp.me/pZhYe-5Gb
Maximiliano Firtman retweeted
The Internet goes on high alert after discovery of 8 compromised TLS certs arstechnica.com/security/202…
Welcome to the new era.
Maximiliano Firtman retweeted
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.
PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
👀
if this affects the default installation of PHP
We are fucked up
CVE-2026-109618
CVE-2026-109619
PHP RCEs with a CVSS score of 10.0 ☠️
news.ycombinator.com/item?id…
😬
🚨 Going out of business sale 🚨
iOS dev course sales plummeted due to AI. It costs a lot of money to host my courses online and with sales at basically $0, I've cancelled that hosting.
This closes down the site which unfortunately removes access to the courses.
I want you to have the courses you purchased forever, so I've added the ability to download my course videos so they are yours.
I've put my recent course on sale at a large discount so you can get it before it's gone and I've made old courses available for free if you want to grab those too.
The school will be online until November 24th so you have a few weeks to download these videos at seanallen.teachable.com
Thanks for learning with me and supporting my work over the years. I appreciate it.
Maximiliano Firtman retweeted
We've expanded Core Web Vitals to include special support for soft navigation (SPA)!
Since SPAs are handled differently in their implementation, they've required bespoke custom measurement, making it hard to compare directly across sites. Measuring performance is a little art, a little science. Over time, we've evolved CVW to best fit how the web is written, and we've found that giving SPAs their own unique metrics has had the best outcome.
More here, including access, and plans for SEO:
web.dev/blog/crux-experiment…
Maximiliano Firtman retweeted
The #1 unused feature of PWAs is screenshots for the installation dialog. Even big companies like Uber, X, Spotify and WhatsApp don't use them, and that's a shame.
Adding them to manifest.json displays a description and screenshots in the installation dialog in Chrome on Android and desktop.
Users are not (yet) familiar with installable web apps like they are with native apps. This makes the experience much more familiar and will help the adoption of PWAs 💪
Check the difference, tutorial link below 👇
😅
Chrome 155 adds support for JPEG XL (.jxl) → goo.gle/4yYpSjW
Expect 30-50% smaller file sizes than traditional JPEGs, native HDR, progressive rendering, and lossless JPEG transcoding.
Under the hood, Chrome uses jxl-rs, a pure Rust decoder built for maximum memory safety and performance.
Maximiliano Firtman retweeted
We launched OSS Scanner, which gives critical open source projects free, periodic vulnerability scans from our strongest models.
Each finding includes a proof-of-concept, and a patch where possible.
red.anthropic.com/oss-scanne…
Maximiliano Firtman retweeted
Head of Design at Stripe on how to stop creating zombie UIs
If we only use AI to make the things that we already make, just faster, then we're definitely missing out on the most interesting part.
From my talk at @lennysan’s Summit, here are four ideas for raising the ceiling, not just the floor:
- Have a point of view [5:38]
- Encode your standards into the machine [9:07]
- Don't confuse done with good [12:21]
- Unleash creativity and artistry [16:19]
Full talk here: youtu.be/GLvFTMtw4Jk?si=-5Ts…
🔴 FREE EBOOK
@ManningBooks has just published Modern Web Development, a free ebook. It contains one chapter from my upcoming book "Vanilla Web".
Get it here: blog.manning.com/free-ebook-…
Maximiliano Firtman retweeted
A few big upgrades for Chrome users today! We’re bringing the power of computer use to anyone who uses Chrome.
First up: ChatGPT can now use your tabs in Chrome to make answers more useful and get things done for you.
If you’re in Chat, it can look across your open tabs and gather info.
If you’re in Work, ChatGPT can control your Chrome tabs to get things, like sending messages, filling out forms, or downloading files. It can even help you organize and group that pile of tabs you have open.