Been throwing code into editors for 20+ years. Automating things. PHP contributor. World citizen. Migrant. Annoying. Tweeting for myself.
Joined May 2009
- Tweets10K
- Following308
- Followers590
- Likes8.2K
Pinned Tweet
🎉 Introducing `refactorlah` CLI -- fully open source.
Agents are surprisingly bad at renaming/moving files.
They are doing `git mv`s, then dozens of `grep`s, then hand-editing imports/namespaces/references while burning tokens and wasting time on tiny refactors.
The `refactorlah` CLI gives them one boring command instead:
`refactorlah move A B` or in bulk `refactorlah move --use-list A,B tests/A,tests/B`
Then file/s are moved, and namespaces, imports, references, etc. automatically updated.
Ambiguous renames are skipped and reported, so the agent can follow up manually instead of guessing.
Support for Go, Python, PHP, Symfony, Twig is landed.
A PR for JavaScript, TypeScript, Vite etc. is open.
I built and dogfooded `refactorlah` over the last few weeks. It works better for me than keeping an MCP server running in an IDE or making agents struggle through long tool-call chains for basic moves.
Still in alpha! Experimental, built with my best buddy Codex, and still dogfooding.
More eyes -> more dogfooding -> releasing early.
What do you think?
This blew up. 😅 Anyway, if you work at a company that makes decent money off of PHP tell your boss to consider sponsoring the PHP Foundation: @ThePHPF 💜
Rich guy who cheaps out with 4 subscriptions instead of paying API prices is mad that plebs get resets.
all these resets done by @thsottiaux is destroying the brand of openai. it turns the brand into $2 bargin basement option.
How likely is it that no one in 20 years has been using the PHP vulnerability? Someone out there is probably pretty pissed. 🫠
Hetzner sent out a reminder to dedicated and cloud server users, to remind them that security is on them. Mail sounds like they talk to someone who runs root servers by accident. First I laughed, then I remembered vibe coders.
My Codex usage is back to normal. Kinda expected I was one of the 40,000 affected accounts. But I did not get any mail or credits. So I guess I got just ripped off undetected for a few days. It's fine. 🫠
Spent two full days on PHP security. One day emergency work, another on some additional hardening. That's 2 days for 2026. It's almost November. Two days are roughly 293 days less than what average Node devs spent on supply chain attacks this year.
Nick e/code retweeted
Of course it'd be better to have vulnerability in PHP at all, but I'm deeply moved by today's events:
1) The absolute profesionalism of everyone involved from @ThePHPF. Thank you!
2) The number & size of sites went off-line at 2PM UTC to patch their servers. PHP totally runs the world!
3) PHP in news reports in press and TV across the world.
The comments below this are hilarious. Japans PM is confusing the whole country by tweeting about the PHP CVE. 😅
皆様に、今夜に対応して頂きたい大至急のお願いです。
多くのウェブサイトで使用されているPHPに関し、PHPのセキュリティチームが、重大な２件の脆弱性に関する注意喚起を行っています。
公開しているウェブサイトでPHPを使用しているか確認し、今夜、10月21日午後11時（日本時間）に公開される修正パッチについて、可及的速やかに適用できるよう準備をお願いします。
修正パッチを速やかに適用することが困難な場合は、例えばウェブサイト等を一時的に停止させることも、リスクを低減させるための有効策の一つと考えられます。
国家サイバー統括室のXアカウントでも関係する情報を発信していますので、そちらも参考にして下さい。
国家サイバー統括室(注意・警戒情報)（@cyber_forecast） / X
