AI can generate a diagram in seconds. Getting the diagram you actually want usually takes much longer. A few missing details. A few layout changes. A few rounds of refinement. And after all that, it's often just an image. This architecture diagram wasn't drawn. It was described, refined, and animated.

honestly feels like every creative tool is becoming an agent workflow

honestly loving the new auto approve feature in claude.

This part got me 💀 "I choose to take it offline very secure. according to the NSA."

October 2026 is turning into a security nightmare for software. You can audit your own code perfectly and still get compromised by something buried three dependencies deep. ṱ̴̨̛͇͍̺̖̹̞̟͇̭͛̇̈́͂̾̓̉̔̌̅̋͛̊͊̎͝r̷͉͚̲͓̯͎͚̞͖̜̞̩̼̤̼̠̯͙̙̻̦̬̭̩̝͇̞͕̼̮͓͕͆ự̵̢̱̘̜̬̖̞͔̝̙̯̤̻͍̼̟̦͗͒͂̋̈͗͛̔͋͑̐͊͛͐̅͂̐̓ş̶͙̩̻̰̬͕͙̭̗̰͇͌́̓̀͐̌ț̷̡̨̲̩̞͓͓̙͎̬͉̭̜̕͜͜ͅę̵̛̥̮̪͚̠͑͊̇̃̏͗̽̅̃̀̈̿͗̈́̈͗͑̔͆d̴̡̻͕̼̤̝̪̰̲͖̭̙̣̀͛̂ͅ.̵͔̲̱͈̝̙̱͚̟̲̤͚͕̝̣̬͉̰̱̩̟̖͍̻̜͓̭̗͎̙̘̈́͒̿̋̏͋́͜ 𝗣𝗮𝗰𝗸𝗮𝗴𝗲𝘀 𝘆𝗼𝘂 𝗶𝗻𝘀𝘁𝗮𝗹𝗹 > LiteLLM 1.107.0: credential stealer on PyPI + Docker > Tensorlake 0.5.144: worm on npm > @subql/common 5.8.3: backdoor on npm 𝗥𝗲𝗹𝗲𝗮𝘀𝗲𝘀 & 𝗿𝗲𝗽𝗼𝘀 𝘆𝗼𝘂 𝗿𝗲𝗹𝘆 𝗼𝗻 > OVHcloud CLI: release binaries swapped for a stealer > Rank Math PRO: malware in the official download > GhostAction: ~30K GitHub repos hit by stealer workflows 𝗣𝗹𝗮𝘁𝗳𝗼𝗿𝗺𝘀 𝗵𝗼𝗹𝗱𝗶𝗻𝗴 𝘆𝗼𝘂𝗿 𝘀𝗲𝗰𝗿𝗲𝘁𝘀 > Railway: customer environment variables accessed, some decrypted > Zeabur: internal credentials leaked, customer env vars read > OpenCode console: AI provider keys potentially exposed 𝗩𝗲𝗻𝗱𝗼𝗿𝘀 𝘄𝗶𝘁𝗵 𝗮𝗰𝗰𝗲𝘀𝘀 > TeamUpdraft: stolen keys used to backdoor WordPress sites > ConnectWise: backup app credentials abused across M365 tenants 𝗧𝗵𝗲 𝘁𝗿𝘂𝘀𝘁 𝗹𝗮𝘆𝗲𝗿 > eMudhra: 8 weak CA intermediate keys revoked We review our own PRs line by line. But dependencies, plugins and vendors often get access to our systems with far less scrutiny. That’s the uncomfortable reality of modern software security. Your attack surface extends beyond your repository. It includes every package that runs in your environment and every third party that can access your secrets. 𝗪𝗵𝗮𝘁 𝘁𝗼 𝗱𝗼 𝘁𝗵𝗶𝘀 𝘄𝗲𝗲𝗸 > Rotate credentials that may have been exposed > Audit dependencies and scan for supply-chain compromises > Pin exact versions and verify release integrity > Give every tool its own least-privilege key with spending limits

PHP developers, check your servers. PHP2Shell exposes critical vulnerabilities that could allow remote code execution. T̸̨̨̧̜͚̙̾̏̄h̵̼͓̤̯̣͇͓̽̈́͋͂̏̎̂͛̇̍͐̌̈̄͝e̷͖̞̝̐͒̅̂̈͑͜͠ ̷̺͙̯̪͇̤͚̓͛̆̓͜ẃ̵̡̪̪̳̫͇̺̖̇͋́̃̋ë̵́̈́̒̓̅́͠ͅb̸̢̛̙̲̪̠͚̖̣̺̀̄̈́̌̊̽̄̆́̀̓ ̴̛̛͚͉̦̙͊̊͐̏̀̋̈̚̕͝i̸̡̢̞͎̞͖̠͔̮̗͓͎̣̾̊́̑́̽̈́͐̋̚͝͝s̶̢͖͈̜͍̩͙͋̈́̒̾̌͊͜͝ ̴̢̢̰͖͐͑͂͌͝m̴̛̞͊̂̉͂̿̓̓͂̍̃̓͑̕͝o̵̦̮͙͙͍͕̹̬͎̫͖̽͛̀͠ř̸̛̮̼̹̗̣̫̊̂̐͊̅͝ě̴̡̢͔̻̜̳̮͈̪̦̫̪͓̫̀͛̈͘ ̵̛͎͚̙̥̳̝͖̟̰̘̻͂͊͛͆̔͝f̷̲̪̰̤̼̞̻̖̳̺̜̻̒̽͌̈̉̊͌͛̃̄͌̒̚͠͠r̴̨̨̙̯̫̹̞̳̺̲̤̩͍͒͛a̴̛͓̠͍̺͍̫̰͗̑̀̿̎͐͠g̶̭͎̊̓̅͂̇̄̓̿̾̓̌̇̓͆͘͠͠ì̷̢̳̣̘̜̯̹̖̘͓̫̫̀̾̑̑̑̅͒ľ̷̢̠̯̪̝̱̫̠̻̩̜͇͍͒̇͗̓̈́͠ę̷̢̲͔̪͙̤͉̰̗͔̦̗̗̪̘̓͒͊͊́̏̀̈͌͌͂̋̓̀́̚͝ ̵̯͇̤́̂̒̍͌̎͗̋͐͝t̶͔̭̘̠̻̤̗̤͖͉̎̃͂̈́ͅh̷̢̧̻̤͛a̴͕̜̯͓͖͔̭̫͍͇̯̺̝̘̎ͅn̶̹̆̂̈́̏̂͆͑́̉̕͝ ̶̧̢̘̘̪̫̮̪͚̻̼̪̥̖̂̒͐͆̽͊̄͐͐̓̐̃̓̈́̐ͅi̴̢̧̤̘̞͖̲̦̻̓̒̅́̎̽͊͠t̵̬̤͂̍̈́̐͗́̒̀͗͝͝ ̸̨̗̰̪̘̥̻̜̼̳̲͖̬͔̟̹̤͛͒͊ḷ̵̡̛̩̝̲͍͇̼̜͚̏̉͛͑́̂̑̊̕͝ỏ̵̧̢̨̘̝̘͖̺̙͙͔͎̞̼̱͓̎o̶͇̯͎̬̫̬̙͕̭̣̳͑͌̊́̔̿̀̄͂̎̚͜ͅͅk̴̢͚̬̹͎͛͝ͅs̴͖͚̞̰̜̻̗̫͎̲̘͓̥̮͈̀̿̓͑̓͆̂̍̀̆̅̚͠ Check your PHP version. Patch if affected.

I tried to recreate that jony ive animation in @coanimator