Web Development
Frontends, backends, runtimes and the open web platform — from CSS layout to edge deploys and API design.
$ cat START_HERE.md
Every entity, every block update, every redstone pulse — one thread, twenty times a second, 50 milliseconds a pass. Folia's answer is to stop sharing the kitchen. Here is the tick budget and the ownership rules, read from the PaperMC source.
Forum Archaeology #1: I built plugins for this software when it ran half the internet's communities. Sixteen years after the exodus that should have killed it, vBulletin is still getting hit with critical, unauthenticated remote code execution.
JDK 26's ten targeted features explained — what's shipping, what it means for production Java, and why the language keeps reshaping the terrain while you're not watching.
$ ls -t ~/web-development
Forum Archaeology #2. Three free PHP forum platforms started from the same premise a generation ago. One got hit with a CVSS 9.8 authentication bypass this June. One had eleven CVEs last year. One has stayed almost quiet. Same premise, three completely different fates.
A PHP API case study: fixing an N+1 query, twenty serial cURL calls, missing connection pooling, and stats recalculated on every request with Redis caching.
A recipe card with blank ingredient fields is worse than no recipe card at all. Part 3 of the kitchen series covers PHPDoc, comments, and the documentation debt nobody notices until the person who understood it walks out the door.
Escoffier's brigade de cuisine solved the same problem PHP's class visibility solves: who gets to touch what, and who answers to whom. Part 2 of the kitchen series, and the one where we build something real.
Before I ever touched PHP, I learned mise en place the hard way, on a line in a 1-star kitchen. Turns out variables, functions, and scope are the same discipline with a different uniform.
Forum Archaeology #1: I built plugins for this software when it ran half the internet's communities. Sixteen years after the exodus that should have killed it, vBulletin is still getting hit with critical, unauthenticated remote code execution.
A pull request checkout, a poisoned GitHub Actions cache, and an OIDC token pulled straight out of runner memory. That's how 84 malicious versions of TanStack's packages hit npm in six minutes.
A deep look at how Microsoft's Go-based TypeScript 7 compiler achieves its speed gains, and what the Visual Studio Code team's year-long migration reveals about adopting it safely.
TypeScript 7.0 has officially launched, bringing a native Go-based compiler with 8x to 12x faster build times. Here's what shipped, how to install it, and how to migrate safely.
CVE-2026-41940 is a CVSS 9.8 authentication bypass in cPanel/WHM affecting every version after 11.40. It was a zero-day for two months, 44,000 IPs are now scanning, ransomware has deployed, and a state-linked actor is hitting Southeast Asian government networks. Patch now.
Zed 1.0 Released — The man who built Electron at GitHub created Zed to fix the damage. Here's the full technical story of why Electron is broken and what Rust + GPU rendering actually changes.
Authentication is a cornerstone of contemporary applications. Virtually every app demands user login, identity verification, and secure sessions. Though it's ubiquitous, many developers implement authentication without
$ ssh community@sudosecurity
Ask in the forums, share a snippet, or work through a course on Learn.
