SudoSecurity

Sign in Subscribe

Web Development 58 articles

Ship it. Then find out what it does.

Frontend and backend, frameworks and the runtimes under them — API teardowns, performance work, and the security bugs that only show up once real traffic arrives.

Join free Talk with us on the forums

A free account gets every post by email. No paywall, no drip campaign.

Primary sources
Real numbers
Working code

Browse by subject

Pick a layer of the stack.

Dedicated feeds

Front, back, and the data underneath.

Frontend

Your npm Install Just Ran Someone Else's Code: Why Dependency Security Has to Start Before CI

Your npm Install Just Ran Someone Else's Code: Why Dependency Security Has to Start Before CI

A pull request checkout, a poisoned GitHub Actions cache, and an OIDC token pulled straight out of runner memory. That's how 84 malicious versions of TanStack's packages hit npm in six minutes.

20 Jul 2026 · 13 min read

Backend & runtimes

phpBB vs. SMF vs. MyBB: Three Very Different Fates

phpBB vs. SMF vs. MyBB: Three Very Different Fates

Forum Archaeology #2. Three free PHP forum platforms started from the same premise a generation ago. One got hit with a CVSS 9.8 authentication bypass this June. One had eleven CVEs last year. One has stayed almost quiet. Same premise, three completely different fates.

17 Aug 2026 · 16 min read

Data layer

PHP API Performance: N+1 Queries, cURL, and Connection Pools

PHP API Performance: N+1 Queries, cURL, and Connection Pools

A PHP API case study: fixing an N+1 query, twenty serial cURL calls, missing connection pooling, and stats recalculated on every request with Redis caching.

10 Aug 2026 · 8 min read

Every article

58 articles · RSS

Newest first.

phpBB vs. SMF vs. MyBB: Three Very Different Fates

Forum Archaeology

phpBB vs. SMF vs. MyBB: Three Very Different Fates

Forum Archaeology #2. Three free PHP forum platforms started from the same premise a generation ago. One got hit with a CVSS 9.8 authentication bypass this June. One had eleven CVEs last year. One has stayed almost quiet. Same premise, three completely different fates.

PHP API Performance: N+1 Queries, cURL, and Connection Pools

Web Development

PHP API Performance: N+1 Queries, cURL, and Connection Pools

A PHP API case study: fixing an N+1 query, twenty serial cURL calls, missing connection pooling, and stats recalculated on every request with Redis caching.

Why Your PHPDoc Blocks Are Recipe Cards Nobody Can Use

Web Development

Why Your PHPDoc Blocks Are Recipe Cards Nobody Can Use

A recipe card with blank ingredient fields is worse than no recipe card at all. Part 3 of the kitchen series covers PHPDoc, comments, and the documentation debt nobody notices until the person who understood it walks out the door.

PHP OOP Explained Through a Real Kitchen Brigade System

Web Development

PHP OOP Explained Through a Real Kitchen Brigade System

Escoffier's brigade de cuisine solved the same problem PHP's class visibility solves: who gets to touch what, and who answers to whom. Part 2 of the kitchen series, and the one where we build something real.

What a 1-Star Kitchen Taught Me About PHP Fundamentals

Web Development

What a 1-Star Kitchen Taught Me About PHP Fundamentals

Before I ever touched PHP, I learned mise en place the hard way, on a line in a 1-star kitchen. Turns out variables, functions, and scope are the same discipline with a different uniform.

The Slow Death of vBulletin, and Why It Isn't Over

Forum Archaeology Featured

The Slow Death of vBulletin, and Why It Isn't Over

Forum Archaeology #1: I built plugins for this software when it ran half the internet's communities. Sixteen years after the exodus that should have killed it, vBulletin is still getting hit with critical, unauthenticated remote code execution.

Your npm Install Just Ran Someone Else's Code: Why Dependency Security Has to Start Before CI

Web Development

Your npm Install Just Ran Someone Else's Code: Why Dependency Security Has to Start Before CI

A pull request checkout, a poisoned GitHub Actions cache, and an OIDC token pulled straight out of runner memory. That's how 84 malicious versions of TanStack's packages hit npm in six minutes.

Inside TypeScript 7: What a Year-Long Rewrite in Go Actually Bought Developers

Web Development

Inside TypeScript 7: What a Year-Long Rewrite in Go Actually Bought Developers

A deep look at how Microsoft's Go-based TypeScript 7 compiler achieves its speed gains, and what the Visual Studio Code team's year-long migration reveals about adopting it safely.

TypeScript 7.0 Is Officially Here: What Changed and How to Upgrade

Web Development

TypeScript 7.0 Is Officially Here: What Changed and How to Upgrade

TypeScript 7.0 has officially launched, bringing a native Go-based compiler with 8x to 12x faster build times. Here's what shipped, how to install it, and how to migrate safely.

CVE-2026-41940: The cPanel Authentication Bypass That Runs 70 Million Domains and Is Being Weaponized Right Now

CVE-2026-41940: The cPanel Authentication Bypass That Runs 70 Million Domains and Is Being Weaponized Right Now

CVE-2026-41940 is a CVSS 9.8 authentication bypass in cPanel/WHM affecting every version after 11.40. It was a zero-day for two months, 44,000 IPs are now scanning, ransomware has deployed, and a state-linked actor is hitting Southeast Asian government networks. Patch now.

Zed 1.0 Is Out — And the Guy Who Built Electron Just Proved It Was a Mistake

Software Development

Zed 1.0 Is Out — And the Guy Who Built Electron Just Proved It Was a Mistake

Zed 1.0 Released — The man who built Electron at GitHub created Zed to fix the damage. Here's the full technical story of why Electron is broken and what Rust + GPU rendering actually changes.

How Authentication Actually Works

How Authentication Actually Works

Authentication is a cornerstone of contemporary applications. Virtually every app demands user login, identity verification, and secure sessions. Though it's ubiquitous, many developers implement authentication without a complete understanding of it's inner workings. This article breaks down authentication step-by-step, explaining the core concepts used

TypeScript 7.0 Beta Is Out — The Compiler Is Now Written in Go and It's 10x Faster

Web Development

TypeScript 7.0 Beta Is Out — The Compiler Is Now Written in Go and It's 10x Faster

TypeScript 7.0 Beta dropped yesterday. The entire compiler has been ported from TypeScript/JavaScript to Go, and the numbers are real. The Sentry codebase drops from 133 seconds to 16. Editor startup drops from 9.6 seconds to 1.2. Memory usage is roughly halved.

What is OAuth?

Every time you click "Sign in with Google" or "Connect your GitHub account," you are using OAuth. You have used it hundreds of times. Most developers have implemented it at least once. And the April 2026 Vercel breach, which exposed credentials for hundreds of organizations, happened

Build Your Own AI Coding Assistant With Access to Your Entire Codebase (2026)

Artificial intelligence

Build Your Own AI Coding Assistant With Access to Your Entire Codebase (2026)

GitHub Copilot charges $19/month and sends your entire codebase to Microsoft's servers. You can build something better — one that knows your whole project, costs $0/month after hardware, and never phones home.

AI Agents Are Breaking the Internet. The Numbers Are Staggering.

Artificial intelligence

AI Agents Are Breaking the Internet. The Numbers Are Staggering.

ChatGPT. Claude. GitHub. All of them went down — repeatedly — and it's not a coincidence. AI agents are generating traffic at a scale human developers never could, and the infrastructure holding up your entire dev workflow was never designed for this.

OpenClaw: The Lobster That Broke the Internet, Burned Through Every LLM's Compute Budget, and Started a War Between Anthropic and OpenAI

Artificial intelligence

OpenClaw: The Lobster That Broke the Internet, Burned Through Every LLM's Compute Budget, and Started a War Between Anthropic and OpenAI

A retired Austrian developer built an open-source AI agent for fun in November 2025. Within 90 days, Jensen Huang called it the most successful open-source project in human history.

AI Agents Are Breaking the Internet — And Nobody's Ready for the Bill

Artificial intelligence

AI Agents Are Breaking the Internet — And Nobody's Ready for the Bill

ChatGPT went down 28,000-report strong in February 2026. Claude had back-to-back outages within 24 hours in March. GitHub logged 37 incidents in a single month and is running at 90.21% uptime — one nine, not three. AI agents aren't just using infrastructure.

Markdown Is a Programming Language. Fight Me.

Programming Languages

Markdown Is a Programming Language. Fight Me.

The dev community has spent 20 years calling Markdown 'just a markup language.' They're wrong. Here's the full technical case — parse trees, AST internals, the CommonMark spec, Pandoc's extended grammar — plus why Markdown is the fastest way to write long documents that has ever existed.

TypeScript 6.0 Is Out, and It's the End of an Era

Web Development

TypeScript 6.0 Is Out, and It's the End of an Era

TypeScript 6.0 dropped today. It's the last version of TypeScript written in TypeScript. Strict mode is on by default, ES5 is gone, outFile is dead, and TypeScript 7.0 — rewritten in Go — is right behind it. Here's everything that changed and what you actually need to do.

Amazon's Mass Layoffs, Kiro AI, and Why Shipping AI-Generated Code to Production Should Terrify You

Artificial intelligence

Amazon's Mass Layoffs, Kiro AI, and Why Shipping AI-Generated Code to Production Should Terrify You

Amazon fired 1,800+ engineers while forcing staff onto its Kiro AI tool. Here's why that's a cybersecurity disaster waiting to happen — and what it means for every developer.

Bun v1.3.11: Cron Jobs, ANSI Slicing, Markdown Rendering, and What Changed Under the Hood

Web Development

Bun v1.3.11: Cron Jobs, ANSI Slicing, Markdown Rendering, and What Changed Under the Hood

A production deep dive into Bun v1.3.11 — covering Bun.cron for OS-level scheduling, Bun.sliceAnsi for terminal-aware string slicing, enriched Markdown rendering callbacks, path-ignore patterns for test discovery, and the dgram UDP fixes that unblocked real-world libraries on macOS.

ChatGPT Is Building Its Own Code Repository — And I Have a Lot of Thoughts

Artificial intelligence

ChatGPT Is Building Its Own Code Repository — And I Have a Lot of Thoughts

OpenAI is building a GitHub competitor — a technical breakdown of Git internals, version control history, and what this move signals about OpenAI's strategy.

How to Use AI Coding Tools to Speed Up Development (Without Losing Your Mind or Your Skills)

Artificial intelligence

How to Use AI Coding Tools to Speed Up Development (Without Losing Your Mind or Your Skills)

Learn how to use AI coding tools like GitHub Copilot and Cursor to speed up development, cut boilerplate, and ship faster — without becoming dependent on the machine.