Writing

PHP2Shell: Two Critical RCEs in PHP Core, and What to Do Today CVE-2026-109618 and CVE-2026-109619 are unauthenticated remote code execution flaws in PHP core, both rated CVSS v4.0 9.2. Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, released 21 October 2026. What the bugs are, who is at risk, and a patch-day checklist. engineering Oct 21

Jehovah Jireh Does Not Always Mean More Money The LORD Will Provide is a name Abraham gave on a mountain where he almost lost his son — not in a season of surplus. Genesis 22:14 on what God actually provides, and why the provision often looks nothing like cash. faith Sep 6

Speaking in Tongues Edifies Yourself — Prophecy Edifies the Church He who speaks in a tongue edifies himself, but he who prophesies edifies the church. 1 Corinthians 14:4 on the private prayer language that strengthens you — and why public worship aims at building up everyone. faith Aug 21

You Cannot Impart What You Do Not Possess You cannot lead people where you have never been. You cannot preach with power what you are not practicing with integrity. Ezra 7:10 on why the order — study, obey, then teach — is everything. faith Aug 17

How Do Two Servers Never Pick the Same ID? Auto-increment works right up until you add a second writer. The story of how distributed systems mint unique IDs without asking each other permission — ticket servers, UUIDs and the birthday math, Snowflake and ULID, and the one idea underneath all of them: who owns which slice of the ID space. engineering Aug 15

ReBAC: When Permissions Become a Graph Google's Zanzibar modeled access as relationship tuples — editor of the folder that contains the doc. When your ABAC policies turn into chains of relationship-walking, ReBAC (OpenFGA, SpiceDB) is the tool built for it. What it buys, what it costs, and the seam that keeps you free to adopt it later. engineering Aug 8

Faith Requires Movement Before the Miracle Happens God did not part the Jordan while Israel rested in their tents. He waited until the priests stepped into the flood-stage water. Joshua 3 on why faith moves first — and the miracle meets the movement. faith Aug 1

Audit Trails: Who Did What, When, and Prove It Authorization decides what happens; the audit trail proves what happened. What a useful audit event records, spatie/laravel-activitylog for model changes, logging the denials (not just the changes), and why append-only is the property that makes it an audit log at all. engineering Aug 1

FrankenPHP on macOS: Dynamic Vhosts and Legacy PHP Pinning A full FrankenPHP local dev setup on macOS — one catch-all config that serves every site in /var/www/sites with no per-site vhost, a launchd daemon that survives reboot, and an fp-pin helper that routes legacy projects to older PHP-FPM pools. Plus how to evict Nginx or Apache and translate their config. engineering Jul 30

The Greater Our View of God, the Deeper Our Fear of Him The more we comprehend God's greatness — though in itself it stays incomprehensible — the greater our capacity to fear Him. A small view of God breeds a shallow reverence; a growing view of God deepens holy fear into wonder. faith Jul 27

Multi-Tenant Authorization: One Database, Many Customers, Zero Leaks In a SaaS, the worst bug class is the cross-tenant leak — customer A seeing customer B's rows. Global scopes that make the leak impossible by default, why tenancy is not authorization, and the escape hatches that bite: queues, commands, and reports. engineering Jul 25

How to Efficiently Structure a Medium Scale Vue 3 Project The awkward middle: too big for a flat src/, too small for micro-frontends. How I lay out a Vue 3 + Vite + Pinia app by feature module instead of by file type — a router split per module, colocated stores, one Axios client, composables that stay near their feature, and the Tailwind-vs-Vuetify call. The same modular instinct as my Laravel Module Maker, on the frontend. engineering Jul 23

How One Server Holds a Million Connections A million open connections on a single box sounds impossible until you stop thinking one-thread-per-client. The story of C10K, why an idle connection is almost free, the four walls you actually hit, and the napkin math that makes a million fit in RAM. engineering Jul 21

Testing Authorization Policies Like the Boundary They Are A policy bug isn't a bug, it's an incident. Table-driven Pest tests over the attribute grid, feature tests that prove the 403 is actually wired, and the Gate::before mistake that silently kills every policy you have. engineering Jul 18

Atomic Deployments — Flip a Switch, Not a Site How to deploy a site so the switch from old to new happens in a single instant — no broken pages mid-deploy, and rollback in one command. engineering Jul 16

You Cannot Worship God Properly if You Don't Know How to Praise Him Modern culture blurs praise and worship into two tempos of music, but Psalm 100 maps them as a path — thanksgiving at the gates, praise in the courts, worship in the sanctuary — and you cannot reach true worship without first learning to praise. faith Jul 14

RBAC vs ABAC: Roles, Attributes, and Where Each One Breaks RBAC answers 'what kind of user is this'; ABAC answers 'can this user do this thing, right now, to this row.' Where role checks stop scaling, where attribute policies get hard to audit, and the hybrid every real app lands on — with Laravel examples. engineering Jul 13

A Worked Design, End to End The whole toolkit on one real system: an appointment booking and reminder service. Napkin math first, then the CAP call per feature, idempotent bookings, async reminders, cached availability, and where every previous chapter lands. engineering Jul 12

Optimistic UI and Prefetching The fastest system is the one that feels instant, and feeling instant is a design problem, not just a speed problem. Optimistic UI, prefetching what the user will probably need next, and optimistic locking so assuming success stays safe. engineering Jul 12

Designing for Failure Everything fails: servers, networks, dependencies. The question is never whether, but how gracefully. Timeouts, retries with backoff and jitter, circuit breakers, bulkheads, and graceful degradation — the toolkit for staying up when parts don't. engineering Jul 12

Caching Patterns and Their Failure Modes Cache-aside, write-through, write-behind — the strategies, and the failure modes that turn a cache into an outage: the stampede when a hot key expires, and why every cache is a bet that stale data is acceptable. engineering Jul 12

Idempotency and Safe Retries The network makes every call at-least-once, never exactly-once — so the same request will sometimes arrive twice. Idempotency is what makes a repeat harmless: idempotency keys, dedup, and why 'exactly-once' is a lie you engineer around. engineering Jul 12

Sync vs Async Synchronous means the caller waits; asynchronous means the work is handed off to a queue and the caller moves on. When to decouple with a queue, what it buys (resilience, smoothing, speed), and the new problems it hands you. engineering Jul 12

Replication and Quorums Copying data across machines buys read capacity and survives a dead server — and creates every consistency headache in the series. Leader/follower, sync vs async, failover's split-brain risk, and quorums as the dial between them. engineering Jul 12

Consistency Models 'Eventually consistent' isn't one thing — it's a whole menu between strong and eventual, and the middle options are where real apps live. Read-your-writes, monotonic reads, and the bugs that appear when you pick wrong. engineering Jul 12

The CAP Theorem (and PACELC) When the network splits, you get consistency or availability — not both. The CAP theorem stated without the folklore, why 'CA' isn't a real option, and PACELC: the tradeoff that bites even when nothing is broken. engineering Jul 12

Scaling and Statelessness Scaling up buys a bigger box; scaling out adds more boxes. But scaling out only works if your app is stateless — and the sticky session is the hidden state that quietly breaks it. Where state actually belongs. engineering Jul 12

Latency, Throughput, and Napkin Math The numbers every engineer should know by feel — memory vs SSD vs network — plus why p99 matters more than the average, and how a five-minute capacity estimate saves you from building for a scale you don't have. engineering Jul 12

How to Think About System Design System design has no right answers — only tradeoffs along a few axes: latency, consistency, availability, cost, and complexity. The intro to a working dev's field guide, and how to read the rest of it. engineering Jul 12

System Design from Zero Before the tradeoffs, the vocabulary. A system is just boxes and arrows — client, server, database, and the network between them. The absolute-beginner on-ramp to the series: what really happens when you load a page, and the scary words demystified. engineering Jul 12

Git Hooks That Actually Help Hooks run your scripts at points in the Git lifecycle — lint before commit, test before push, validate the message. The genuinely useful ones, and how to share them across a team with lefthook. engineering Jul 11

The PHP date() Function: Common Formats A working reference for PHP's date() function — the format characters worth memorizing, ready-to-paste patterns for dates, times, and timestamps, and the escaping and timezone gotchas that bite people. engineering Jul 6

Automated UPS Shutdown and Recovery with NUT Wiring a CyberPower UPS to a Ubuntu server with Network UPS Tools so the box shuts down cleanly on a dead battery and boots itself back up when the power returns — BIOS, ups.conf thresholds, upsmon, and the full-power-cut test. engineering Jul 2

Using a Separate SSH Key for GitHub How to point a custom SSH key at GitHub without disturbing your default identity — an SSH config host alias, the matching remote URL, and a repo-only alternative. engineering Jul 1

A PHP Auto-Installer Script for Ubuntu A small Bash script that takes a version number and installs PHP plus the core modules almost every modern app needs — without the trap of installing every module in the repo. engineering Jun 29

Hunting Bugs with git bisect A bug appeared sometime in the last 200 commits and you don't know where. git bisect binary-searches your history to find the exact commit that broke it — by hand, or fully automated. engineering Jun 27

Building Real Things The whole loop, end to end: one feature from a prompt to a deployed change — the wins, the dead ends, and the honest accounting of what agentic engineering is and isn't good at yet. engineering Jun 20

Guardrails and Trust An agent that can run any command is powerful and dangerous in the same breath. Permission modes, destructive-action gates, and reviewing diffs — how I let an agent ship to a live Synology box without losing sleep. engineering Jun 20

Subagents and Parallel Work One agent in one context window hits limits. Delegating research to subagents, isolating context, and working in parallel with git worktrees — plus the trap of over-delegating. engineering Jun 20

Designing the Feedback Loop An agent is only as good as the ground truth it can check itself against. Tests, build scripts, type checks, and screenshots as the agent's eyes — and why a fast loop beats a smart prompt. engineering Jun 20

Claude Code in the Terminal Where the agent lives is the shell — the same place I always worked. Setup, project memory with CLAUDE.md, slash commands, and hooks, using the rebuild of this very site as the case study. engineering Jun 20

What "Agentic" Actually Means Agent, chatbot, autocomplete — three different things the industry keeps calling the same word. What makes a tool agentic, and why a loop plus tools plus judgment changes how the work feels. engineering Jun 20

git worktree for Parallel Branches Stop stashing to switch branches. git worktree checks out multiple branches into separate folders off one repo — review a PR, hotfix prod, and keep your feature work untouched, all at once. engineering Jun 20

What You Are About to Do, Do Quickly When Jesus tells Judas to act quickly, He is not speaking to a man — He is granting permission to the spirit possessing him. Even in the betrayal, His divinity is revealed. faith Jun 17

SEO, AEO, and GEO: Optimizing for Search, Answers, and Generative Engines Search isn't one game anymore. SEO ranks you on Google, AEO wins the featured-answer box and voice results, and GEO gets you cited inside ChatGPT, Claude, and AI Overviews. What each one actually optimizes for, where they overlap, and how I'd build a page to win all three. engineering Jun 16

Availability and Recovery: When It Breaks, How Fast Do You Come Back? Everything fails eventually. Availability is staying up despite failure; recovery is getting back fast when you can't. Backups you've actually restored, redundancy, RTO/RPO, and the runbook you'll be glad you wrote. engineering Jun 14

Error Tracking and Logs: Knowing Before Your Users Tell You If you find out about bugs from angry tweets, you're flying blind. Logs are the flight recorder; error tracking is the alarm; metrics are the dashboard. The three pillars of observability, made practical. engineering Jun 14

Load Balancing and Scaling: Surviving Success One server has a ceiling. Scaling up buys a bigger box; scaling out adds more boxes behind a load balancer. The catch is statelessness — and why your app has to be designed for it before the traffic arrives. engineering Jun 14

Caching and CDN: Don't Compute What You Already Know The fastest query is the one you never run. Caching stores expensive results so you reuse them; a CDN moves content close to users. The layers of cache, the hard part (invalidation), and how to apply both. engineering Jun 14

Rate Limiting: What Stops One Client From Melting Your App An endpoint with no rate limit is a door anyone can hold open forever. Throttling protects against brute force, scrapers, runaway clients, and bill shock. The algorithms, and how to wire it in Laravel. engineering Jun 14

Security and Row-Level Security: Can User A Read User B's Data? Security is a layer, not a feature you add at the end. The OWASP basics, and the bug that quietly ships in real apps: broken object-level authorization — when changing an ID in the URL loads someone else's data. engineering Jun 14

CI/CD and Version Control: The Conveyor Belt for Code Version control is the source of truth; CI/CD is the automated belt that carries a commit to production with the tests run and the build checked. How to wire a pipeline that makes shipping safe and boring. engineering Jun 14

Cloud and Compute: What Your Code Actually Runs On 'The cloud' is someone else's computer, rented by the hour. VMs, containers, and serverless; vCPU and RAM; the bill that surprises you. Demystifying the machine your app lives on — and when self-hosting wins. engineering Jun 14

Hosting and Deployment: Getting It Online Without Fear Code on your laptop helps no one. Hosting is where it runs; deployment is how it gets there — repeatably, reversibly, without 'works on my machine'. The path from localhost to a URL the world can hit. engineering Jun 14

Auth and Permissions: Who Are You, and What Can You Do? Authentication answers who you are; authorization answers what you're allowed to do. Sessions vs tokens, password hashing, roles vs policies, and the mistakes that turn into breach reports — built with Laravel. engineering Jun 14

Database and Storage: Where Data Comes to Rest The database outlives your code. Schema design, indexes, the N+1 query that quietly kills performance, migrations, and where files actually belong — the storage layer done with MySQL and Eloquent. engineering Jun 14

APIs and Backend Logic: Where the Rules Live The backend is where your business rules are enforced and your data is shaped before it ever reaches a screen. REST design, validation, the fat-controller trap, and how I structure a Laravel API so it survives growth. engineering Jun 14

Frontend Foundations: The Layer Users Actually Touch The first layer of any stack is the one the user sees and feels. HTML structure, CSS systems, the JavaScript you can afford, and the build step that ties them together — what a senior values, and what I reach for. engineering Jun 14

Vibe-Coded vs Production-Ready: 3 Layers or 13? An AI can spin up a working demo in an afternoon — frontend, a bit of backend, a database. That's three layers. Shipping it to real users needs ten more. Here's the gap between a demo that works and a product that survives contact with the world. engineering Jun 14

My Homelab on Proxmox: From One Raspberry Pi to a 20U Rack Seven years after I called the Raspberry Pi 4 'a direction', the direction has a floor rack, dual-WAN failover, and opinions about VLANs. A tour of the homelab. engineering Jun 13

Building Graveyard Analytics: Managing My Jellyfin Server's Afterlife Why I built a Jellyfin plugin that finds dead media, tracks resource vampires, and reclaims terabytes from my homelab. engineering Jun 13

Resolving Merge Conflicts Like You Mean It Conflict markers stop being scary once you can read them. What <<<<<<< HEAD actually means, how to resolve by hand or with a tool, and rerere so you never solve the same conflict twice. engineering Jun 6

Keeping a Fork in Sync Contributing to open source means your fork falls behind the original fast. The upstream remote, the fetch-and-rebase loop, and the daily routine that keeps your PRs mergeable. engineering May 30

Paano Sila Makabati? Roma 10:14-15 — the chain of salvation runs through messengers. Those who have received grace are the ones God sends, with beautiful feet bearing good news. faith May 24

macOS Homebrew PHP-FPM Setup Guide The steps after installing a new PHP version with Homebrew — pool config, a per-version port convention, validation, and the Nginx wiring, plus troubleshooting. engineering May 15

A Feature-Branch Workflow, Start to Finish The full loop for shipping a change the GitHub Flow way — branch, commit, push, PR, review, merge, clean up — with the exact commands and the gh CLI shortcuts at each step. engineering May 9

Unwrapping the Grace Within Spiritual gifts are not talents we earned but grace working through us — and among them, discernment stands as the church's quiet guardian. faith May 3

Trunk-Based vs Git Flow vs GitHub Flow Three branching models, three philosophies of how code reaches production. What each one is, the team size it fits, and why most small teams are overthinking it. engineering Apr 25

Ang Bisan Sin-o nga Magtawag Maluwas Roma 10:13 and Joel 2:32 — salvation is an open invitation. Whoever humbly calls on the name of the Lord, from any background, receives a guaranteed salvation. faith Apr 19

Signing Commits with SSH and GPG That 'Verified' badge isn't decoration — it proves a commit came from who it claims. The easy modern path (SSH signing), the classic one (GPG), and how to fix 'gpg failed to sign'. engineering Apr 11

A Sane .gitignore and .gitattributes Two dotfiles that keep a repo clean: .gitignore to keep junk out, .gitattributes to normalize line endings and tame diffs. Plus the global ignore for your machine-specific cruft. engineering Mar 28

When the Shepherd Is Struck: Finding Our Way Together Matthew 26:31-32 — when leaders fall or leave, sheep scatter. How to stay anchored: look to the Chief Shepherd, know His voice, and lean on the whole body. faith Mar 22

Ihambal Lang ang Pulong, Ginoo Mateo 8:5-13 — the centurion's faith that amazed Jesus. True faith recognizes Christ's supreme authority: one word from Him is enough, even from afar. faith Mar 15

Undoing Things: reset, revert, restore, reflog The four commands that undo almost any Git mistake — and exactly which one to reach for. Discard a change, undo a commit, recover a deleted branch, walk back a bad rebase. engineering Mar 7

Merge vs Rebase vs Squash-Merge Three ways to land a feature branch on main, three different shapes of history. What each one actually does to the commit graph, and a rule of thumb for picking one. engineering Feb 21

Kon Buot Mo, Mahimo Mo Ako Maputli Mateo 8:1-4 — Jesus touches the untouchable. His power draws near to the rejected, and His healing restores not just the body but dignity and belonging. faith Feb 15

git rebase -i Without Fear Interactive rebase is how you clean a messy branch before review — squash, reword, reorder, drop. The commands, the golden rule, and how to recover with reflog when it goes sideways. engineering Feb 7

A .gitmessage Template and Commit Hooks That Enforce It A convention nobody enforces is a convention nobody follows. A commit template to prompt the format, and a commit-msg hook to reject anything that doesn't match — shared across the whole team. engineering Jan 24

Conventional Commits, End to End A commit message spec that turns git log into a changelog and a version number. The full type list, the anatomy of a message, breaking changes, and why the discipline pays for itself. engineering Jan 10

Notes on engineering, life, and faith

Series

The Thirteen Full-Stack Layers

Git for Working Devs

System Design for Working Devs

Authorization in Practice

Agentic Engineering with Claude

Latest

PHP2Shell: Two Critical RCEs in PHP Core, and What to Do Today

Jehovah Jireh Does Not Always Mean More Money

Speaking in Tongues Edifies Yourself — Prophecy Edifies the Church

You Cannot Impart What You Do Not Possess

How Do Two Servers Never Pick the Same ID?

ReBAC: When Permissions Become a Graph

Archive

2026 79 posts

2025 24 posts

2024 12 posts

2023 12 posts

2022 12 posts

2021 12 posts

2020 12 posts

2019 12 posts

2018 6 posts

2011 1 post