Engineering on jpcercal.com

A WAF Is Not a Patch

Thu, 22 Oct 2026 00:00:00 +0000

A critical CVE lands. Someone asks in the team chat whether we are exposed, and the first reply is “we have a WAF, we’re covered.”

I understand the reflex. A WAF is one of the fastest ways to react, and I would not want to run a public application without one. But the sentence mixes up two different things. A WAF changes the odds that an attacker reaches a bug. A patch removes the bug. When the first gets treated as the second, a temporary bridge quietly becomes permanent infrastructure.

PHP2Shell: Two Critical PHP Vulnerabilities and What to Do Now

Wed, 21 Oct 2026 00:00:00 +0000

Two critical flaws in the PHP runtime itself were disclosed on October 21, 2026: CVE-2026-109618 and CVE-2026-109619, nicknamed “PHP2Shell.” Both are CVSS 9.2 (v4.0) and can lead to unauthenticated remote code execution. Disclosure was moved up a day after the IDs leaked (PHP Foundation). The bug is in PHP core, so your framework does not matter.

The short version: update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35, restart every worker, and verify the running version. A WAF buys time; it is not a patch.

Changing the Decision Model Changes the Policy

Sun, 11 Oct 2026 00:00:00 +0000

I’ve been reading Vercel’s comparison of Jev, Laya, and Liquid d1, and the useful part for me is not which model wins.

The article does not establish a winner.

It shows that all three can answer the same typed questions through AI Gateway. That makes comparing them easier. It does not tell us whether the application should act on their answers in the same way.

That is the distinction I would keep before changing a model in an existing system.

GPT-6 Astra Is an Operator, Not a Chatbot

Thu, 24 Sep 2026 00:00:00 +0000

I’ve been thinking about GPT-6 Astra less as a new chatbot and more as a standing offer to operate the computer.

OpenAI calls it “the world’s most intelligent and aligned model.” Perhaps. The claim I can check is narrower. On the launch note and the later work note, Astra is described as something that uses the applications people already have open, including applications with no API.

That is the distinction I would use.

The Cost of the Loop Matters More Than the Score

Wed, 23 Sep 2026 18:00:00 +0000

I’ve been reading Anthropic’s notes on Claude Opus 5.5, and the part I keep coming back to is not the leaderboard.

They say it performs at the level of Claude Fable 5.1 on most work, and that in their own use the gap is narrower than the benchmark scores suggest. They also say that at this level of capability, benchmark margins have become a less reliable guide to real-world differences.

When AI Decisions Become Software Inputs

Wed, 23 Sep 2026 00:00:00 +0000

I’ve been thinking about what software actually needs when it asks an AI system where to send a request.

Usually it is not another paragraph. It is an answer it can inspect: a known category, an indication of uncertainty, and a rule for what happens next.

Consider a support message: “I was charged twice, and the receipt page will not load.” A free-form explanation might help a person, but the application still has to decide which queue receives the message. Parsing prose into a queue name adds another place for the workflow to fail.

What an AI Session Can Teach the Next One

Mon, 14 Sep 2026 00:00:00 +0000

An AI assistant can help write code, explain an unfamiliar system, investigate a failure, or draft documentation. An AI agent can go a step further and take several actions on our behalf.

In both cases, it is easy to focus only on the immediate result. Did the code compile? Did the document look reasonable? Did the task move forward?

There is another result that is easy to lose: what the session taught us about the way our team works.

Working With AI Agents: Stay on the Loop

Sun, 13 Sep 2026 00:00:00 +0000

I’ve been thinking recently about how our role as software engineers changes when AI agents become part of the development process.

There seems to be a tempting choice between two extremes.

Either we let the agent handle everything and trust the result, or we stay involved in every step, reviewing every piece of code it produces.

I don’t think either approach scales particularly well.

The output isn’t the whole process

When building software, we often focus heavily on the artifacts we produce: code, tests, technical designs, configuration, and documentation.

Understand the System Before Changing It

Thu, 10 Sep 2026 00:00:00 +0000

One thing I’ve learned over the years is that good architecture often starts with understanding the system you already have.

Before changing something, I usually invest some time looking at how requests actually flow, where the dependencies are, what the failure points might be, and perhaps most importantly… why things ended up the way they are.

Sometimes there’s a very good reason. Sometimes the reason is simply that the system evolved over time. Either way, understanding the context usually leads to better decisions than jumping straight to a solution.

How to Create a Bidirectional File Sync using Unison

Mon, 13 Jul 2020 06:35:28 +0000

So if you came here I consider you already have a problem to solve, and you are familiar with unison. If this is the case, skip the introduction please.

If you don’t, then keep reading as it might clarify a few things before we get started with the how to use unison in order to create a bidirectional (two way) synchronization of two directories.

Introduction

To simplify the understanding let’s imagine that you have two folders and you want both folders to be synchronized when an event happens such as a new file is created, a file got changed or even a file got deleted. You want both folders to reflect exactly the same state as a replica.

Composer clear cache

Sun, 31 Mar 2019 20:53:12 +0000

Well, today I was facing the follow issue:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


End-of-central-directory signature not found. Either this file is not
 a zipfile, or it constitutes one disk of a multi-part archive. In the
 latter case the central directory and zipfile comment will be found on
 the last disk(s) of this archive.
unzip: cannot find zipfile directory in one of /var/www/apps/api/vendor/symfony/symfony/d9b1f549001f508e27a7334590534b83 or
 /var/www/apps/api/vendor/symfony/symfony/d9b1f549001f508e27a7334590534b83.zip, and cannot find /var/www/apps/api/vendor/symfony/symfony/d9b1f549001f508e27a7334590534b83.ZIP, period.

 The archive may contain identical file names with different capitalization (which fails on case insensitive filesystems)
 Unzip with unzip command failed, falling back to ZipArchive class

 Invalid zip file, retrying...

It was part of the output message after executing composer install command.

Revisiting the layout and the Blog project

Tue, 12 Mar 2019 21:33:54 +0000

Hello dear visitor, a long time ago I had the desire to revisit the Blog layout, however, conciliate attention to my family and write are not things that could be done at the same time, because, both of them requires dedication.

Well, technically speaking, the goal was to give back to the open-source community something and so the source code is hosted on GitHub. You can use it to inspire yourself by taking this project as a solid base or even as a starting point.

How to delete all your Git local branches

Tue, 12 Mar 2019 11:31:29 +0000

Well, from time to time I feel the need of cleaning my local branches, it’s part of my natural workflow and if you need the same you could benefit as well of this handful pipped command below:

1
2
3


$ git branch --list | \
egrep --invert-match "(master|gh-pages|\*)" | \
xargs git branch -D

So, I believe the command listed above is self-explained, but if you didn’t understand what’s going on then, here’s the explanation for each on of them:

iTerm2 + Zplug = Productivity

Mon, 26 Feb 2018 10:15:56 +0000

After spending a long time of my life using the normal terminal I met a new tool called iTerm2 because a friend of mine a few years ago. And, this week I’ve discovered the power of zplug. So, here’s a brief tutorial on how to get something looking similar to this:

iTerm2

This is a tool like the native app for terminal provided by Apple that has a lot of features that you can just check here. It allows you to customize everything from autocomplete to syntax highlight.

Accessing Amazon RDS Instances from your Desktop

Fri, 15 Aug 2014 10:48:28 +0000

After a few minutes of research, I found an interesting solution for connecting to Amazon RDS through a Desktop client, well, the magic formula is an SSH connection that forwards packets to the local machine, allowing a remote connection this way.

First you need to add your Amazon EC2 service connection key. Do this by running the following command:

1

$ ssh-add <your-key-filename>.pem

And to forward the packets, run the following command: