Algavi — Articles

PHP2Shell: two critical holes in PHP that can't wait

2026-10-23T00:00:00.000Z

PHP fixes usually ship quietly. This time the PHP team warned in advance on October 20 that it would release a fix for two critical vulnerabilities rated CVSS 9.2 out of 10 the next day, and earlier if details leaked. They did leak, and attackers were trying them before the fix was out.

The bugs got the nickname PHP2Shell. They let an attacker run code on the server without a password, with the site's privileges: its files, the database password and write access wherever PHP can write. That covers practically every PHP site, whether it runs WordPress, Laravel, Nette or custom code. Apache with mod_php is the most exposed, because the attack lands before the application runs.

Fixed versions: 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 7.4 to 8.1 only have source patches, and older versions get nothing.

How it works

Both are use-after-free bugs: PHP uses memory it has already freed, which may by then hold the attacker's data.

CVE-2026-109618 is like a cook who drops everything and leaves when the counter runs out of space. The cleaner then tidies up according to a note the cook only half wrote. PHP does something similar when it runs out of memory: it jumps out of the current work immediately, and cleanup trusts half-initialized data.

CVE-2026-109619 is like a hotel where the room isn't fully reset between guests. A PHP server reuses the same processes for visitor after visitor. When a request is interrupted unexpectedly, a "note" pointing to memory that now belongs to someone else stays in the process, and the next request follows it.

Why it happened

PHP was built on the rule that everything is thrown away at the end of a request and the next one starts clean. For performance, though, processes are reused, and the rule breaks as soon as something somewhere isn't reset. Add the shortcut of "bail out immediately on out-of-memory", which assumes every place in the code is ready for it. And PHP is written in C, which doesn't check whether memory still belongs to you. So the bug comes from three old decisions meeting in situations nobody routinely tests.

In practice

According to Amazon, the first exploitation attempt came on October 17, four days before the fix. Right after the release hundreds of "exploits" appeared on GitHub, mostly fake. Security firms still caught real attempts, including one trying to plant a webshell, a script an attacker uses to control the server.

A typical victim looks unremarkable: a small e-shop on a cheap VPS, PHP last updated over the summer. An automated scanner breaks in after a few attempts, reads the database password and injects a card-skimming script into checkout. The site doesn't need a single bug in its own code.

This isn't overcautious. CVE-2024-4577 from June 2024 was being used by ransomware less than two days after disclosure.

What to do

Update PHP and restart all its processes (PHP-FPM, Apache). Debian and Ubuntu often backport fixes into an older version, so a lower php -v number doesn't necessarily mean you're vulnerable. Check your distribution's security tracker.
In Docker, rebuild the image with a freshly pulled base (docker compose build --pull). up -d alone isn't enough. Then check the version inside the container.
On shared hosting, ask your provider whether they've updated.
If you can't update right away, the temporary measures in the official advisory help, such as turning off session.upload_progress. They don't fully close the hole, though.
Check the server. If it ran a vulnerable version, look for new files in the web root, new cron jobs and crashing PHP processes.

A website's security rests not only on its own code but on the environment it runs in. That's why it pays to have deployment set up so a fix takes a single command.

Sources: php.net – advance notice · php.net – releases · Root.cz · GHSA-w8hw-w9fx-j79w · GHSA-6wmf-4rv5-p3rp · Censys

A bakery, WhatsApp and AI: how I automated orders for fresh bread

2026-10-19T00:00:00.000Z

Say "order automation" and most people picture an online shop or processing large enquiries from email. But what do you do with a product that is too small for an online shop and too perishable for paperwork? Fresh sourdough bread, for example.

How it all started

I have been working with Michal Konečný as his personal technical adviser for some time now. Recently he described a problem that other producers with a narrower range of products may recognise too.

He has two kinds of customers: regular and occasional. The regular ones run themselves. The occasional ones, though, mean the same round every day: offer what will be available on which day and how much, wait for a reply, and write down whether the customer confirmed, changed or cancelled. Over WhatsApp or on the phone.

Every new customer added a bit more work. The time spent checking grew linearly with their number, at exactly the moment Michal should have been baking.

Why vibe coding was not enough

Michal had already tried to simplify part of the process with AI agents himself. It half worked, and orders got lost in the gaps. You cannot build a fully debugged automated system by vibe coding. Or you can, but at the cost of the vibe coder's mental health. :D

The solution: an admin panel + WhatsApp

I designed an admin panel connected to his website, where Michal sets up his customers and their parameters. The rest runs on its own:

In the morning, the system sends the occasional customers an offer through the WhatsApp Business API.
With one button, the customer confirms the order or chooses Change.
The result is written into the system and the bakery knows exactly how much of what to bake. No phone calls and no copying things by hand.

A sample template of the morning message with a proposed order (in Czech).

But people are not buttons

In an ideal world, that would be enough. In the real world, a customer says: "Today I want two more loaves and no rolls." That is why there is a Change button.

The customer simply writes what they need. And here is the catch: everyone writes differently. Some use abbreviations, some make typos, some write a whole paragraph. Expecting customers to follow an exact format is a utopia.

This is where AI comes in:

If the system recognises the message by its format, it processes it straight away.
If not, it sends the text through an API to a language model, which extracts a predicted order from it.
The system sends that back to the customer on WhatsApp for confirmation.
The customer confirms or corrects it, and the loop repeats until the order is right. 🔄

So the AI never decides on its own. It only translates human language into structured data, and the customer always has the final say.

The order life cycle from the morning offer to the baking plan (labels in Czech). Click to open the diagram at full size.

The result

Michal no longer spends his mornings calling around and copying orders. Customers order where they already are, on WhatsApp. And every day the bakery knows exactly how much to bake.

Automation does not have to mean a big online shop. Sometimes all it takes is a well-designed process, one communication channel and AI used exactly where rigid logic fails.

Will software engineers disappear? Take a look at an old drafting room

2026-09-15T00:00:00.000Z

Almost every week I read that AI will soon replace programmers. Sometimes from people who sell AI, sometimes from people who are afraid of it. Whenever I think about it, one old photograph keeps coming back to me.

A drafting room in the mid-20th century. Every line was drawn by hand, and a single project needed a whole hall of people.

The drafting room disappeared, the drafter stayed

Before CAD, every technical drawing was made by hand. Every line, every dimension, every correction. When the brief changed, the drawing was redrawn. That is why car makers and aircraft plants had entire halls full of drafting tables.

In the 1980s and 1990s, computers and CAD arrived. Work that used to need a hall is now handled by a few people at their screens. And yet the profession did not disappear. In 2025 the US Bureau of Labor Statistics (BLS) still counts about 180,000 drafters and expects roughly the same number in 2035. As the reason why their numbers are not growing, it names CAD and BIM: they raise productivity and let engineers and architects do much of the work themselves.

So the drafter did not die out. The job changed. Instead of drawing lines, drafters model, check and coordinate. And more drawings are produced than ever, just by fewer hands.

What people in the field say

Opinions differ a lot, so here are just a few voices I find important.

Dario Amodei (Anthropic) said in Davos in January 2026 that within six to twelve months AI models could do "most, maybe all" of what software engineers do today. He also mentioned that some of his engineers no longer write code themselves, they only edit what the model produces. At the same time he admitted he is not sure how fast it will happen.

Grady Booch, one of the fathers of UML and now IBM's Chief Scientist for Software Engineering, sees it the opposite way in a February 2026 episode of The Pragmatic Engineer podcast. In his view, a "third golden age of software engineering" is beginning. Programmers feared for their jobs when compilers and higher-level languages arrived too, and AI is just another layer of abstraction. His summary: your tools are changing, but your problems are not.

And the data? In 2025 the BLS counts more than 1.7 million software developers and expects their number to grow by 10% by 2035. A Stanford study (Brynjolfsson et al., 2025) so far mainly sees one thing: in the occupations most exposed to AI, developers among them, employment of people aged 22 to 25 fell by about 13%, while for more experienced colleagues in the same occupations it held steady or kept growing.

What I think

AI writes a large part of my code today. But what it writes, I first had to think through, explain, check, and then take responsibility for. Just like with the bakery taking orders over WhatsApp: the AI translates, a human decides.

What I think is disappearing is turning a clear brief into code. Forms, CRUD, repeated patterns. Exactly the things juniors used to learn on. And that is the uncomfortable part: if the work people started on disappears, where will future seniors come from? Drafters had to solve this too. The way into the field changed, it did not close.

Everything around it, on the other hand, is gaining value. Understanding what the client really needs. Designing a system that lasts. Spotting when the AI generated nonsense that only looks good. Security, testing, operations. And communicating with people who do not want to know anything about software.

On top of that, when software gets cheaper, more of it gets made. A small bakery could not have afforded a custom system before; today it is an ordinary project. There will be more and more projects like that, and someone has to design and build them so that they work.

Conclusion

The drawing board disappeared. The drafter stayed, just doing different work, with fewer of them per drawing. I think software will go a similar way. A programmer who only turns briefs into code really is in trouble. An engineer who understands the problem, the system and the people it all revolves around will still be needed. Maybe even more than today.

Sources

A year at SMS finance, the arrival of Stelar Holding and four days of AI

2026-07-08T00:00:00.000Z

The past month was so packed with events that I never got round to writing regular updates. So it turned into one big summary that I want to share. Three major milestones are behind me.

1. A year with SMS finance, a.s.

It is exactly a year since we started developing and modernising the company's internal systems. My balance after twelve months is more than positive.

Not only in IT do you come across all kinds of approaches, from projects where ego mattered more than results, or where the basic prerequisites for leading people were simply missing, to genuinely healthy environments. That is why I appreciate the current setup all the more. There is excellent organisation here and leadership built on the abilities of people who really have what their roles require.

2. The arrival of Stelar Holding, a.s. and a new era

The big turning point came at the conference marking the company's 25th anniversary, where the launch of Stelar Holding, a.s. was announced. At the same time, SMS finance, a.s. became fully part of the new holding as Stelar Advisory a.s.

For our IT team this was initially a big unknown and, honestly, a bit of a scare, mainly because of the ties to the EAG group and its strong technical team. But the reality of implementation is often different from the first presentation. Instead of a threat, this change opened the door to new ways of looking at our work, to new technologies and to interesting challenges.

3. An intensive four-day AI workshop

It was all rounded off by a team AI workshop. Each of us presented our own methods and showed how we actually use AI tools in everyday work. We brought the team's know-how to a common level and created an internal playbook.

At the end we met representatives of the EAG group. They shared their practical experience from implementing AI, which is a valuable source of inspiration for us and will help us steer our further development in the right direction.

Spring wardrobe change: Apartmány Luka and SVUMSP get a new coat

2026-05-14T00:00:00.000Z

Websites are a bit like clothes. When you buy them, they fit. Then a few years go by, you change, fashion changes, and one day you realise you are still wearing a jacket you outgrew long ago. It works, nobody complains, but you would rather not show it off.

That was exactly the case with two websites I have a personal connection to. Both were once built from free HTML5 UP templates, both worked, and both asked for a new coat this spring.

Apartmány Luka: from one apartment to three

Apartmány Luka are in Buchlovice, South Moravia, a short walk from the chateau, Buchlov Castle and the vineyards. A place people visit for cycling, wine and quiet.

The old website did not quite match that. It greeted you with a dark screen, a heading and a little circle, with everything else hidden below. It described a single apartment, even though three are available today. And a look at the source code revealed comments like "This is Massively", a greeting from the original template. A coat with the shop tag still attached, so to speak.

The new website is built around what guests actually want to know:

Where is it and how do I get there. The "Navigate to us" button sits right at the top and there is a map at the bottom.
How do I book. Bookings are phone-only, so the phone number is always in sight, one tap away on a mobile.
Which apartment to choose. Luka 1, 2 and 3 each have their own tab with capacity, price and a photo gallery you can browse full screen.
How much and when can I arrive. Prices and check-in and check-out times sit together in one section, no digging through paragraphs.
What to do nearby. The chateau, Buchlov, Smraďavka, Kovozoo, Živá voda, Luhačovice spa, cycle paths. Here the surroundings matter as much as the bed.

The new coat of Apartmány Luka. Grapes instead of a dark screen and the phone always at hand.

Technically it is deliberately simple: a single static page, no content management system, no plugins that need updating every month. The hero photo loads according to the screen size, so a phone does not download a huge image meant for a monitor. The site is fast, has nothing to break and the owner does not have to look after it. For accommodation with a handful of apartments, that is exactly what you want.

SVUMSP: artists deserve a gallery, not a notice board

SVUMSP is the Association of Visual Artists of the Moravian-Slovak Borderland. It has been around since 1990, is based in Uherský Brod, and over the years more than 150 professional and amateur artists have been part of it. People who spend their whole lives thinking about how things look.

Which is why it was a little ironic that their website looked like a neatly kept notice board. I built the old version myself years ago, also on an HTML5 UP template, and it served well for its time. But times moved on. The site felt plain, the artworks had no room to shine, and the texts on the home page could only be changed through me.

I built the new website around three things:

People. The home page opens with a group photo of the members. The association is not an institution, it is a group of people, and that should be visible straight away. Every artist has their own card with a portrait and portfolio, and the Artists section can be filtered.

Art. The gallery got the space it needed; photos open in a large preview and can be browsed. Everything is carried by a calm, warm palette and the classic serif typeface Playfair Display, which suits visual art better than strict technical fonts.

Independence. The association now manages most things on its own. Articles, almanacs, artists, their photos and the texts on the home page, section by section. Nobody has to wait until I have time.

SVUMSP, renewed. People first, then the art, then the history.

Under the hood it is still the proven PHP framework Nette, but everything around it got a proper clean-up.

The Ostrava TechMeetup was an absolute success

2025-11-07T00:00:00.000Z

The Ostrava TechMeetup was an absolute success. The organisation was excellent, and the programme offered both technically rich and informal, inspiring talks. Exactly the kind of mix that keeps you engaged without wearing you out.

The talk worth highlighting

I'd especially like to highlight the presentation by Michaël Pilaeten. It was highly energetic and insightful. It provided a valuable perspective on product and output quality as such, not just the quality of the code or whether the tests pass, but what the person using the product actually gets in the end.

That is a perspective many people often overlook. In development it is easy to focus on the technical side and on our own work, and much less on how the result is perceived by the person it is meant for.

Takeaway

Thanks to the organisers and the speakers. If you get the chance to attend the Ostrava TechMeetup, I recommend it.

Incognito mode: who it hides you from, and who it doesn't

2025-08-14T00:00:00.000Z

A comic that explains incognito mode better than its welcome screen does. Mr. Incognito is still the same browser.

Plenty of people open an incognito window and feel invisible. That gap between expectation and reality led to a 5 billion dollar class action against Google in 2020. Browsers have described the mode more precisely on their welcome screens ever since. Hardly anyone reads it, so here is the short version.

What an incognito window really does

It behaves as if you had launched the browser for the first time on a new computer. Once you close every incognito window, it deletes:

Browsing and search history.
Cookies and site data. They work normally while the window is open; closing it logs you out of every account.
Form data, passwords and addresses for autofill.
The cache.
Permissions for the microphone or camera that you granted a site during the session.

One exception: downloaded files stay on the computer. If nobody else should see them, you have to delete them yourself.

It also works the other way round. Once the window is closed, nobody can recover that session's history from the browser. Not even you.

Who still sees you

The browser cleans up after itself, but the connection itself runs exactly as usual. Incognito mode doesn't encrypt your traffic and doesn't hide your IP address. So you are still visible to:

The website you visit. It knows your IP address, and with it your rough location. As soon as you log in, it knows exactly who you are and links the whole visit to you.
Your internet provider. It sees the domains you connect to, when, and how much data flows.
Your employer or school. On a company network, traffic goes through their servers, proxies and DNS. The admin can watch it in real time, and a work laptop may have monitoring software built right in.
Ad networks. Without a tracker blocker they recognise you even without cookies, by your browser fingerprint: screen resolution, fonts, operating system, hardware.

When it's useful

Despite all that, it's a handy tool. Just for different things than people think:

Someone else's or a shared computer. You leave no passwords or history behind.
Gifts. No telltale ads show up on the family computer.
Two accounts on one service at once. The second account without logging out of the first.
Testing a website. A clean state with no cache and no saved login. I use this daily.
Sensitive searches. Nothing lands in the history or the address bar suggestions.

When you want more

If what you do should stay hidden from your provider or the network admin too, an incognito window isn't enough:

A VPN encrypts your traffic and replaces your IP address with its server's. Your provider no longer sees where you go, and websites only see the VPN.
A browser or extension that blocks trackers. Brave blocks them out of the box; in Firefox and Chrome add uBlock Origin or Privacy Badger.
An up-to-date system and antivirus. No incognito mode protects you from a keylogger or spyware.

Browsers are meanwhile working on the next step: IP address masking, blocking device fingerprints and encrypting DNS queries (DNS over HTTPS), so nobody on the local network sees which domains you load.

An incognito window is a good broom for the traces on your computer. Nothing more, nothing less. Real privacy rests on habits, not on one item in a menu.

CarBase: an information system for used car dealerships that I built on my own

2025-07-21T00:00:00.000Z

Mention a used car dealership and most people picture a lot full of cars and a salesperson in an office. Few people see how much paperwork hides behind every single car. A purchase contract, a brokerage agreement, a power of attorney, income and expense receipts, a windscreen label, the vehicle history. All of it again, by hand, for every car.

How it all started

CarBase began as a commission for one specific dealership. The owner had a clear problem: the paperwork around cars lived half in spreadsheets and half in a drawer, and contracts were written over and over from Word templates. Every typo in a licence plate or VIN then spread across several documents.

The goal was simple: one place for the car, its owner, photos, contracts and receipts, and documents that get generated instead of retyped.

What CarBase does

Vehicle records

Every car has its own card with everything a dealer needs: specification, VIN, licence plate, year of manufacture, MOT validity, mileage, engine power and displacement, fuel, gearbox, body type, number of owners, purchase and sale price, and equipment. Manufacturers, models, fuel types, body types and equipment are lists the dealership manages itself in the settings.

A car moves through the states accepted → advertised → sold, or returned, and every change is written to the vehicle history. You can always trace what happened to a car and when. Vehicles can be filtered and searched quickly.

Photos and files

Photos and documents are uploaded to each car. One photo is set as the main one, the others can be deleted. Deleted files don't disappear immediately; the system can show them and plans for cleaning them up. The home page shows a chart of used storage, so it's clear how much space the photos take.

Clients

Records of clients, both sellers and buyers, linked to vehicles and contracts. For companies, loading details by company ID straight from the Czech ARES business register was in the pipeline.

Contracts and receipts in one click

This was the main added value. From the car and client data, the system generates PDFs:

a brokerage agreement,
a purchase contract that follows the brokerage agreement, so documents come in a logical order,
income and expense receipts with prices taken from the vehicle card,
an issue slip when the car is handed over,
a windscreen label with the vehicle's specs.

Contracts and cars have their own number series, so document numbers follow on and never collide. For anything non-standard there is a custom document with a text editor where the dealership can write whatever else it needs.

Home page overview

After logging in you see how many cars were sold, how many were returned, how many are advertised and how many are waiting to be advertised. Below that is the history of recent changes to cars and the lists of purchase contracts and brokerage agreements.

Under the hood

CarBase is a web application built on the PHP framework Nette with a MySQL database and Latte templates. PDFs are generated with mPDF from HTML templates; the frontend runs jQuery, Naja for AJAX redraws without reloading the whole page, Chart.js for charts and Froala as the text editor. A basic GraphQL API was also prepared for future integrations.

Nothing exotic, but a stable stack that is easy to deploy and easy to maintain.

From one dealership to four

At first the system ran only at the dealership it was built for. Over time it turned out others were dealing with the same problems, and CarBase made it to four customers.

All of this was built back when AI was still in its infancy. No agents, no generating half an application from a single prompt. Every form, every PDF template, every bit of document-chaining logic was written by hand. Analysis, database design, backend, frontend, contract templates, deployment and support. For one person it was quite a grind.

Why it stopped at four

Unfortunately, the conditions at my old job back then didn't allow me to give the project the attention it deserved. There was no room left for further development, sales or new customers, so the number stopped at four and the system wasn't developed any further.

Looking back, I see it as a valuable experience. CarBase showed me what a product looks like from the first meeting with a client to running at several customers, and how important it is to have not just ideas for a product's growth, but also the time and conditions for it. With today's AI tools, a similar system could be built much faster. The essential part, understanding how a dealership really works and turning that into a process, stays the same.