🎉 Introducing `refactorlah` CLI -- fully open source. Agents are surprisingly bad at renaming/moving files. They are doing `git mv`s, then dozens of `grep`s, then hand-editing imports/namespaces/references while burning tokens and wasting time on tiny refactors. The `refactorlah` CLI gives them one boring command instead: `refactorlah move A B` or in bulk `refactorlah move --use-list A,B tests/A,tests/B` Then file/s are moved, and namespaces, imports, references, etc. automatically updated. Ambiguous renames are skipped and reported, so the agent can follow up manually instead of guessing. Support for Go, Python, PHP, Symfony, Twig is landed. A PR for JavaScript, TypeScript, Vite etc. is open. I built and dogfooded `refactorlah` over the last few weeks. It works better for me than keeping an MCP server running in an IDE or making agents struggle through long tool-call chains for basic moves. Still in alpha! Experimental, built with my best buddy Codex, and still dogfooding. More eyes -> more dogfooding -> releasing early. What do you think?

We could re-normalise proudly showing off `index.php` in URLs of PHP powered websites.

One of my agents is having an anxiety attack or something. Its job is quite simple: migrate IndexDB data to external. 1,613,336 records. Very simple schema. All the importers pre-existed. The agent is on it since ~20 hours. It trapped itself in a verification loop or something. I cannot get it to just run the "production" import. Nothing I am telling it can stop it from verifying again "just to be safe" right after. It built its own version of Chrome which is a snapshot of an actual Chrome instance profile -- with a different name; that's where it runs its verifications on. It keeps writing and running tests, creates new backups (274G by now!), and keeps telling itself that it is _almost_ safe to make the final cutover. It's hilarious. 😆

Codex Composer adapting nicely to my writing style.

Positive that PHP will have better funding after this.

Maybe people now start to understand why I believe a no-new-feature-year for PHP would be a good thing. Core has many structural problems; deeply complex problems.

A bloody cyber expert knowing PHP, the language that runs the web, would already be enough. Not asking much, really.

we made it into "Today's News" on Twitter @paulmichaeldev lmao. 😆

Imagine you are spending moths on cracking SSL certs and eventually look at a '4'.

Rich guy who cheaps out with 4 subscriptions instead of paying API prices is mad that plebs get resets.

How likely is it that no one in 20 years has been using the PHP vulnerability? Someone out there is probably pretty pissed. 🫠

Hetzner sent out a reminder to dedicated and cloud server users, to remind them that security is on them. Mail sounds like they talk to someone who runs root servers by accident. First I laughed, then I remembered vibe coders.

My Codex usage is back to normal. Kinda expected I was one of the 40,000 affected accounts. But I did not get any mail or credits. So I guess I got just ripped off undetected for a few days. It's fine. 🫠

Spent two full days on PHP security. One day emergency work, another on some additional hardening. That's 2 days for 2026. It's almost November. Two days are roughly 293 days less than what average Node devs spent on supply chain attacks this year.

You know that when you wanna tweet something but you do not coz you do not wanna jinx it? 😆

The comments below this are hilarious. Japans PM is confusing the whole country by tweeting about the PHP CVE. 😅