Posts

What a fucking week…. If you’ve been living under a rock this week, two critical RCE vulnerabilities were found in PHP, collectively known as PHP2Shell. This vulnerability allows unauthenticated attackers to remotely execute code on vulnerable web servers without logging in or providing credentials, potentially seizing server control or stealing data. These vulnerabilities affected all PHP versions released over the last decade, spanning back to version 5.4. This was particularly scary because according to Wiz, PHP powers 70% of the world’s websites, including banking and government applications. ...

An apology to start off with! I was too busy having fun in Sydney last week hacking with customers, building agents and agent harnesses to provide last weeks update. I got to experiment with Entra Agent ID and Agent Governance Toolkit, two technologies I’m looking forward to building with more over the next few months. I’ve bought myself a set of Wireless Pro from Rode which I need to test out, so maybe I might give this update on my YouTube channel as well as this blog in the future. ...

Last week I’ve been struggling with some kind of illness. My throat was dry and I couldn’t breathe on Friday, so I took a course of pseudoephedrine medication, bought some strepsils, and a nasal spray just to manage it. I was sick the whole weekend and started to recover just in time for Monday! Being an adult is awesome…. Now those of you who are a little too keen for our robot overlords to consume us might point out that agents don’t get sick, but they can be subject to a wide variety of vulnerabilities. Not the greatest segway into this weeks article, but I couldn’t think of anything else. ...

Last week I talked at NDC Oslo about the OWASP Top 10 for Agents where I showed folks the different ways that agents can be exploited. If you’ve turned the news on recently, you’ve probably heard about AI will kill us all and how we’re all doomed. Call me optimistic, but I think we’re currently in the middle of a hype cycle where AI labs are overstating the abilities of the models, and we’re at a point where we’ve seen how powerful agents can be, but we need to be more serious about the harms agents can do, and how we can mitigate those risks. ...

When I first started using GitHub Copilot, I kept to the chat window, as I wasn’t too comfortable with the idea of using the CLI for long prompts. The chat interface in VS Code was more friendly and intuitive for me, and I felt more in control using the chat UI. Over time, I’ve been using GitHub Copilot CLI more often. As the scope of work increases (and as demand from stakeholders also increases!), I’ve found myself firing up multiple terminals to do multiple different tasks on a project. However, I’ve had to be careful about how I’ve done that, as I didn’t want to have to deal with the trouble of merge conflicts only made worse by overzealous coding agents! ...