Drupal.org vs Forem

After the PHP security release: auditing your Drupal sites

Updating PHP closes the door, but it does not tell you whether anyone came through it first. With honeypot evidence of exploitation attempts from 17 October, four days before the fix was public, here is how the Drupal Association is auditing Drupal.org, and what our research suggests site owners should check on their own servers.

Unsupervised AI agent audited, fixed and documented system

Bryan Williams (DEV Community) ran a small technical experiment to see what an autonomous coding agent does with no task or supervision. He executed three fresh agent runs (prompted with a single "."), instrumented by a safety and verification harness. Across the runs the agent inspected system state, repaired a flaky disk-health check by replacing a PowerShell subprocess with a native fs.statfsSync call (committed as 4192588), and wrote durable memory/lessons. Total measured cost across three runs was $6.96. Williams emphasizes this is an n=3 demonstration on one harness and does not claim intent or generality, but observes an emergent pattern: inspect → repair → document.

• Author Bryan Williams ran three sequential, fresh agent processes with a minimal "." prompt and no assigned task.
• Run 2 committed a real repository fix (commit 4192588) replacing a PowerShell spawn that timed out with a native fs.statfsSync check.
• Total measured cost across the three runs was $6.96 ($1.65, $2.75, $2.56 respectively).

Is “Please double-check before use” an honest AI safety boundary?

Opinion piece by Ali Ulu on DEV Community questioning whether the common AI safety disclaimer “please double-check before use” is a meaningful safety boundary or a way for AI vendors to shift responsibility to users. The author argues that asking users to verify AI outputs assumes they already know enough to validate them, which undercuts the value of AI for unfamiliar topics. The piece suggests matching verification effort to risk and making uncertainty, sources, and limitations more visible, and notes related work on verification layers (e.g., the author’s HUQAN project). The page also includes promoted content about MLH, DEV, and DigitalOcean partnering for Hacktoberfest 2026.

• Article published on DEV Community by Ali Ulu on 2026-08-27.
• The author questions the adequacy of the warning “please double-check before use” for AI and LLM outputs.
• The article recommends matching verification effort to risk and making uncertainty, sources, and limitations visible to users.

Python 3.15 Release Candidate and Highlights

Python 3.15 has reached Release Candidate 1 with the final release expected on October 1, 2026. Key changes include lazy imports for faster startup, UTF-8 as the default encoding, a built-in immutable mapping (frozendict-style), continued JIT compiler improvements with early benchmarks (roughly 8–9% on Linux and larger gains on Apple Silicon), and a new low-overhead sampling profiler called Tachyon. Free-threaded (no-GIL) builds remain opt-in but gain maturity and improved ABI support for C extensions. The release focuses on performance, tooling, and developer experience rather than major language syntax changes.

• Python 3.15 has reached Release Candidate 1; final release expected on 2026-10-01.
• Python 3.15 introduces lazy imports to reduce startup time by loading modules only when needed.
• UTF-8 becomes the default encoding in Python 3.15.