Ed Grosvenor and Peter van Dijck survived the PHPocalypse. Peter took his sites down and waited for Laravel Cloud's patch; Ed trusted Cloudflare's mitigations and spent the day patching clients still running PHP 5.6. Their verdict: the PHP community, the PHP Foundation, Laravel and Cloudflare handled it well, Chainguard's early release of embargoed patches did not, and the vulnerability is a reminder that open source supply chain security only works when everyone acts like a good citizen. Also: why it pays to pick providers that own their mistakes.
Then it's on to building. Ed's overnight Solo crash, why he builds everything twice (a ten-minute throwaway first, then a planned build where the domain language is settled in conversation), an MCP-powered kill switch that swaps your PHP sites for a Rust, Go or Cloudflare Worker "back soon" page, analytics and Hone in Rust, and Capstan, Ed's private artifact hosting and PRD hand-off tool. Peter asks the big question: if the models keep getting better, what does a builder's life look like a year from now, and how does it turn into money (or happiness)?
Along the way: a social network launched and pulled in the same week, Railway's API key leak, Claude Docs and vendor lock-in, data as a moat, Our CVEs getting a second life, the three Scalpels Ed would install first, Reddit ads for a DocuSign alternative, and why podcast transcripts are prime training data.
Chapters
00:00 Recovering from the Wednesday madness
02:50 How the PHP community handled it
04:08 Chainguard jumps the embargo
08:20 Don't throw the PHP Foundation under the bus
11:44 Unpatched sites and leaked API keys
13:03 Pick providers that own their mistakes
17:54 A social network launched and pulled in one week
20:15 Solo crashed overnight
21:48 Build everything twice
26:19 Naming things on day one
28:36 Is the launch on track?
30:11 A kill switch for your PHP sites
35:04 Analytics and Hone in Rust, and owning your stack
40:30 Capstan: private artifacts and hand-offs
44:58 Claude Docs and avoiding vendor lock-in
46:04 What does a year from now look like?
53:31 The labs eat SaaS; data is the moat
55:03 Our CVEs gets a second look
57:34 Three Scalpels to start with
1:02:05 Who the front page is for
1:03:28 Reddit, YouTube and content for the models
Links
Artisan Beer: https://artisan.beer
Scalpels: https://scalpels.app
Hone: https://scalpels.app/products/hone
Wake: https://scalpels.app/products/wake
Reel: https://scalpels.app/products/reel
Capstan: https://scalpels.app/products/capstan
Witness (the DocuSign alternative): https://scalpels.app/products/witness
SimpleStats on Scalpels: https://scalpels.app/products/simplestats
Our CVEs: https://ourcves.com
Sputnik Intelligence: https://sputnikintelligence.com
Ed / Artisan Build: https://artisan.build
Peter: https://petervandijck.com
Mentioned
The PHP Foundation: https://thephp.foundation
Laravel Cloud: https://laravel.com/cloud
Laravel Forge: https://forge.laravel.com
Cloudflare: https://www.cloudflare.com
Chainguard: https://www.chainguard.dev
Railway: https://railway.com
Solo by Aaron Francis: https://soloterm.com
Verbs: https://verbs.thunk.dev
Fathom: https://usefathom.com
Hotjar: https://www.hotjar.com
If you enjoyed it, like and subscribe. Peter still insists.
#Laravel #PHP #Security #AI #MCP #Podcast