Simon Willison’s Weblog

My obituary for programming (via) Jeremy Scheff poignantly captures the key loss caused by coding agents for career programmers who enjoyed the puzzle of developing code:

Programming turned into one of the greatest jobs you could imagine. You got paid to work on tricky little logic puzzles. The trickier the puzzle, the more you got paid. But even pretty simple puzzles were worth a lot of money because regular people just couldn't do it! No, they needed us. They would give us a problem and we would solve it the way we wanted. We set the strategy, we made the timeline, we defined what was and was not possible.

If you're a programmer who thrives on building working systems and doesn't care too deeply about the problems solved along the way, LLMs are the gift that keeps on giving.

If directly solving those problems was a big part of your enjoyment, the loss is very real.

# 11:58 pm / programming, careers, ai, generative-ai, llms, coding-agents, deep-blue

eMudhra Intermediate CA Compromise. This is very, very bad news:

The private keys of eight eMudhra intermediate CA certificates have been compromised. They chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome root programs and by many downstream trust stores.

Any software that bundles a list of trusted certificates needs to be updated. This site is tracking software updates via this GitHub repository - Linux distros need to update their ca-certificates packages.

In Python world uv 0.13.4 and pip 26.2.2 and certifi 2026.10.19 have been released with upgraded certificate lists.

# 11:50 pm / encryption, https, pip, python, security, uv

Panache — RTS Belle Époque pour mobile (via) Well this is delightful: I released Battle Drones yesterday under an Apache 2.0 License and there's already a French language fork which reskins the game to take place in steampunk 1900s France and adds an animated intro!

Panache est un jeu de stratégie en temps réel pour mobile et navigateur, dans la France de la Belle Époque (vers 1900) : dirigeables, Fardiers à vapeur, Creusot cuirassés, automates en képi, Gargantua la forteresse marchante — et beaucoup de panache.

You can play Panache here - it's worth clicking that link just to experience the new intro video.

So far it's mostly just aesthetic updates as opposed to gameplay changes. The music has had a French twist added to it as well.

The new steampunk models are so cool!

Here's a page with the original Battle Drones models and that same page with the new Panache alternatives.

This is a comparison of the original and the new design for the Goliath:

# 4:25 pm / game-design, open-source

Today’s PHP Security Release, and How We’re Strengthening PHP Security (via) If you're running anything on PHP it's vital you upgrade - today's updates (across the entire PHP 8.x line) address two remote code execution holes, and there have been exploits circulating since last night, thanks to a leak in the coordinated disclosure process.

This post from the PHP Foundation explain what went so wrong:

On Tuesday, October 20th, at around 15:00 UTC, the two CVE IDs began circulating on online forums and social media. They came with a wrong release time and a wrong CVSS score of 10.0 (the actual score is 9.2). No technical details leaked. In response, the PHP project brought its pre-announcement forward and published it at 19:30 UTC. It also moved the release from October 22nd, 14:00 UTC, to October 21st, 14:00 UTC [...]

As a result of the leak and pre-announcement around 20:00 UTC, Calif, one of the security firms that had reported the issues mistakenly published a video. It showed their proof of concept working against a number of targets and revealed a few additional, though limited, details about the vulnerabilities. Copies of the deleted video started circulating on social media soon after. The video contributed to accelerated development of various PoCs (exploitation proof of concepts), which then increased circulation on October 21st.

This article from the team that discovered the original vulnerability includes a more detailed timeline of the original intended responsible disclosure:

• August 19, 2026: Wiz Research discovers the first PHP vulnerability using Wiz Atlas, Gemini 4 Argon, and GPT-5.6 Sol.
• August 20, 2026: Unauthenticated RCE is confirmed against Drupal.
• August 21, 2026: Unauthenticated RCE is confirmed against WordPress.
• August 24, 2026: Wiz Research reports the vulnerabilities to the PHP security team.
• September 21, 2026: PHP acknowledges the reports and begins developing a coordinated fix.
• October 21, 2026: Patched PHP releases become available.
• October 21, 2026: Public disclosure.

# 6:41 pm / open-source, php, security, ai, ai-security-research