PHP2Shell, a pre-auth RCE in PHP itself, was patched Oct 21. Speedtest Tracker, Firefly III, Passbolt, FreshRSS and BookStack all run PHP inside their Docker images.
Which self-hosted apps have it, and why pulling may not fix it yet.
productimpossible.com/articles/php2s…
5/ SolidCraft. Open-source parametric CAD in Rust, on the desktop and in the browser. Constrained sketches, a feature timeline, assemblies, sheet metal, STEP export, and an MCP server so an agent can drive it. Early but usable. MIT or Apache-2.0
solidcraft.io
Top new releases this week (Oct 12 – 18):
1/ Tiny Little Office. A ten-app office suite where the link is the document. Docs, sheets and slides live compressed in the URL, with no accounts and nothing on a server. From Paul Ford's Aboard. MIT
tinylittleoffice.com
5/ BIGWORDS.PAGE. Turns any phone, tablet or TV into a full-screen sign. The message lives in the URL fragment, so there's no server storage, app or account. Countdowns, slides and Wi-Fi QR codes. MIT
bigwords.page
Top new releases this week (Oct 5 – 11):
1/ Nanolathe. Total Annihilation rebuilt for modern computers, in Go. The demo plays in the browser, and the native beta for Windows, macOS and Linux runs the full game from your own files, online play too. MIT
nanolathe.gg
Austin's off-grid mesh now tells beginners to use MeshCore, not Meshtastic. Same $40 radio, but the two networks can't hear each other.
Meshtastic is still the safest place to start. Here's how it compares with MeshCore and Reticulum.
productimpossible.com/articles/mesht…
5/ Pi 1.0. The minimal coding-agent harness reaches 1.0 with Codemode for native MCP, virtual models that route between real ones, and deferred tool loading. 15+ providers, sessions you can branch and share. MIT
pi.dev
Top new releases this week (Sep 28 – Oct 4):
1/ Roborock Local Server. Runs Roborock's cloud on your own network, so the vacuums keep live maps and room cleaning offline. No rooting or mods, works with Home Assistant, undone with a Wi-Fi reset. MIT
github.com/Python-roboroc…
2K Followers 1K FollowingQubble Labs. Verifiable trust for crypto and the AI infrastructure underneath. The work between today's primitives and the 2030s. Not financial advice.
499 Followers 1K Followingm-pepe inadai confirmed pale https://t.co/JjsC20Bdq8. set up shop at https://t.co/LA21puDKPa.
subreme leader, BuDAKe
dean of kenyan hip-hop and sheng studies.
0 Followers 2 FollowingEditor at @prodimpossible. Writing about indie software sustainability, subscription fatigue, and what makes some tools last while others quietly fade.