This page was translated from Dutch with AI.
This is how you help build a stronger internet together
Last night Tom Verheyden forwarded me an email from his hosting provider. It warned about a series of security leaks that became known this week. It was about even more security risks related to PHP, about Node.js and about eMudhra, a certificate authority whose keys were stolen. Tom added one line himself:
'Hmmm... seems it does not just stop at PHP.'
With a half awake head I read that this morning with my coffee. I was awake immediately. And my first reaction was actually: yes, we are going to have that more and more. My second reaction was a prompt to my own agent.
This article is about that prompt. Copy it at the bottom of this article and feel free to give it to your own agent.
What was going on this week
I am going to keep it simple for a moment, because the details are quite technical. First there was a certificate authority whose private keys for a number of intermediate certificates were leaked. With those keys someone can pretend to be a website or a service. The padlock in your browser then says that everything is safe, while that is not the case.
After that Node.js released patches for multiple leaks. One of them allows you to bypass the check on certificates. Another leak is in the unpacking of compressed data, and with that someone from the outside can run code on your server.
And then there was PHP. They found two critical leaks in PHP itself there. An attacker does not even have to log in. He can execute code or read pieces of memory, and those often contain passwords, tokens and API keys. Which framework you use does not matter in this case.
What struck me most in that email was one sentence at the end. The provider says that his platform is safe. But everything you put on it, like your software and your secrets, remains your responsibility. I think many people with a website or app do not realise that well. Your hosting provider keeps the building standing, but you have to lock your own door yourself.
I also immediately thought of the people who followed a workshop with me about Claude, AI Agents or Vibe Coding. A number of you have something online yourselves by now, built with what we practiced together. And that is fantastic. Only that software needs maintenance just as much.
What I asked my Webmaster this morning
I work in Craft Agents with a separate workspace for my websites. I call that my Webmaster. That agent knows my servers, my sites and the way I publish. So it was logical for me to ask it there.
Keep reading for free
Register free with your e-mail address and read on. Your account opens the free articles in the learning space; the rest is for subscribers, from Learn Plus up.