Yells at Cloud, Episode 4: The Vulnpocalypse

Listen: YouTube · Spotify · Apple Podcasts

Summary

PHP is 31, runs most of the web, and finally made the front page of the Wall Street Journal. All it took was an unauthenticated remote code execution bug. Danielle opens with a goodbye: AWS is ending support for Infrastructure Composer, which grew out of Stackery, the startup she worked at. Chris walks through a week of vulnerabilities: an eMudhra CA private key that was the number 4, PHP2Shell and the Chainguard embargo fight, a Node.js RCE, and the Railway and TiDB breaches. Gunnar brings the one piece of good news, Lambda Web Functions, and asks whether serverless is still meant for humans to understand, or only for agents. And Ken looks at Claude Code agent teams and mods, which the docs say plainly aren't sandboxed.

Burst Mode: Danielle on Eric Mann's Longhorn PHP keynote, The Commit You Can't Take Back, and the day a PM added "destroy" to the dropdown. Chris on the crappy state of MCPs. Ken on recursive self-improvement and why you should write evals instead of prompts. And Gunnar on Mistral, which answered last episode's "are they still around?" with a trillion-parameter model named after a cat meme: Le Chonk.

Timestamps

Main topics

• 0:00: Intro, brought to you by PHP
• 0:35: Check-ins: retro gaming, an MCP gateway, ProductFest
• 3:49: Infrastructure Composer end of support (Danielle)
• 12:28: The Vulnpocalypse: eMudhra, PHP2Shell, Node.js and more (Chris)
• 29:57: Lambda Web Functions: is serverless still for humans? (Gunnar)
• 42:24: Claude is teamin' and modin' (Ken)

Burst Mode

• 52:06: Burst Mode
• 52:32: The Commit You Can't Take Back (Danielle)
• 54:53: The crappy state of MCPs (Chris)
• 57:03: Recursive self-improvement (Ken)
• 1:00:48: Mistral is still around: Le Chonk (Gunnar)
• 1:05:25: What we're looking forward to
• 1:08:32: Wrap

Links

Check-ins

• Portland Retro Gaming Expo
• agentgateway
• ProductFest RVA

Infrastructure Composer end of support

• AWS: Infrastructure Composer end of support
• Danielle Heberling: Pour one out for Infrastructure Composer
• Kiro CLI 3.0

The Vulnpocalypse

• Chris's source: the Bluesky mega thread
• Google: compromised eMudhra intermediate CA certificates
• WSJ: AI found a bug that puts up to 70% of websites at risk
• PHP Foundation: today's security release
• AWS: PHP2Shell exploitation seen in MadPot before disclosure
• Socket: the PHP embargo dispute
• Node.js October 2026 security releases
• Railway security disclosure
• PingCAP (TiDB) security update

Lambda Web Functions

• AWS News Blog: Announcing AWS Lambda Web Functions
• Aidan Steele: Some notes on Lambda Web Functions
• Aidan Steele: Lambda Web Functions as queue consumers
• Bref: serverless PHP on AWS Lambda

Claude is teamin' and modin'

• Claude Code: agent teams
• Claude Code: mods overview
• GeekWire: Amazon blocks Meta's Muse AI assistant
• ABA: Ninth Circuit on Perplexity's Comet agent
• Forklog: OpenClaw deletes a Meta researcher's emails

The Commit You Can't Take Back

• Eric Mann at Longhorn PHP: The Commit You Can't Take Back (recording)
• Slides

The crappy state of MCPs

• AWS MCP Server: multi-account access
• Google Workspace Developer Preview Program
• Microsoft Work IQ

Recursive self-improvement

• Matthew Berman: We need to talk about this...
• Anthropic: When AI builds itself

Mistral Large 4 (Le Chonk)

• TechCrunch: Mistral's new 1T model
• Artificial Analysis: Mistral Large 4
• Decrypt: Le Chonk and the cat meme
• Crypto Briefing: Aleph Alpha Kolibri

Wrap

• You Can See Everything (Nathan Fielder's Elizabeth Holmes film)
• AWS re:Invent 2026

Hosts

• Gunnar Grosch: https://gunnargrosch.com
• Danielle Heberling: https://danielleheberling.xyz
• Chris Farris: https://chrisfarris.com
• Ken Collins: https://metaskills.net

Follow the show

• Website: https://yellsatcloudpod.com
• YouTube: https://youtube.com/@yellsatcloudpod
• Bluesky: https://bsky.app/profile/yellsatcloudpod.com
• Twitter / X: https://twitter.com/yellsatcloudpod