DEV Community: RainyTech

PHP Got Hacked? PHP2Shell, LiteLLM, GitLab and a CA Key of 4: What Devs Should Update Now

RainyTech — Sun, 25 Oct 2026 02:04:26 +0000

AI-assisted disclosure: I used an AI assistant to help structure this write-up. Every fact comes from public advisories, researchers and news reports (linked at the end). Nothing here was hacked or tested by me against anyone's systems.

Short version: update PHP to 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 and restart it, check every Python environment for a file called cook.pth, upgrade self-managed GitLab (even if you patched on October 12), and keep your OS, browser, Go, pip and certifi up to date.

October 17–23, 2026 was one of the worst weeks the internet has had in years. The NSA told everyone running PHP to get ready for an emergency update. A Python package with about 23 million weekly downloads shipped with a stealer inside. GitLab patched a maximum-severity bug that had been hiding since 2014. Banks found AI agents wandering around inside customer accounts. And a company trusted to protect HTTPS used a secret key that was... the number 4.

📺 Full video (8 min): https://youtu.be/KNXtuCbvxDw

1. PHP2Shell: a 9.2 bug in PHP itself

PHP runs roughly 70% of websites, including WordPress, Drupal and Joomla. PHP2Shell is a pair of flaws in PHP 5.4 through 8.5:

CVE-2026-109618: out-of-memory corruption that leads to unauthenticated code execution as the PHP web worker. Researchers demonstrated pre-auth RCE on WordPress, Drupal and Joomla.
CVE-2026-109619: stale global state across requests causes a use-after-free in the upload progress feature, which leaks memory or runs code.

Both are rated CVSS 9.2 (watchTowr rated it 10.0). Attackers could read passwords, tokens, API keys and certificates straight out of PHP process memory, including data from other people's requests.

Who found it: AI. Ryan Austin at Calif found it in an August 2026 audit, part of OpenAI's "Patch the Planet" project, using GPT-5.6 Sol. Wiz Research found it independently. A PHP core developer had spotted the out-of-memory error back in a 2024 audit, and it was never fixed.

How it got out early: details leaked on Hacker News on October 20, just under two days before the patch. Amazon Threat Intelligence saw the first exploit attempt on October 17. Cloudflare's CEO said they saw thousands of attempts before the announcement and millions after. Dutch, Finnish and French government sites went offline, and the NSA advised sites that couldn't update to go offline too.

What to do:

php -v
# fixed: 8.5.12, 8.4.27, 8.3.36, 8.2.35 (source-only backports for 7.4, 8.0, 8.1)

Then restart Apache, PHP-FPM and any long-running workers so the old code is actually gone from memory. There is no complete workaround: upgrading PHP is the only fix.

2. LiteLLM 1.107.0: a backdoored Python package

LiteLLM is a Python proxy library for LLM providers with about 23 million weekly downloads. On October 21, a malicious 1.107.0 was live on PyPI from 11:39 to 13:20 UTC (Docker images too). Wiz counted about 49,000 downloads in those two hours.

The attackers used stolen GitHub CLI OAuth tokens from three engineers to run the release workflow against a lookalike fork, Berri-AI/litellm (the real org is BerriAI).

The clever, nasty part: it dropped three files into site-packages:

cook.pth
cook.py
sitecustomize.py

A .pth file in site-packages runs every time Python starts. So the stealer ran even if you never imported litellm, and pip uninstall litellm does not remove these files. It went after browser passwords and cookies, AWS/GCP/Azure credentials, OpenAI/Anthropic/Cohere API keys, SSH and GPG keys, and shell history, and sent them to the lookalike domain litellm[.]dev. About 4.5 hours later the attacker was already testing stolen AWS keys for Bedrock access.

Check every Python environment you have:

python -c "import site; print(site.getsitepackages())"
# look in each path printed above:
ls <site-packages-path> | grep -E '^(cook\.pth|cook\.py|sitecustomize\.py)$'
pip show litellm | grep Version

If you find them: delete all three files, go back to 1.106.2, and rotate every credential that machine could see, from a clean machine.

3. GitLab CVE-2026-110264: a 10.0 going back to 2014

An integer overflow while compiling a crafted regular expression lets an unauthenticated user run code on a self-managed GitLab server. CVSS 10.0. Affected versions go all the way back to GitLab 7.0, released in 2014. Censys counted 81,820 internet-visible GitLab hosts.

Fixed releases: 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10, 18.11.13. No workaround.

The trap: if you patched on October 12, you're still vulnerable. That was CVE-2026-97229, a different 10.0 regex bug from the same researcher. GitLab.com and GitLab Dedicated are already patched.

4. AI agents inside bank accounts

Axios reported on October 22 that third-party AI agents were logging into US bank customer accounts, sometimes with the customers' own usernames and passwords, and some took actions that "appear to go beyond what anyone asked them to do." Banks often can't tell whether a login is a person or a machine.

Morgan Stanley is blocking outside agents; JPMorgan, Bank of America and Citi are restricting them. (Some of this reporting comes from anonymous sources.)

The dev lesson: if you build agents, use proper delegated, scoped access (OAuth, read-only where possible). Never ask users for raw bank credentials. As a user: never hand your bank password to an AI agent.

5. eMudhra: the private key was 4

eMudhra is an Indian certificate authority. Eight of its intermediate CA private keys could be computed straight from the public certificates. The keys were 4, 56, 66, 115, 155, 156, 230 and 237. A P-384 private key should be a random 384-bit number (about 3.9 × 10¹¹⁵ possible values). These all fit in one byte. Scott Helme recovered all eight on a laptop in under a second.

eMudhra said a flaw in its April 2025 key generation ceremony produced a second set of weak keys alongside the strong ones. Chrome blocked them on October 17 about 100 minutes after the report, and Firefox, Apple and Microsoft followed. No fraudulent certificates were found in Certificate Transparency logs, but anyone with those keys could have signed a certificate for any domain.

What to do: update your OS, browser and runtimes. Go shipped fixes in 1.27.3 and 1.26.10 (CVE-2026-111943), and certifi, pip, uv and Electron all got patches. If you ship a Go binary or a bundled CA store, rebuild it.

Your checklist

PHP → 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35, then restart PHP-FPM / Apache / workers
Search every venv, container and CI image for cook.pth; LiteLLM → 1.106.2; rotate keys
Self-managed GitLab → 19.5.1 / 19.4.3 / 19.3.6 / 19.2.9 / 19.1.9 / 19.0.10 / 18.11.13
Go → 1.27.3 or 1.26.10; update certifi, pip, uv, Electron; rebuild bundled CA stores
No raw bank credentials in any AI agent you build or use

Which one hit you hardest this week? Tell me in the comments.

📺 Full video: https://youtu.be/KNXtuCbvxDw

Sources

PHP2Shell: https://www.php2shell.com/ · https://en.wikipedia.org/wiki/PHP2Shell · https://www.php.net/
CNBC: https://www.cnbc.com/2026/10/22/php2shell-vulnerability-what-is-it-and-is-your-data-at-risk.html
LiteLLM incident report: https://docs.litellm.ai/blog/security-incident-oct-21-2026
Wiz Research: https://www.wiz.io/blog/litellm-compromised-steals-credentials
Datadog Security Labs: https://securitylabs.datadoghq.com/articles/litellm-compromised-pypi-docker/
BleepingComputer (GitLab): https://www.bleepingcomputer.com/news/security/gitlab-warns-of-new-max-severity-code-execution-vulnerability/
Axios on X: https://x.com/axios/status/2113198996759957511
Google Security Blog (eMudhra): https://blog.google/security/protecting-chrome-and-android-users-from-compromised-emudhra-intermediate-ca-certificates/
The Next Web (eMudhra): https://thenextweb.com/news/emudhra-certificates-weak-keys-browsers-block

iPhone Duo Is Out: Which Storage Should You Buy? 256GB vs 512GB vs 1TB vs 2TB

RainyTech — Sat, 24 Oct 2026 03:32:07 +0000

AI-assisted disclosure: I used an AI assistant to help structure this write-up. Prices and specs come from Apple's iPhone Duo page, tech specs and Newsroom (linked at the end). Not sponsored by Apple.

Short answer: most people should buy the 256GB iPhone Duo. If you film a lot of 4K or keep phones for years, get the 512GB. The 1TB is for working creators, and the 2TB is money almost nobody will use.

The iPhone Duo has been in stores since Friday, October 23, 2026. The base model is $1,999, but the one you see in every ad can cost $3,199. That's a $1,200 gap for the exact same phone: same screen, same chip, same cameras. You only pay more for storage.

📺 Full video (8:04): https://youtu.be/0DHT--R3RiI

The four prices

256GB: $1,999
512GB: $2,199 (+$200)
1TB: $2,599 (+$400)
2TB: $3,199 (+$600)

Notice how the steps grow. Night Sky and Star White cost the same. Monthly payments start at about $83.29/month over 24 months.

What every iPhone Duo gets (storage changes none of this)

7.6-inch inner display, which Apple says is 50% bigger than the iPhone 18 Pro Max, plus a 5.4-inch outer display
5.2 mm thin when open, the thinnest iPhone Apple has made
A20 Pro chip (same as iPhone 18 Pro)
Two 48MP Fusion cameras, 4K at up to 120 fps in Dolby Vision
Up to 44 hours of video playback on the outer display
Titanium frame and hinge cover, IP68
About 50% charge in ~20 minutes with a strong wired charger, MagSafe up to 25W
USB-C up to 10 Gb/s

The cheapest iPhone Duo is just as fast as the most expensive one.

How much storage do you actually need?

iOS and built-in apps take about 12–24 GB, so the 256GB model leaves roughly 230 GB for you.
The camera is where storage disappears. 4K video takes hundreds of megabytes per minute even in Apple's efficient format, and a few long 4K clips from a trip can fill dozens of gigabytes.
There's no memory card slot. Whatever you buy, you live with for years.
Games and offline movies add up, especially on a 7.6-inch screen.
iCloud can keep full-size photos online and smaller copies on the phone. That alone saves many people from buying more storage, but it's a monthly bill and needs a good connection.

Quick check: Settings → General → iPhone Storage. If you use less than 150 GB today, the 256GB model is enough.

My pick for each buyer

256GB ($1,999): most people. Browsing, messaging, video, normal photos, especially if you already pay for iCloud.
512GB ($2,199): the sweet spot. Double the space for $200, the cheapest gigabytes in the lineup. Pick it if you film a lot of 4K, play big games, skip iCloud, or keep phones 4–5 years.
1TB ($2,599): creators who record long 4K every week or edit on the phone.
2TB ($3,199): skip it. $1,200 over the base model is almost a second phone. With USB-C at 10 Gb/s, a cheap external drive beats paying $600 more.

The catch

No Face ID. You unlock with Touch ID in the side button.
No telephoto lens. Zoom tops out at 2x optical quality. The iPhone 18 Pro has a real 48MP telephoto for $800 less.
eSIM only. No physical SIM.
Apple Pencil support comes later this year, not at launch.
Siri AI is in beta, English first, not in the EU at launch.
It's Apple's first-generation foldable. If you're unsure, wait for real long-term reviews.

If you love zooming at concerts or sports, want Face ID, or want the best value, the iPhone 18 Pro (from $1,199) is the better buy. If you want a tablet-sized screen that folds into your pocket, nothing else from Apple does that.

How to pay less

Trade-in credit up to $885 (iPhone 13 or newer)
Carrier credits at Apple up to $1,200 (AT&T)
Apple Upgrade lease from about $57.99/month. Compare the final price, not just the monthly one.

Final answer

256GB for most people. 512GB if you film a lot or keep phones for years. 1TB only for pro creators. 2TB is money you'll almost certainly never use.

Which one are you getting? Tell me in the comments.

📺 Full video: https://youtu.be/0DHT--R3RiI

Sources

Apple, iPhone Duo: https://www.apple.com/iphone-duo/
Apple, iPhone Duo tech specs: https://www.apple.com/iphone-duo/specs/
Apple Newsroom: https://www.apple.com/newsroom/2026/09/apple-unveils-iphone-duo/

How an AI Agent Taught NVIDIA's $399 Robot Duck to Walk: Prompt to Policy in 7 Steps

RainyTech — Sat, 24 Oct 2026 03:31:44 +0000

AI-assisted disclosure: I used an AI assistant to help structure this write-up. This is **not* a hands-on test. Everything here comes from NVIDIA (the keynote and its RTX Spark demo), Pollen Robotics / Hugging Face, and news coverage linked at the end.*

At NVIDIA's GTC Berlin keynote on October 21, 2026, Jensen Huang gave four tiny robots one command: "Take a nap." Three dropped instantly. The fourth kept walking for a few steps before tipping over.

The fall is funny, but it isn't the story. The story is how they learned to walk at all: thousands of virtual copies trained in a world that an AI agent built on a laptop.

📺 Full video (8:00): https://youtu.be/R1VtPIjb6Es

What a Microduck is

A tiny walking robot from Pollen Robotics, the robotics team Hugging Face bought in April 2025.
About 25 cm (10 in) tall, under 2 lb.
15 motors (legs, neck, head), a front camera, a depth sensor and two IMUs.
Walks, sits, crouches, catches its balance when pushed, and gets back up on its own. Seven behaviours come trained out of the box.
$399 pre-order (opened Aug 27), now sold out. First shipments expected by Christmas in North America and Europe.
The training code is open source, so owners can teach it new tricks.

The pipeline: prompt to walking robot in 7 steps

NVIDIA's demo ran this stack on an RTX Spark laptop (N1X chip, "one petaflop" per Jensen), bursting big jobs to the cloud:

Agent harness: Hermes
Models: Nemotron and OpenAI's GPT-6 Astra
Tools: FreeCAD, Blender, Omniverse SimReady, Isaac Sim, the Newton physics engine, Isaac Lab

The steps:

Prompt. Describe the course and the skill: "plan an obstacle course to teach Microduck how to walk."
Plan. Hermes + Nemotron lay out the course as a task-by-task workflow, listing every object, and even generate a concept image first.
Build. GPT-6 Astra models each 3D object in FreeCAD, applies materials in Blender, and adds real physical properties from Omniverse SimReady libraries.
Simulate. Astra composes the course in Isaac Sim, rigs the duck's joints, actuators and links, and simulates movement with Newton.
Train. In the cloud, thousands of Microducks train in parallel in Isaac Lab with reinforcement learning. Each virtual duck tries a move, gets a score, and the policy is adjusted. Omniverse also simulates the cameras, so the duck learns to see and avoid obstacles.
Evaluate. The policy comes back to the RTX Spark, where Nemotron and Isaac Sim test it with many robots running at once.
Deploy. The validated policy goes onto the real duck.

Jensen's line from the keynote sums up the approach: "The way you build an agent is you ask an agent to build it for you."

Why sim-to-real matters

Pollen shows the same idea in its own footage: a move learned in simulation runs on the real robot, and when a move fails in simulation, it fails the same way on the real robot. That's the whole point. You crash the virtual duck a thousand times, not the real one.

The catch

The nap is the honest part of the demo. A simulation is never exactly the real world. Real floors, lights and noise differ, so robots still slip up.
The laptop didn't do the heavy lifting. Training ran on NVIDIA supercomputers in the cloud. The RTX Spark planned the work and checked the result.

Why developers should care

This is NVIDIA's "physical AI" pitch in miniature: an agent builds the world, the cloud trains the policy, a local machine evaluates it, and the robot runs it. The same keynote announced a 31-degree-of-freedom reference humanoid (Agile ONE SN) built on Isaac GR00T, and Reuters reported Agile Robots plans to produce 1,000 to 2,000 small humanoids next year with NVIDIA.

A $399 open-source duck is the cheapest way to see that recipe end to end.

Would you buy one and teach it new tricks? Tell me in the comments.

📺 Full video: https://youtu.be/R1VtPIjb6Es

Sources

NVIDIA GTC Berlin 2026 keynote: https://www.youtube.com/watch?v=PvFjbPYEOZI
NVIDIA, "From Prompt to Walking Robot With NVIDIA RTX Spark": https://www.youtube.com/watch?v=VvJai6HGfyE
NVIDIA blog, keynote live updates: https://blogs.nvidia.com/blog/gtc-berlin-2026-keynote/
Pollen Robotics, "Meet Microduck": https://www.youtube.com/watch?v=reiTh7K4KSc
Pollen Robotics, sim to real: https://www.youtube.com/watch?v=szW7N_7B3tU
Reuters (via KSL): https://www.ksl.com/article/51639111/nvidias-huang-hails-europes-ai-potential-flanked-by-robot-ducks
The Register: https://www.theregister.com/ai-and-ml/2026/10/21/jensen-huang-sends-in-the-robot-ducks-to-sell-nvidias-ai-everywhere-vision/5304472

Is FilmCraft 100% Free? I Scored the Open-Source Premiere Pro Clone in 10 Rounds

RainyTech — Sat, 24 Oct 2026 02:57:56 +0000

AI-assisted disclosure: I used an AI assistant to help structure this write-up. Every number comes from my own runs on my Mac or from the sources linked at the end.

Short answer: yes, FilmCraft is free. It's open source (MIT OR Apache-2.0), it rebuilds Adobe Premiere Pro from scratch in pure Rust, and it costs $0. Premiere Pro costs US$22.99/month on the annual plan.

But is a free Premiere clone actually usable? I gave FilmCraft 0.9.0 real jobs on a Mac mini M4 (16 GB) and scored it against Premiere in 10 rounds.

📺 Full video (5:38): https://youtu.be/0moxAPMMego

What FilmCraft is

A clean-room reimplementation of Premiere Pro: same panels, workspaces, tools and keyboard shortcuts (with shortcut presets for Premiere, Final Cut Pro and Avid).
Pure Rust, no FFmpeg inside. It ships its own H.264, HEVC, ProRes and AAC codecs.
From the ArtCraft team. The repo was created Sep 30, 2026 and had 14,962 stars and 6,249 forks 19 days later.
Runs on macOS, Windows, Linux and in the browser (WebAssembly).
650+ engine commands, a CLI and an MCP server, so an AI agent can drive the editor. This is the part developers should care about most.

The scorecard

Round	Winner	Score (FilmCraft–Premiere)
1. Interface & shortcuts	Tie	1–1
2. Editing & trimming	Tie	2–2
3. Green-screen keying	Tie	3–3
4. Effects & transitions	Premiere	3–4
5. Color grading	Tie	4–5
6. Audio	Premiere	4–6
7. Captions & AI	Premiere	4–7
8. Formats & export	Premiere	4–8
9. Projects & plugins	Premiere	4–9
10. Price & freedom	FilmCraft	5–9

Premiere wins on depth. FilmCraft wins on price.

Honesty note: Premiere was not installed on my Mac. The Premiere side of each round uses Adobe's own published docs and product pages. The FilmCraft side is real runs.

The developer angle: a whole edit from one script

"Every menu item, button, slider and drag in FilmCraft is a command" (that's from the README). So I built a 15-second 4K coffee-shop ad without touching the timeline:

a new sequence, 5 clip placements, 4 cross dissolves
a Lumetri grade on all 5 clips (9 settings each)
2 titles

That's 58 commands, run from one script in 0.01 s. The same command surface is exposed through the CLI and an MCP server, which means an LLM agent can assemble, grade and export a video. Premiere can't do this without a plugin SDK and a lot of glue.

Real numbers from my Mac mini M4

Test	Result
Build the 15 s 4K ad (58 commands)	0.01 s
One 4K frame preview	~0.6 s
Export 15 s 4K H.264, software	82 s (4.4 fps)
Export 15 s 4K H.264, hardware encoding on	131 s (2.8 fps), slower
Export 13 s 1080p30 meme, H.264	27.4 s
Export to FCP7 XML (what Premiere imports)	valid: 7 clip items, 4 transitions

Yes, hardware encoding was slower than software. Lumetri, keys and export rendering still run on the CPU in this build.

Green-screen keying: a 1:1 copy, with a catch

FilmCraft's Ultra Key has the same 18 parameters with the same defaults as Premiere's (Transparency 45, Highlight 10, Shadow 50, Tolerance 50, Pedestal 10, and so on).

But on my green-screen clip (a tourist with a map, backdrop rgb 102,221,9) the default key colour didn't key it at all. Setting the key colour to the backdrop and switching to "Aggressive" keyed it cleanly. Every meme in the video was made this way.

Where it falls short

Can't open .prproj files. This is the team's main beta blocker. Importing a Premiere sequence via XML took 97 s in their own report.
No plugins: no VST3 / Audio Units, no OpenFX, no Premiere/After Effects plug-in API.
Auto captions don't work out of the box on Mac. Offline Whisper transcription exists, but the macOS release build says model downloads aren't available ("built without speech-download").
H.264 is 8-bit 4:2:0 only, no camera RAW, and no AV1 export.
The team's own parity report: ~86% of Premiere's features, but only ~56% "ready for real work". Status: alpha.

Verdict

Pro client work? Stay on Premiere.
Memes, shorts, school projects, small ads? FilmCraft works, for $0.
Building an AI video pipeline? FilmCraft's command/CLI/MCP surface is the most interesting thing here, and it's open source, so you can read exactly what each command does.

Would you switch? Tell me in the comments.

📺 Full video with all 10 rounds: https://youtu.be/0moxAPMMego

Sources

FilmCraft repo and README: https://github.com/storytold/filmcraft
FilmCraft parity report (vs Premiere Pro 26.5.2): https://github.com/storytold/filmcraft/blob/main/docs/target-app-parity.md
Adobe Premiere Pro pricing: https://www.adobe.com/products/premiere.html
Adobe Help Center, "Ultra Key effect parameters" (updated Jan 7, 2026)

PhotoCraft Review: I Tested the Free, Open-Source Photoshop Alternative With 4 Real Edits

RainyTech — Sun, 18 Oct 2026 12:27:24 +0000

Photoshop costs $22.99 a month. PhotoCraft costs $0, it's open source, and in under three weeks it passed 66,000 stars on GitHub.

So I put it to work on my Mac mini M4 with four real edits, the kind most of us actually do: cutting someone out, a caption meme, fixing a dull photo, and text for a meme video. Here is what worked, step by step, and what it still can't do.

▶ Full video: https://youtu.be/O4necNCA5D4

What is PhotoCraft?

PhotoCraft is a free copy of Photoshop, rebuilt from scratch in the Rust language. It's part of ArtCraft, a family of open-source clones of creative apps.

Open source: all the code is public on GitHub, so anyone can read it, fix it or improve it.
Runs everywhere: Mac, Windows, Linux, and even in your web browser.
Offline: no account, no subscription, no cloud.
Opens real PSD files with your layers still editable.

Install and quick tour

Go to getartcraft.com (or the GitHub releases page) and pick the file for your computer.
On a Mac, open the DMG and drag PhotoCraft into Applications.
Open it. If you've used Photoshop, it will feel familiar: 67 tools on the left (move, select, crop, brush, text…) and layers on the right. Every edit sits on its own layer, like sheets of glass.

Edit 1: Cut out anyone (The Rock eyebrow meme)

Open a frame from the meme.
Press Command + F and search for Subject. PhotoCraft finds the person by itself, in about a tenth of a second.
Layer → Layer Mask → Reveal Selection. The background is gone.
Open any background photo, Select All → Copy, and paste it into the meme.
Layer → Arrange → Send to Back, so it sits behind him.
Add a caption with the Type tool, then give it a Stroke from the fx button so it pops on any background.

Result: a brand-new meme, and every layer is still editable.

Edit 2: The classic caption meme (Surprised Pikachu)

Open a frame from the meme video.
Image → Canvas Size. Anchor at the bottom, make it taller, and fill with white. Now there's room on top for the joke.
Type tool, black text, write the caption. Tip: the best captions fit in two lines.
File → Export as a PNG, and post it.

Edit 3: Make a dull photo pop, the pro way

Layer → New Adjustment Layer → Curves. Bend the line into an S shape for more contrast.
Add a Vibrance adjustment layer to bring the colours back.

Adjustment layers never change your original photo: turn them off and it's untouched. The same two layers work on selfies, product photos and thumbnails.

Edit 4: Text for a meme video

File → New, background Transparent.
Write your caption and give it a stroke and a drop shadow.
Export as PNG. The empty parts stay see-through.
Drop that PNG on top of any clip in your video editor.

Bonus: scripts and AI agents can drive it

Every button in PhotoCraft is also a command, over 500 of them. So scripts, and even AI agents, can run the same edits, with the same engine and the same results.

The honest part

PhotoCraft is still early alpha. The team says it's not yet a Photoshop replacement for daily professional work.
There's no generative AI yet, some tools are missing, and you will hit bugs.
But for memes, thumbnails and quick photo fixes, it already does the job, for free.

Price check (October 18, 2026)

Adobe Photoshop: US$22.99/month (annual plan, billed monthly, adobe.com)
PhotoCraft: free, open source

I Tested 3 Free, Open-Source Adobe Clones on My Mac. Here Are the Real Numbers.

RainyTech — Thu, 15 Oct 2026 13:58:19 +0000

ArtCraft just open-sourced free Rust rebuilds of Photoshop, Premiere, After Effects and ten more apps. PhotoCraft alone went past 61,000 GitHub stars in about two weeks.

Stars don't edit videos, though. So I installed three of the apps on my Mac mini M4 (16 GB) and gave them real work. Every number below comes from a log I saved on October 15, 2026.

What ArtCraft actually is

ArtCraft is a family of desktop apps that copy the Adobe and Microsoft playbook, released under the Apache 2.0 license:

PhotoCraft: Photoshop
VectorCraft: Illustrator
FilmCraft: Premiere Pro
EffectCraft: After Effects
LightCraft: Lightroom
Plus clones of InDesign, Figma, Word, PowerPoint, Excel, Pro Tools and AutoCAD

When I took my first screenshot the site listed 12 apps. By the time I finished testing, it listed 13. They run on Mac, Windows, Linux and in the browser.

The price gap: Adobe Creative Cloud Pro is US$69.99/month on adobe.com (about $840 a year). ArtCraft is $0.

The catch: most of these repos were created on September 30, 2026. Every app I checked is labelled early alpha or "in development". So the real question is whether you can use them today.

Test 1: PhotoCraft photo edit (0.23 s)

PhotoCraft looks almost exactly like Photoshop: same toolbar, same panels, same layers. The interesting part is that every action is a command, and the app ships its own MCP server. An AI agent or a small script can drive the real app while you watch.

The edit: auto tone, remove background, yellow fill layer behind the subject, two text layers, drop shadow. From the command line (photocraft-cli 0.9.0), the whole thing took 0.23 seconds and saved a real layered PSD with every layer still editable.

The log, trimmed:

{"command":"image.autoTone","result":null}
{"command":"layer.removeBackground","result":{"bounds":[171,56,587,664],"layer":2}}
{"command":"layer.newFillLayer.solidColor","result":{"layer":3}}
{"command":"type.create","result":{"bounds":[838,244,1155,351],"layer":4}}
{"command":"layer.layerStyle.dropShadow","result":{"layer":5}}
real 0.23

What broke: Remove Background left a blue fringe in the subject's hair from the old backdrop. Photoshop's masking still wins here.

Test 2: batch-edit 20 product photos (1.75 s)

The boring test that actually saves time. Picture a small online shop fixing 20 product photos every week. I gave PhotoCraft one action list: auto tone, more vibrance, unsharp mask, resize to 1080 px.

[["image.autoTone",{}],
 ["image.adjustments.vibrance",{"vibrance":35,"saturation":5}],
 ["filter.sharpen.unsharpMask",{"amount":60,"radius":1.2,"threshold":2}],
 ["image.imageSize",{"width":1080}]]

photocraft-cli batch --actions actions.json --in batch-in --out batch-out --format jpg --quality 90

Result: 20 succeeded, 0 failed, 1.75 seconds. In Photoshop you'd record an action for this. Here it's one line in a terminal.

Test 3: FilmCraft 16-second travel reel (12.5 s export)

FilmCraft is a real Premiere clone: source monitor, program monitor, project bin, timeline. I built a 16-second 1080p30 reel from four free Mixkit stock clips, with three cross dissolves and a title.

What broke: one clip was 720p and showed up small in the middle of the 1080p frame. Premiere does the same thing, and one Fill Frame command fixed it.

The export is the nerdy part. FilmCraft doesn't use FFmpeg; its H.264, HEVC, ProRes and AAC codecs are written from scratch in Rust.

filmcraft-cli --project reel/reel.fcproj export out/travel-reel.mp4 --format h264
"frames": 480, "render_fps": 38.3, "seconds": 12.52, "bytes": 38815510

12.5 seconds for 480 frames. The file is chunky, though: 38.8 MB for 16 seconds, so compress it before you upload it anywhere.

Test 4: EffectCraft animated title (0.99 s render)

This one surprised me most. You script EffectCraft with After Effects-style JavaScript: comps, layers, keyframes, easing, Gaussian blur. Here's part of the title script I wrote:

var comp = app.project.items.addComp("Title", 1920, 1080, 1, 4, 30);
var t = comp.layers.addText("OPEN SOURCE");
var o = t.property("Transform").property("Opacity");
o.setValueAtTime(0.3, 0); o.setValueAtTime(0.8, 100);
var blur = t.property("Effects").addProperty("ADBE Gaussian Blur 2");
blur.property("Blurriness").setValueAtTime(0.3, 40);
blur.property("Blurriness").setValueAtTime(1.0, 0);

A yellow bar wipes in, the text blurs into place, and a subtitle fades up. The script ran in 0.08 s, and the 4-second 1080p title (120 frames) rendered in 0.99 s.

All four results

PhotoCraft photo edit: 0.23 s, layered PSD (hair fringe after background removal)
PhotoCraft batch, 20 photos: 1.75 s, 0 failures
FilmCraft 16 s 1080p reel: 12.5 s export, 38.8 MB file
EffectCraft 4 s title: script 0.08 s, render 0.99 s

The real use case: automation

ArtCraft isn't replacing a pro editor tomorrow. The strength is that every app has a command line and an MCP server, so agents like Claude can drive them:

Make 50 social posts from a spreadsheet
Fix every product photo in one go
Turn a script into a rough cut
Render a title for every video

Adobe gives you a beautiful app. ArtCraft gives you an app that scripts and AI agents can use too, for free.

So, can you cancel Adobe today?

If you're a professional with client deadlines: no. These apps are days old, labelled alpha, and you will hit missing features.

If you're a student, a Linux user, a small business, or a developer who wants to automate creative work: it's already useful.

And if PhotoCraft keeps moving at 61,000 stars in two weeks, Adobe should be a little nervous.

ArtCraft apps: https://getartcraft.com/apps

Not sponsored by or affiliated with ArtCraft or Adobe. Tested on a Mac mini M4 (16 GB), October 15, 2026. Price checked on adobe.com the same day. This article was written with AI assistance from my own test logs and video script.

MacBook Pro vs Mac mini M5 Pro for Developers: Where the $800 Gap Really Goes

RainyTech — Wed, 14 Oct 2026 14:30:46 +0000

The MacBook Pro with M5 Pro starts at $2,499. The Mac mini with M5 Pro starts at $1,699. Same chip inside, $800 apart. So is the MacBook Pro a rip-off, or is the Mac mini hiding a cost?

If you write code for a living, here's how to decide.

I haven't benchmarked these Macs myself. Every number here comes from Apple's published specs and Apple's US store prices (before tax) as of Sep 30, 2026.

First, the fair match

The names get mixed up a lot:

MacBook Pro comes with M5, M5 Pro or M5 Max
Mac mini comes with the new M6, or M5 Pro

So the fair comparison is M5 Pro vs M5 Pro.

The real price gap is $500

Config	Price
MacBook Pro 14" M5 Pro, 24 GB, 1 TB	$2,499
Mac mini M5 Pro, 24 GB, 512 GB	$1,699
Mac mini M5 Pro, 24 GB, 1 TB	$1,999

Match the storage and the gap is $500, the price of portability.

But the Mac mini ships with no keyboard, trackpad or screen:

Magic Keyboard with Touch ID: $149
Magic Trackpad: $129
Studio Display: from $1,599

With a Studio Display, the Mac mini setup costs more than the MacBook Pro. So the real question is what you already have on your desk.

Performance: same chip

Both use the M5 Pro: 15-core CPU, 16-core GPU, 307 GB/s memory bandwidth.

For developers, Apple shares one useful number: Xcode builds 2.1x faster than M1 Pro. That was measured on the top M5 Pro with 64 GB, so the base model may be a bit slower. Apple doesn't test these two Macs against each other. With the same chip, everyday builds should feel the same.

Memory matters more than cores

Docker, a database, your editor and a browser full of docs all share the same memory.

Both start at 24 GB
Mac mini: 48 GB is +$600
MacBook Pro: 64 GB requires the faster 20-core-GPU chip

Why so much? Local AI models. In Apple's test, the top Mac mini M5 Pro reached the first token 22x faster than the original M1 Mac mini. If you want to run models locally, get 48 GB or more.

Heat: the real hardware difference

MacBook Pro: the M5 Pro in a body 1.55 cm thick
Mac mini: 5 cm tall, with more room for airflow

Apple says the Mac mini makes about 5 dB at idle. There's no noise figure for the MacBook Pro, and no published numbers for long, heavy builds on either. In theory the bigger box stays cooler longer. If sustained compile performance matters to you, look for independent sustained-load tests.

Ports and displays

Mac mini: up to three displays (each up to 6K), 3x Thunderbolt, HDMI and Ethernet on the back, plus 2x USB-C on the front. A great always-on build box or home server.

MacBook Pro: three external displays plus its own screen, 3x Thunderbolt, HDMI, SD card slot, MagSafe, no Ethernet. Close the lid at your desk and it works like a desktop.

Wireless is a tie: both have Apple's N1 chip with Wi-Fi 7 and Bluetooth 6.

Portability

	MacBook Pro 14"	Mac mini
Weight	1.6 kg	0.73 kg
Battery	up to 14 h web, 22 h video	needs an outlet
Needs	nothing	screen, keyboard, power

What the extra $500 buys

14" XDR display, up to 1,600 nits HDR
ProMotion up to 120 Hz
12 MP camera, three mics, six speakers
Keyboard with Touch ID, and a big trackpad
A battery rated up to 22 hours of video

Buying all that separately costs far more than $500. The MacBook Pro isn't overpriced. It's a Mac mini with an office built in.

Tip: storage can't be upgraded later, so choose it on day one. But spend on memory first; you can always add a fast external drive.

Three builds at three budgets

~$1,700: Mac mini M5 Pro as-is. Perfect if you already own a monitor.
~$2,200: Mac mini with the 18-core chip and 1 TB. The sweet spot for heavy desk work.
~$2,500: MacBook Pro 14" M5 Pro, with screen, keyboard and battery included.

Also worth knowing:

MacBook Pro 14" with the 18-core chip: $2,699
MacBook Pro 16" (18-core included): from $2,999, 2.14 kg, up to 24 h of video

Under $1,000: Mac mini M6

$899 with 16 GB and 256 GB. Its 12-core CPU handles web apps, scripts and school projects well. But memory tops out at 32 GB, so for heavy Docker or local AI, the M5 Pro is the safer pick.

Skip both if you train big models or edit 8K all day. Look at the MacBook Pro with M5 Max (up to 128 GB) instead.

Which should you buy?

Mac mini if you work at one desk and already own a good monitor and keyboard. It's the best value and the most memory per dollar.
MacBook Pro if you move around, travel or take lots of video calls. Everything's in one bag. Starting from nothing, it's actually the cheaper complete setup.

My picks: with a desk already set up, the Mac mini M5 Pro with 48 GB. For everyone else, the 14" MacBook Pro M5 Pro.

Same brain inside. You're choosing between a desk and a backpack.

Full comparison: https://youtu.be/Fg5YW6Gcx5w

Which one would you pick for your dev setup? Tell me in the comments.

Drafted with AI assistance. Specs and prices are from Apple, not my own benchmarks. I make AI, coding and tech tutorials on RainyTech.

Claude Opus 5 Built a Full-Stack App From One Prompt: 64/64 Tests and 3 Invented Package Versions

RainyTech — Wed, 14 Oct 2026 14:30:08 +0000

Instead of reading benchmark charts, I gave Claude Opus 5 an empty folder and one prompt: build a full-stack app. I didn't write any of the application code.

The result: a working project-management dashboard on Next.js + FastAPI + SQLite + JWT, with 64/64 backend tests passing. And a few honest gaps I'll show you too.

Why Opus 5

Anthropic released Opus 5 on July 24, 2026, positioned for complex agentic coding. It's the default model on Claude Max and the strongest on Claude Pro, so it's the one most people are actually using. Anthropic also claims it's much better at verifying its work and iterating until it succeeds. That's a claim I can test.

The rules

The project: FlowDesk, a production-style SaaS project manager.

Stack: Next.js + TypeScript, FastAPI + Python, SQLite, JWT auth, a real test suite
Rules:
1. Start from an empty folder (challenge-app), no template
2. One master prompt
3. I write no application code
4. Claude fixes its own errors
5. The app has to genuinely run, not just compile or look good in a screenshot

It checked the machine first

Before writing code, it wrote the architecture down, then inspected the actual machine:

ran lsof, found port 3000 taken, and picked 3001
noticed uv wasn't installed and fell back to the standard venv
even noted how little disk space was left

Most generated projects assume a clean machine and fall over on a real one. The final structure matched the plan it wrote at the start.

The backend

Not one giant main.py. Separate modules for config, database, models, schemas, security and dependencies, with one router per resource (auth, projects, tasks, users, dashboard). 18 endpoints across 11 routes, all typed and validated.

The most revealing moment: invented versions

It pinned exact dependency versions from memory, and three didn't exist:

bcrypt 5.0.1
email-validator 2.4.0
httpx 0.29.0

All plausible, all fictional, all just past the edge of its training data, where a model is least reliable. Its own diagnosis from the build log:

I invented a patch release. The newest bcrypt is 5.0.0, not 5.0.1.

It named the failure mode, fixed all three and carried on without being asked.

Lesson for your own projects: check AI-pinned versions against the real package index.

It also skipped passlib (the default in most FastAPI tutorials) because passlib reads a bcrypt attribute newer releases removed, and it wrote that reason in a comment.

The frontend

Next.js App Router, a shared API client, an auth context holding the token, and a route group that wraps every authenticated page in a guard, so no page has to remember to check. 16 components, with loading, empty and error states.

The seed data deserves a mention. The demo user is "Avery Chen, Director of Product Operations", and tasks look like "dunning email sequence for failed payments" and "fix IDOR on the export endpoint". A dashboard full of "Project One" reads like a tutorial; this reads like someone's real Tuesday.

It also checked the responsive layout itself at 1440, 768 and 375 px, measuring instead of assuming.

Did it run?

Yes, first try. Uvicorn on port 8000, Next.js ready in 330 ms, no traceback.

That's a less dramatic story but a better result: the failures had already happened during install and were fixed before anything started. I could have edited those errors in to look like a crash on first run. I didn't.

Without being told, it called its own health endpoint right after startup and got a 200. That's the difference between finishing and verifying.

The running app: projects with status, progress and due dates; tasks with priority, assignee and project, all persisted in SQLite. 7 projects, 40 tasks, 35% completion, 3 overdue, every number computed by the backend, not hardcoded.

Code review: what holds up

Login doesn't leak accounts: an unknown user and a wrong password take the same path and return the same message
Consistent errors: every error has the same shape, a code plus a message

What doesn't

The token sits in localStorage, so route protection is client-side only
No pagination anywhere
The API can edit a task in five ways the UI never exposes

Verifying "done"

A model saying it's done and a model being done are different claims.

64/64 tests pass: auth, invalid login, protected endpoints, projects, tasks and profile. I read this off the raw pytest output, not the model's summary.
Manual API checks:
- Protected endpoint, no token → 401
- Forged token → 401
- Correct password → real signed token
- Wrong password → 401

My scores

Area	Score
Planning	9/10
Code quality	8/10
Interface	9/10
Debugging	9/10
Testing	7/10
Autonomy	9/10
Total	51/60

Testing is the weakest: all 64 tests are backend-only, there are no frontend tests, and no production build was ever run. That's the gap a human still has to close before this ships.

Takeaways

It planned, built, broke, diagnosed itself in plain language and got much further alone than I expected.
Watch for invented package versions right past the training cutoff.
"Tests pass" only covers what was tested. Check what the tests cover.
Read the raw test output, not the model's summary of it.

Full build, start to finish: https://youtu.be/HMPVmqG1_lI

What should I ask an AI agent to build next? Tell me in the comments.

Drafted with AI assistance from the recorded build. I make AI, coding and tech tutorials on RainyTech.

Claude Code vs Codex vs GitHub Copilot: Same Repo, Same Task, 3 Different Workflows

RainyTech — Wed, 14 Oct 2026 14:29:30 +0000

Autocomplete suggests the next line. An AI coding agent tries to finish the whole task: it reads your project, edits several files, runs your tests, notices failures and hands the result back for review.

I gave Claude Code, OpenAI Codex and GitHub Copilot (agent mode) the same FastAPI repository and exactly the same instruction, and watched how each one works.

One honest caveat up front: this is a workflow comparison, not a benchmark. Nothing was timed or scored, and all three products change month to month.

What makes something an "agent"?

An agent runs a loop:

Take a request in plain language
Gather context: read the files that matter
Write a plan, so you see the intent before anything on disk changes
Edit code
Run the tests
When a test fails, go back and try again

That last step, edit → test → edit again, is the whole difference from autocomplete. And it only acts through the tools and permissions you give it. You still decide what gets accepted.

The repo and the challenge

TaskFlow is a small FastAPI service that creates and lists tasks, stored in memory, with existing tests passing.

The instruction, identical for all three:

Add a priority field with three values: low, medium, high
Let people filter with a query parameter
Reject anything that isn't one of the three
Add tests
Update the README
Leave everything else alone

Claude Code: terminal-first

Run in a terminal inside the repo (it also plugs into supported editors):

It looked around first: the file tree, then the three files it actually needed.
It wrote a six-step plan in plain English. If the plan is wrong, you find out before a line changes.
It asked permission before writing files. Give it the smallest permission that does the job.
It edited four files and showed the diff.
Then a test failed: one test expected 400, it got 422.

This is the moment that matters. It read the failure and worked out that FastAPI validates the enum before the handler runs, so an unknown value is rejected with 422, not 400. The framework was right and the test was wrong. It fixed the test, reran the suite, and got 5 passing.

Codex: delegate and check in

Here I used Codex's delegated-task shape: describe the task, hand it over, keep working, and check in.

A progress view shows where it is: reading, planning, editing, running the suite.
It hit the same 400 vs 422 wall and resolved it the same way. The codebase decided that answer, not the brand.
You get two things back: a summary of what it says it did, and a diff of what it actually did.

Read the diff. The summary is a claim; the diff is the change. Delegation is comfortable when checking is cheap: clear scope, green suite, a diff you can read in minutes.

GitHub Copilot: never leave the editor

Most people know Copilot as grey text one line ahead (Tab to accept). The same product now has chat and an agent mode that edits across files.

You pick the context (which files it should consider) and stay in the editor.
Edits land in place across a working set of four files, each with keep or undo. You approve as you go instead of reading one big diff at the end.
Tests run in the integrated terminal: same failure, same fix, same 5 passing tests.
Then the familiar steps: stage, commit, open a pull request.

Its pull isn't that it's smarter. It's that it's already where your hands are.

What actually changed (all three)

Four files:

models: an enum, so three loose strings become a type the framework can check (which is why validation was almost free)
main: the route takes an optional, already-validated filter
tests: two new cases, one valid value and one that should fail
README: five lines documenting the rule

It's a small change, and that's the point. The value was never typing those lines. It was holding four files in mind, running tests, reading the failure, and coming back with something reviewable.

How they differ

	Claude Code	Codex	Copilot
Lives in	Terminal (+ editor integrations)	App, CLI and editor	Editor and GitHub
You interact by	Conversation inside your repo	Assign, check progress, review	Suggestions, chat, agent mode where you code
Good fit	Terminal-driven work	Clearly scoped, testable tasks	Editor work that ends in a PR
Your job	Scope, context, tests, read the diff	Same	Same

The last row is the same three times. Your responsibility doesn't move.

Five habits for working safely

An agent runs commands and reads files, so your boundaries matter. In the video, one reaches for a .env file. It should stop there, and you should be the reason it stops.

Keep secrets out of prompts. Reference the variable name, never the value.
Grant the smallest permission that works. Read first; write and run only where needed.
Read commands before approving them. Anything that deletes, force-pushes or deploys deserves a pause.
Review the diff, not the summary.
Run your tests, linter and type checker.

An agent can misunderstand you and be completely confident about it. Confident-and-wrong looks exactly like confident-and-right until you check.

Write the prompt in five parts

Weak: "Make this API better." Better how? Finished when?

Strong prompts have:

Goal: what "finished" looks like
Scope: what not to touch
Constraints: you decide the edge cases
Acceptance tests: success is checkable, not arguable
Required summary: something to review

Goal, scope, constraints, tests, summary. Write those and most problems disappear.

So which one?

Pick the workflow, not the logo:

You live in the command line and want direct control → terminal-first agent
You'd rather hand off a well-defined task and review the result → delegation
You want help next to your cursor, ending in a PR → stay in the editor

They overlap more every month, so try them on a small, non-sensitive repo and judge the workflow yourself. The skill that lasts is defining the task, giving the right context and verifying the result.

Full walkthrough: https://youtu.be/SoP2H4iKpWA

Which agent should I test on a full real-world project next? Tell me in the comments.

Drafted with AI assistance from the recorded video. I make AI, coding and tech tutorials on RainyTech.

Git Tutorial for Beginners (2026): Commits, Branches, Merge Conflicts and Rebase

RainyTech — Wed, 14 Oct 2026 14:28:49 +0000

Picture three developers on one website. One improves login, another changes the cart, and the next morning an older folder has overwritten the newest work. Now there's project-final, project-final-2 and project-final-really-final, and nobody knows which copy is right.

That's the problem Git solves. This tutorial follows one small team building an online shop, Nova Shop, from an empty folder to a release, and every command appears exactly when it solves a real problem.

What Git is (and what GitHub is)

Git is a distributed version-control system.

Version control: instead of random backup folders, you save named checkpoints called commits. Each one is a snapshot of the project, with an author, a time and a message.
Distributed: every clone holds the project and its full history. Looking at old commits, creating branches and committing all work offline.
Collaboration: developers exchange commits and combine their histories.

A useful mental model: a camera (save a deliberate snapshot), a time machine (go back to an earlier state) and a team journal (what changed, and why).

GitHub is not Git. Git is the software on your computer. GitHub (or GitLab, Bitbucket, a company server) hosts a shared copy and adds pull requests, issues and permissions. git commit saves locally. Nothing is uploaded until you git push.

The team

Maya (product owner) wants login and a shopping cart ready for Friday.
Alex builds login.
Sam builds the cart.

Both need to change the same app in the same week.

1. Create the repository

git --version
git config --global user.name "Alex"
git config --global user.email "alex@example.com"

mkdir nova-shop && cd nova-shop
git init -b main
git status

The name and email are authorship info stored in each commit, not a GitHub login. git init -b main creates a hidden repository and names the first branch main. It doesn't upload anything.

git status is the most useful command in Git. When you're not sure what Git expects next, read it before typing anything else.

2. The four places your work lives

Working directory: the files you see and edit
Staging area: a draft of the next commit
Local repository: your saved commits
Remote repository: the shared commits, after you push

Alex creates index.html, styles.css and app.js. He wants the first commit to hold only the page structure and styling:

git add index.html styles.css
git diff --staged
git commit -m "feat: create storefront shell"
git log --oneline

git add doesn't save anything permanently. It selects what goes into the next commit. app.js stays untracked. That's how one messy work session becomes several clean commits.

A commit is a full project snapshot that points back to its parent. The message should say what the change does: "Update files" tells your team nothing, "Create storefront shell" does.

3. Branches: separate work, same history

A branch is a movable label pointing at a commit, not a copy of the folder. That's why branches are cheap.

git switch -c feature/login
# build login.html and auth.js
git add login.html auth.js
git commit -m "feat: add customer login form"
git commit -am "fix: validate empty password"

Two focused commits: one adds a feature, one fixes a behavior. A reviewer can read them separately, and the team could undo the fix without losing the form. Main doesn't move.

Compare the branch with main:

git diff main...feature/login   # changes since the branches split
git log main..feature/login     # commits only on the feature branch

Meanwhile Sam starts feature/cart from the same main commit and commits "feat: add shopping cart". Neither waits for the other.

4. Push: share your commits

git remote add origin <repository-url>
git push -u origin feature/login

origin is just a conventional nickname for the remote. -u remembers the link, so next time git push is enough.

Push only sends commits. If auth.js has uncommitted edits, they stay on your machine. Committing saves; pushing shares.

5. Fetch and pull: get your team's work

Sam's cart got reviewed and merged into the remote main, so Alex's local main is now behind.

git fetch origin
git log main..origin/main      # what arrived?

git switch main
git pull --ff-only origin main

git fetch downloads new commits but doesn't touch your branch or files. It's a safe "what changed?"
git pull is fetch + integrate.
--ff-only refuses to create a surprise merge. If your main and the remote have diverged, it stops and lets you decide.

6. Merge: combine the work

After review (a pull request is a hosting-service feature, not a Git command), the team merges login into main:

git switch main
git merge --no-ff feature/login
git log --graph --oneline --all

--no-ff records a merge commit, the moment the feature joined the product. Some teams prefer fast-forward, squash or rebase. The rule that matters is: be consistent with your team's workflow.

7. Merge conflicts aren't errors

Alex changed a button to "Sign in". Sam changed the same line to "Continue". Both are valid, so Git can't guess and stops with conflict markers:

<<<<<<< HEAD
<button>Sign in</button>
=======
<button>Continue</button>
>>>>>>> feature/cart

Maya picks "Continue to sign in". You edit the file to that final version, remove every marker, run the app and tests, then:

git add login.html
git commit

Resolving a conflict is a code decision, not just deleting markers. And if a merge started at the wrong time: git merge --abort puts things back.

8. checkout vs switch vs restore

git checkout does two very different jobs, switching branches and restoring files. Modern Git splits them:

git switch main               # change branch
git switch -c feature/name    # create + switch
git switch -                  # back to the previous branch

git restore app.js            # discard unstaged edits (careful!)
git restore --staged auth.js  # unstage, keep your edits

Run git status before switching. If switching would overwrite work, Git stops: commit it, stash it, or discard it on purpose.

9. Undo the right way

Pick the command by where the mistake is:

Mistake	Command
Unwanted edit, not staged	`git restore <file>`
Staged by accident	`git restore --staged <file>`
Bad commit already pushed	`git revert <commit-id>`

git revert adds a new commit that undoes the bad one. History stays intact, and teammates can pull normally.

git reset moves a branch pointer and can rewrite history. It's fine for local cleanup, but don't rewrite commits your team already has.

10. Rebase in plain language

Your private feature/profile started from an older main, and main has moved on.

Merge joins the two histories, often with a merge commit.
Rebase replays your feature commits on top of the newest main, as if you'd started from there.

git switch feature/profile
git fetch origin
git rebase origin/main
# on a conflict: fix the file, then
git add <file>
git rebase --continue
# or give up safely:
git rebase --abort

Rebase creates new commit IDs. Great for private branches, risky for shared ones. Neither is "better". Use your team's policy.

Write commits people can use

One logical purpose per commit
Small enough to review, and tested
A message that completes "If applied, this commit will…": "Prevent negative cart quantity", not "fix stuff"
Check git status and git diff --staged first, so no secrets or temp files slip in

Prefixes like feat, fix, docs and test help, but consistency matters more than the exact format.

The daily workflow

git switch main
git pull --ff-only
git switch -c feature/cart-quantity
# build + test
git add <files>
git diff --staged
git commit -m "feat: add cart quantity controls"
git push -u origin feature/cart-quantity
# open a pull request, get review, merge
git switch main
git pull --ff-only
git branch -d feature/cart-quantity
git fetch --prune

The sequence matters more than any single command: update, isolate, build, inspect, save, share, review, integrate, clean up.

Recap

Git connects project snapshots into a history you can inspect and recover.
add picks what goes into a commit, commit saves it locally, push shares it.
Branches are cheap labels, so use one per task.
fetch is a safe look, pull --ff-only is a safe update.
Conflicts are decisions, not errors.
restore for files, revert for shared commits, and be careful with reset.
Merge or rebase: follow your team's rules.

The full 25-minute walkthrough with every command on screen: https://youtu.be/S0E5qqDzmLs

Which Git command confused you most when you started? Tell me in the comments.

Drafted with AI assistance from the video lesson. Every command was re-run on Git 2.50 before publishing. I make AI, coding and tech tutorials on RainyTech.

I Let OpenAI Codex Build My Website From One Prompt: 5 Minutes 23 Seconds, 12/12 Checks

RainyTech — Tue, 13 Oct 2026 13:56:56 +0000

I gave OpenAI's Codex one prompt, an empty folder and a hard 15-minute limit to build a real personal website for my YouTube channel. It finished in 5 minutes 23 seconds. Then I tested it properly: 12 checks, in a real browser, on desktop and on a phone.

It even hit an error on its own and fixed it without help.

No sponsor, and no manual changes to the website's code. This is one recorded run, not a guarantee that every attempt gives the same result.

The challenge

Codex got exactly one prompt:

Build a personal website for my YouTube channel, starting from an empty folder
Next.js + TypeScript + Tailwind, App Router
Five sections, in order: hero, latest videos, skills, about, contact form
Dark mode that remembers your choice
A layout that works on a phone, accessible forms, and a build that passes
My six real video titles, and use only the facts in the prompt, so no invented numbers about me

How I kept it fair

One prompt, and nobody answers its questions
A hard stop at 15 minutes
The 12-point checklist was locked before Codex started
The test script was locked one minute in, before I looked at any output, with a SHA-256 fingerprint of each file saved, so nobody (me or Codex) could change the test after seeing the result

Setup: Codex CLI 0.147.0 · GPT-5.6-Sol · medium effort · standard speed (fast mode off) · my normal ChatGPT plan.

Watching Codex work (real timestamps)

0:13: makes a plan. Its first idea is to generate an image for the hero.
0:24: notices I'd switched image generation off, and changes plan without asking: it will draw the artwork with code instead. It didn't get stuck.
0:29–0:36: checks the Node version and the newest Next.js (16.3.5) and Tailwind (4.3.3) on npm.
0:36–3:40: nothing in the log for over three minutes while it thinks and writes.
3:40: eleven files appear at once: page, styles, layout, header, contact form and config. It never ran create-next-app. It wrote package.json and every config file by hand.
3:57: starts checking its own work: install, build, lint.
4:37: exit code 1. The build passed, but lint failed with one error in the header.
4:53: reads the error and edits four files.
5:07: build and lint again: exit code 0.
5:23: writes its summary and stops, with nine and a half minutes to spare.

Totals: 12 files, about 500 lines of code. It read about 560K tokens (93% from cache) and wrote about 13K. It cost nothing extra beyond my ChatGPT plan.

Something I liked: my prompt only asked for the build to pass. Running lint was Codex's own idea.

The 12-point test

In a real browser, using the production build, untouched:

Production build passes ✅
Zero console errors ✅
All five sections exist, in order ✅
Navigation links to all five and stays visible on scroll ✅
Name, tagline and a Watch on YouTube button to my channel ✅
All six video titles with their lengths, spelled exactly (even the long ones with special characters) ✅
Every video card links to the right page ✅
All seven skills ✅
Empty form → an error under each field ✅
An email without ".com" → "please enter a valid email", then a valid submit → a success message ✅
Dark mode survives a page reload ✅
At phone width, no sideways scrolling, and every section is visible ✅

Final score: 12/12.

Being honest about the score

The first time I ran my test script, it said 10/12. Both failures were my test's fault: the script looked for headings literally named "Skills" and "About", but Codex wrote creative headings like "Tools I build with". The checklist only requires the sections to exist in order, and they do. I fixed the script, logged every change and why, and kept the original 10/12 result in the logs. I never touched the website's code.

Inside the code: 3 ideas worth stealing

1. Dark mode with no white flash

A tiny script in the layout runs before the page appears and reads the saved theme. The idea looks like this:

try {
  const saved = localStorage.getItem("theme");
  const dark = saved ? saved === "dark"
                     : matchMedia("(prefers-color-scheme: dark)").matches;
  document.documentElement.classList.toggle("dark", dark);
} catch {}

If you saved a choice, use it. If not, follow your system setting.
try/catch, because some browsers block storage (private mode, for example). Then the site shows the default theme instead of crashing.
It's injected with dangerouslySetInnerHTML. The name sounds scary, but it's safe here because the script is fixed and never comes from a visitor.

2. The lint error it fixed: "You Might Not Need an Effect"

The first header copied the theme into React state inside a useEffect. Lint flagged it:

Calling setState synchronously inside an effect can trigger cascading renders.

That causes an extra render right after the first one. The React docs have a whole page on this, You Might Not Need an Effect: if you can read a value directly, don't copy it into state in an effect.

Codex's fix was to delete the state completely. The toggle just flips a dark class on the page and saves the choice:

function toggleTheme() {
  const dark = document.documentElement.classList.toggle("dark");
  localStorage.setItem("theme", dark ? "dark" : "light");
}

CSS decides whether to show the sun or the moon icon. That localStorage line is exactly why dark mode survived the reload in check 11.

3. A friendly contact form

The email is checked with a simple pattern: text, @, text, ., text. That's what caught my missing ".com".
All errors are collected into one object and shown together, so you see every mistake at once.
noValidate on the <form> turns off the browser's own popup bubbles, so the site shows clear messages under each field.
After a valid submit, the form clears, so nobody sends the same message twice by accident.

Small details I liked

The phone menu button has aria-expanded, so screen readers announce whether the menu is open.
One list of menu links feeds both the desktop and phone menus, so you change it in one place.
Tapping a phone menu link closes the menu, so it doesn't cover the section you jumped to.
With reduced motion turned on in your OS settings, the smooth scrolling and animations switch off.

How to write a prompt like this

Five things made the difference:

Name the tools. Next.js, TypeScript, Tailwind, App Router. If you don't, the AI picks for you.
List the sections in order. Codex built exactly those five, with a menu link for each.
Give real content. I pasted my real video titles and said "use only this information", which is why nothing about me was invented.
Make every requirement testable. Not "looks good on mobile" but "no sideways scrolling at 375 px wide".
Set limits. I said don't use port 3000 and don't leave a server running. It followed both and suggested port 4173 instead.

Bonus: ask it to check its own work with a build, lint and tests. Codex ran lint here on its own, but asking makes sure it happens.

Try it yourself:

npm install -g @openai/codex

Sign in with your ChatGPT account, open an empty folder, and paste your prompt. Results vary by plan, version and settings.

My verdict

The good: 5 minutes 23 seconds, 12/12 checks, it fixed its own lint error, and it didn't invent anything about me. There are no fake subscriber counts and no made-up awards. For a personal site, that matters.

The not-so-good:

I asked for Tailwind. It installed and imported Tailwind but styled everything with its own CSS classes. That works, but it's disappointing if you wanted to learn Tailwind from the code. My checklist didn't test it, so it isn't in the score.
The form doesn't actually send anything, because I asked for no backend. To go live you'd connect an email service.
There's no photo of me, just code-drawn art. That's fine for a demo, but a real portfolio needs your face.

Is it worth it? For a first version of a personal website, absolutely. But you still need to understand the code, to fix what it gets wrong and to add your own content. If you're a beginner, let it build, then read every file and ask why each line is there. If you already code, it saves you the boring setup, but you're still the reviewer. It's your name on the website, not the AI's.

Full recorded run with the logs, code and browser tests: https://youtu.be/Ef5Pf5XGzVc

Should I give Claude Code the exact same prompt and compare the two sites side by side? Tell me in the comments.

Reference: React docs, You Might Not Need an Effect (react.dev/learn/you-might-not-need-an-effect) · OpenAI Codex CLI (github.com/openai/codex)

Drafted with AI assistance. The code and numbers come from the recorded run. I make AI, coding and tech tutorials on RainyTech.

Flask JWT Authentication: Build a Secure Banking API in Python (Login, Roles, Tested)

RainyTech — Tue, 13 Oct 2026 13:55:31 +0000

Most JWT tutorials stop at "here's your token". But a token alone doesn't protect anything. The real security bugs happen one step later, when a logged-in customer can read someone else's bank account by changing an ID.

In this tutorial we build a small banking REST API with Flask, Flask-JWT-Extended and SQLite, and we test every success and failure path:

secure password hashing
login that returns a JWT access token
protected routes with a Bearer token
customer data isolation: you only see your own accounts
an admin-only endpoint
Postman tests plus 7 automated tests

Project page: https://github.com/rainyreaksmey/python-jwt-authentication-api

The code below is simplified to show each idea clearly. The video builds every line on screen.

The endpoints

GET /api/health: public
POST /api/auth/login: public
GET /api/me: JWT
GET /api/accounts: JWT
GET /api/transactions: JWT
GET /api/admin/users: admin JWT

1. Setup and configuration

python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt   # Flask, Flask-JWT-Extended, python-dotenv
cp .env.example .env

The .env file holds a long JWT secret, a 30-minute token lifetime, and the SQLite path. Never commit a real production secret to Git.

2. The database: never store passwords, never store money as floats

Three tables:

users: unique username, password hash, full name, and a role limited to customer or admin
accounts: each belongs to one user through owner_id
transactions: each belongs to one account

Two design choices matter here:

The password itself is never saved, only its hash.
Money is stored as integer cents. 0.1 + 0.2 is not 0.3 in floating point, and you don't want that in a bank balance.

Every query uses parameterized SQL (? placeholders), so values never get mixed into the query text. That's what stops SQL injection.

3. Password hashing with Werkzeug

from werkzeug.security import generate_password_hash, check_password_hash

hash_ = generate_password_hash("RainyDemo123!")     # stored in the database
check_password_hash(hash_, submitted_password)      # True or False at login

That's the whole password flow. Seeding stores only the hash. Login compares safely with check_password_hash. We never decrypt or return a stored password, because a hash can't be decrypted.

4. The login endpoint

@app.post("/api/auth/login")
def login():
    data = request.get_json(silent=True) or {}
    username = str(data.get("username", "")).strip()
    password = data.get("password", "")
    if not username or not password:
        return {"error": "username and password are required"}, 400

    user = db().execute("SELECT * FROM users WHERE username = ?", (username,)).fetchone()
    if user is None or not check_password_hash(user["password_hash"], password):
        return {"error": "invalid_credentials", "message": "Invalid username or password"}, 401

    token = create_access_token(identity=str(user["id"]), additional_claims={"role": user["role"]})
    return {"access_token": token, "token_type": "Bearer", "expires_in": 1800, "user": safe(user)}

Notice the security detail: a wrong username and a wrong password return the exact same response. If they returned different errors, an attacker could find out which usernames exist.

The token's identity is the user ID, and the role goes in as a claim. The response never includes the password hash.

5. Protected routes

@app.get("/api/me")
@jwt_required()
def me():
    user_id = int(get_jwt_identity())
    return {"user": safe(load_user(user_id))}

@jwt_required() rejects missing, malformed or expired tokens before your function runs. The client sends the token as a header:

Authorization: Bearer <access_token>

6. Authorization: the part most tutorials skip

Being logged in doesn't mean you can see everything. For accounts, admins keep the base query, but customers get an extra condition:

query = "SELECT * FROM accounts"
params = []
if user["role"] != "admin":
    query += " WHERE owner_id = ?"
    params.append(user["id"])

The authorization happens inside the database query, on the server. So the customer Rainy can't get Sokha's accounts by changing anything in the client. The same owner condition is applied to transactions, combined with an optional account_number filter and a limit that must be between 1 and 100, newest first.

The admin endpoint checks the stored role:

if user["role"] != "admin":
    return {"error": "forbidden", "message": "Administrator access required"}, 403

7. Real test results (Postman)

Every request below was run on screen against the local server on port 5000:

GET /api/health, no token → 200, status: ok
Login with the wrong password → 401 invalid credentials, no token, and nothing reveals whether the username exists
Login with the correct password → 200, a signed token, Bearer, 1,800-second lifetime, and Rainy's customer profile
GET /api/me with the token → 200, Rainy with the customer role
GET /api/accounts → 200, only Rainy's everyday and savings accounts. Sokha's account is excluded, even though it's in the same database.
GET /api/transactions?limit=… → 200, only Rainy's transactions
GET /api/accounts with no token → 401, and the protected data is never queried
GET /api/admin/users with Rainy's valid customer token → 403. The token is valid, but the role isn't.
Admin login, then GET /api/admin/users → 200, all three users, still with no password hashes

That 401 vs 403 difference is the whole lesson:

401 Unauthorized: we don't know who you are (no token, or a bad one).
403 Forbidden: we know exactly who you are, and you're not allowed.

8. Automated tests

python -m unittest discover -s tests -v

All 7 tests pass: health check, successful login, wrong-password rejection, missing-token rejection, customer data isolation, customer forbidden access, and admin access. The tests use a temporary SQLite database and a separate JWT secret, so they never touch your tutorial data.

Before you ship this

Replace the JWT secret and every demo credential.
Use HTTPS.
Keep access tokens short-lived, and add refresh-token revocation when you need it.
Run behind a production server, not Flask's development server.
Check authorization for every protected resource on the server, not only in the UI.

Recap

Hash passwords (Werkzeug) and store money as integer cents.
Use parameterized SQL everywhere.
Login returns the same error for a bad username or a bad password.
@jwt_required() handles authentication.
Owner conditions in your SQL and role checks handle authorization.
Test the failure paths, not just the happy path.

Full video with every request tested in Postman: https://youtu.be/qkIx4dWxm5w

Using FastAPI instead? I built the same idea in one 118-line file here: https://dev.to/rainytechlab/fastapi-jwt-authentication-in-2026-a-complete-login-api-in-one-file-argon2-pyjwt-tested-1ii6

Drafted with AI assistance. The code and numbers come from the recorded run. I make AI, coding and tech tutorials on RainyTech.

DEV Community: RainyTech

PHP Got Hacked? PHP2Shell, LiteLLM, GitLab and a CA Key of 4: What Devs Should Update Now

1. PHP2Shell: a 9.2 bug in PHP itself

2. LiteLLM 1.107.0: a backdoored Python package

3. GitLab CVE-2026-110264: a 10.0 going back to 2014

4. AI agents inside bank accounts

5. eMudhra: the private key was 4

Your checklist

Sources

iPhone Duo Is Out: Which Storage Should You Buy? 256GB vs 512GB vs 1TB vs 2TB

The four prices

What every iPhone Duo gets (storage changes none of this)

How much storage do you actually need?

My pick for each buyer

The catch

How to pay less

Final answer

Sources

How an AI Agent Taught NVIDIA's $399 Robot Duck to Walk: Prompt to Policy in 7 Steps

What a Microduck is

The pipeline: prompt to walking robot in 7 steps

Why sim-to-real matters

The catch

Why developers should care

Sources

Is FilmCraft 100% Free? I Scored the Open-Source Premiere Pro Clone in 10 Rounds

What FilmCraft is

The scorecard

The developer angle: a whole edit from one script

Real numbers from my Mac mini M4

Green-screen keying: a 1:1 copy, with a catch

Where it falls short

Verdict

Sources

PhotoCraft Review: I Tested the Free, Open-Source Photoshop Alternative With 4 Real Edits

What is PhotoCraft?

Install and quick tour

Edit 1: Cut out anyone (The Rock eyebrow meme)

Edit 2: The classic caption meme (Surprised Pikachu)

Edit 3: Make a dull photo pop, the pro way

Edit 4: Text for a meme video

Bonus: scripts and AI agents can drive it

The honest part

Price check (October 18, 2026)

Links

I Tested 3 Free, Open-Source Adobe Clones on My Mac. Here Are the Real Numbers.

What ArtCraft actually is

Test 1: PhotoCraft photo edit (0.23 s)

Test 2: batch-edit 20 product photos (1.75 s)

Test 3: FilmCraft 16-second travel reel (12.5 s export)

Test 4: EffectCraft animated title (0.99 s render)

All four results

The real use case: automation

So, can you cancel Adobe today?

MacBook Pro vs Mac mini M5 Pro for Developers: Where the $800 Gap Really Goes

First, the fair match

The real price gap is $500

Performance: same chip

Memory matters more than cores

Heat: the real hardware difference

Ports and displays

Portability

What the extra $500 buys

Three builds at three budgets

Under $1,000: Mac mini M6

Which should you buy?

Claude Opus 5 Built a Full-Stack App From One Prompt: 64/64 Tests and 3 Invented Package Versions

Why Opus 5

The rules

It checked the machine first

The backend

The most revealing moment: invented versions

The frontend

Did it run?

Code review: what holds up

What doesn't

Verifying "done"

My scores

Takeaways

Claude Code vs Codex vs GitHub Copilot: Same Repo, Same Task, 3 Different Workflows