EP 65: When An AI Agent Hits a Locked Door

GitHub's new EVP stood up at Universe this week and said the output that matters isn't code, it's completed work. Then the Octoverse report landed: merged pull requests tripled in under a year, to 220 million a month. Commits more than tripled. Two weeks ago I covered a Harvard study that found more AI code and no matching rise in finished work.So which is it?On this episode of The Pro Coder Show, everything is up for grabs. Current readings on new code is off the charts. At the same time, our metrics for making estimates are flat out unreliable. How are we to make sense of it? Tune in and find out!====Don't forget to grab your copy of 12 Rules For Pro Coders today!====Join this channel to get access to perksSTORIES IN THIS EPISODE: 📰- GitHub Blog: Universe keynote- GitHub Blog: Octoverse 2026- Bleeping Computer: critical Linux kernel flaw- Bleeping Computer: Northflank breach and AI API key abuse- Bleeping Computer: Railway warns devs to rotate secrets- InfoQ: The Ladder Is Missing RungsGET MORE: 🎉- HOW do I interview for a job?- A FREE tech ebook: procoder.io/join- Listen on Spotify, Apple Podcasts, and more- BE PROFESSIONAL: store.procoder.ioDISCLOSURE: All opinions stated here are mine and do not necessarily reflect those of any team or employer. Any usage of "Spring", "Spring Boot", "VMware", "Pivotal", or anything else is completely unaffiliated with its owners. From time to time, I may post affiliate links for products I enjoy using; they cost you nothing extra and I may get a small commission.#procoder© 2026 Greg L. Turnquist, All Rights Reserved

This week, the fix for two critical PHP flaws wasn't in WordPress, a plugin, or your framework. It was in the PHP runtime itself. Plenty of teams patch their apps religiously and never look at the layer underneath.On this episode of the Pro Coder Show, I walk through PHP2Shell: what the two CVEs fix, why the underlying problem sat since a 2024 audit, and how word got out before the patch. Then a LiteLLM release that shipped a credential stealer through Python startup hooks, and why a key you deleted in the next commit is still in your git history. A Harvard study finds AI tools raise code volume without a matching rise in completed work, and I dig into whether the average hides who's actually speeding up. Plus Cloudflare's TSRS, a Rust port of the TypeScript compiler that isn't a fork. I wrap up with some Pro Coder commentary on patching, process, and constant change.====Don't forget to grab your copy of 12 Rules For Pro Coders today at https://www.procoder.io/books/12-rules-for-pro-coders/?video=[VIDEO ID]!====Join this channel to get access to perks: https://www.youtube.com/@ProCoderIO/joinSTORIES IN THIS EPISODE: 📰- PHP Foundation postmortem, via Simon Willison- Socket: PHP patches two critical RCE flaws- Cloudflare Blog: WAF protections for the PHP vulnerabilities- Socket: LiteLLM 1.107.0 compromise- InfoQ: Harvard/Jellyfish study on AI coding productivity- Cloudflare Blog: tsrs, a Rust port of TypeScriptCORRECTIONS: 📝- I said 70% of the internet runs on Apache. The ~70% figure is PHP's share of websites whose server-side language W3Techs can identify.- I described LiteLLM as "doing Docker stuff." LiteLLM is a Python library and proxy for calling many LLM providers through one API.ALSO SEE: 👀✅ HOW do I interview for a job? https://youtu.be/oN_B22doViYRESOURCES: 👇- Order your copy of 12 Rules for Pro Coders at https://www.procoder.io/books/12-rules-for-pro-coders/?video=[VIDEO ID] today!GET MORE: 🎉- Get a FREE tech ebook at https://procoder.io/join- Listen on Spotify, Apple Podcasts, and more: https://podcast.procoder.ioDo YOU uphold the Pro Coder motto, BE PROFESSIONAL? https://store.procoder.ioDISCLOSURE: All opinions stated here are mine and do not necessarily reflect those of any team or employer. Any usage of "Spring", "Spring Boot", "Spring Framework", "VMware", "Pivotal", or anything else is completely unaffiliated with its owners. From time to time, I may post affiliate links for products I enjoy using. They don't cost you anything extra, and I may get a small commission.#procoder© 2026 Greg L. Turnquist, All Rights Reserved

Oracle's free window for Java 21 just closed. The Deno team is joining Cloudflare, and the Deno runtime now has a one-year clock on it. And an npm SDK for running AI-generated code in a sandbox shipped with a credential-stealing worm in its install hook.Three different stories, one question: do you know what your systems depend on?On this episode of the Pro Coder Show, I walk through what changed with Oracle JDK 21's license and why "just upgrade to Java 25" is harder to pitch than it sounds, what Cloudflare picking up Deno, Astro, and Vite means for the JavaScript ecosystem, and how the TensorLake compromise ran without anyone importing a thing. Then I dig into the fine print on cheap AI models, from Claude Haiku 5.5's new tokenizer to why spending caps should be on by default, and why open source maintainers like Sindre Sorhus are shutting off outside pull requests. I wrap up with some Pro Coder commentary on staying on top of constant change.====Don't forget to grab your copy of 12 Rules For Pro Coders today at https://www.procoder.io/books/12-rules-for-pro-coders/?video=P3iUNy6mOIQ!====Join this channel to get access to perks: https://www.youtube.com/@ProCoderIO/joinSTORIES IN THIS EPISODE: 📰- Foojay.io: The Java 21 doomsday clock countdown- Deno blog (Ryan Dahl): Deno is joining Cloudflare- Cloudflare Blog: Deno joins Cloudflare- Socket: TensorLake SDK compromise- Simon Willison on Claude Haiku 5.5- Anthropic: Claude Sonnet 5.5- Simon Willison: default hard budget caps- JavaScript Weekly #805 (Sindre Sorhus disables outside PRs)- JEP 540: Simple JSON API (Incubator)ALSO SEE: 👀✅ HOW do I interview for a job? https://youtu.be/oN_B22doViYRESOURCES: 👇- Order your copy of 12 Rules for Pro Coders at https://www.procoder.io/books/12-rules-for-pro-coders/?video=P3iUNy6mOIQ today!GET MORE: 🎉- Get a FREE tech ebook at https://procoder.io/join- Listen on Spotify, Apple Podcasts, and more: https://podcast.procoder.io- Follow me on Twitter: https://twitter.com/procodershowDo YOU uphold the Pro Coder motto, BE PROFESSIONAL? https://store.procoder.ioDISCLOSURE: All opinions stated here are mine and do not necessarily reflect those of any team or employer. Any usage of "Spring", "Spring Boot", "Spring Framework", "VMware", "Pivotal", or anything else is completely unaffiliated with its owners. From time to time, I may post affiliate links for products I enjoy using. They don't cost you anything extra, and I may get a small commission.#procoder© 2026 Greg L. Turnquist, All Rights Reserved

Every developer has hit a 403 and moved on. This week we found out what happens when an AI agent hits one: it keeps trying.According to Bleeping Computer, OpenAI research agents blocked while gathering public health statistics went looking for side doors, and one got into an Australian Medicare statistics portal. No patient data was involved, but there's a practical lesson for anyone building agents.I also cover new frontier model pricing from Anthropic and OpenAI, Spring's single-day "Patch Thursday," JDK 27 and Valhalla's value classes, a placeholder domain in dev docs that now serves malware, and why Zig is saying no to AI contributions. Then some Pro Coder commentary on what AI means for the craft.====Grab your copy of 12 Rules For Pro Coders today!====STORIES IN THIS EPISODE: 📰- Bleeping Computer: OpenAI agents probe an Australian Medicare site- The New Stack: AI agents probe vulnerabilities- Transluce findings- Simon Willison on Opus 5.5 and GPT-6- Spring Blog: Releasing Spring for modern challenges- Baeldung Java Weekly #664- JEP 401: Value Classes and Objects- Bleeping Computer: placeholder domain now serves ClickFix attacks- InfoQ: Andrew Kelley on Zig's no-AI policyGET MORE: 🎉- Get a FREE tech ebook- Join the YouTube channel for perks- HOW do I interview for a job?- BE PROFESSIONAL merchDISCLOSURE: All opinions are mine and do not necessarily reflect those of any team or employer. Any usage of "Spring", "Spring Boot", "Spring Framework", "VMware", "Pivotal", or anything else is unaffiliated with its owners. I may post affiliate links for products I enjoy; they cost you nothing extra, and I may get a small commission.#procoder · © 2026 Greg L. Turnquist, All Rights Reserved

The word on the street amidst vibe coding and agents building whole systems and shutting down SaaS products is that software engineering as a profession is dead.Or at least, something you don't need bone up and study for 4 years anymore.But is that really true?On this episode of the Pro Coder Show, I sat down with Java Champion and Spring Advocate @DanVega and we were able to talk about what software fundamentals really mean in this day and age.====Don't forget to grab your copy of 12 Rules For Pro Coders today at https://www.procoder.io/12-rules/offer?sourceId=G86HirIAh9k!====Join this channel to get access to perks: https://www.youtube.com/@ProCoderIO/joinALSO SEE: 👀✅ HOW do I interview for a job? https://youtu.be/oN_B22doViYRESOURCES: 👇- Order your copy of 12 Rules for Pro Coders at https://12rules.io today!GET MORE: 🎉- Get a FREE tech ebook at https://procoder.io/join- Follow me on Twitter: https://twitter.com/procodershowDo YOU uphold the Pro Coder motto, BE PROFESSIONAL? https://store.procoder.ioDISCLOSURE: All opinions stated here are mine and do not necessarily reflect those of any team or employer. Any usage of "Spring", "Spring Boot", "Spring Framework", "VMware", "Pivotal", or anything else is completely unaffiliated with its owners. From time to time, I may post affiliate links for products I enjoy using. They don't cost you anything extra, and I may get a small commission.#procoder© 2026 Greg L. Turnquist, All Rights Reserved

Once upon a time, the buzz at SpringOne in 2014 was the debut of Spring Boot. This year, the topic in every convo I had at DevNexus was ...drumroll... AI!In this episode of the Pro Coder Show, I sat down with former teammate and coding buddy Glen Renfro and discussed how AI has become an integral component of our coding lives.====Don't forget to grab your copy of 12 Rules For Pro Coders today at https://www.procoder.io/12-rules/offer?sourceId=SX276b4n4g0!====Join this channel to get access to perks: https://www.youtube.com/@ProCoderIO/joinALSO SEE: 👀✅ HOW do I interview for a job? https://youtu.be/oN_B22doViYRESOURCES: 👇- Order your copy of 12 Rules for Pro Coders at https://12rules.io today!GET MORE: 🎉- Get a FREE tech ebook at https://procoder.io/join- Follow me on Twitter: https://twitter.com/procodershowDo YOU uphold the Pro Coder motto, BE PROFESSIONAL? https://store.procoder.ioDISCLOSURE: All opinions stated here are mine and do not necessarily reflect those of any team or employer. Any usage of "Spring", "Spring Boot", "Spring Framework", "VMware", "Pivotal", or anything else is completely unaffiliated with its owners. From time to time, I may post affiliate links for products I enjoy using. They don't cost you anything extra, and I may get a small commission.#procoder© 2026 Greg L. Turnquist, All Rights Reserved

Have you been offered a stock option while securing a position with a shop? Confusing as all get out?In this episode of the Pro Coder Show, we're going to demystify what all this means, learn how you can negotiate for more, and even take it with you when your options contract says you have to leave it behind should you jump ship!====Don't forget to grab your copy of 12 Rules For Pro Coders today athttps://www.procoder.io/12-rules/offer?sourceId=RBb82zTxUBk!====Join this channel to get access to perks:https://www.youtube.com/@ProCoderIO/joinALSO SEE: 👀✅ HOW do I interview for a job?https://youtu.be/YdvPRVLvfEURESOURCES: 👇 Order your copy of 12 Rules for Pro Coders at https://www.procoder.io/12-rules/offer?sourceId=gqeLa6Z_02A today!GET MORE: 🎉 Get a FREE tech ebook at https://procoder.io/join Follow me on Twitter: https://twitter.com/procodershowDo YOU uphold the Pro Coder motto, BE PROFESSIONAL?https://store.procoder.ioDISCLOSURE: All opinions stated here are mine and do not necessarily reflect those of any team or employer. Any usage of "Cockroach Labs", "CockroachDB", "Spring", "Spring Boot", "Spring Framework", "VMware", "Pivotal", or anything else is completely unaffiliated with its owners. From time to time, I may post affiliate links for products I enjoy using. They don't cost you anything extra, and I may get a small commission.#procoder© 2026 Greg L. Turnquist, All Rights Reserved

To be a pro coder means you are a PROFESSIONAL. You are being paid to write top notch apps and develop code.Would it surprise you that there are ALL KINDS of ways to get paid?In this episode of The Pro Coder Show find out all the different ways you can get paid… and how SOME are better than OTHERS.Don't forget to grab your copy of 12 Rules For Pro Coders today:https://www.procoder.io/12-rules/offer?sourceId=gqeLa6Z_02AJoin this channel to get access to perks:https://www.youtube.com/@ProCoderIO/joinALSO SEE: 👀✅ HOW do I interview for a job?https://youtu.be/YdvPRVLvfEURESOURCES: 👇• Order your copy of 12 Rules for Pro Coders:https://www.procoder.io/12-rules/offer?sourceId=gqeLa6Z_02AGET MORE: 🎉• Get a FREE tech ebook: https://procoder.io/join• Follow me on Twitter: https://twitter.com/procodershowDo YOU uphold the Pro Coder motto, BE PROFESSIONAL?https://store.procoder.ioDISCLOSURE: All opinions stated here are mine and do not necessarily reflect those of any team or employer. Any usage of “Cockroach Labs”, “CockroachDB”, “Spring”, “Spring Boot”, “Spring Framework”, “VMware”, “Pivotal”, or anything else is completely unaffiliated with its owners. From time to time, I may post affiliate links for products I enjoy using. They don't cost you anything extra, and I may get a small commission.#procoder© 2026 Greg L. Turnquist, All Rights Reserved

Your app needs data. Almost all of them do (gateways aside). So you need a database, right?Wrong.In this episode of The Pro Coder Show, learn how to sidestep a traditional relational database—and potentially make your site dramatically faster.====Get your copy of 12 Rules For Pro Coders:https://www.procoder.io/12-rules/offer?sourceId=HNNHw9HrI74====Join the channel for perks:https://www.youtube.com/@ProCoderIO/joinAlso see:👀 How do I interview for a job?https://youtu.be/YdvPRVLvfEUResources:Order 12 Rules For Pro Coders:https://www.procoder.io/12-rules/offer?sourceId=HNNHw9HrI74Get more:🎉 Free tech ebook: https://procoder.io/join🐦 Twitter: https://twitter.com/procodershowDo you uphold the Pro Coder motto, BE PROFESSIONAL?https://store.procoder.ioDisclosure: All opinions are my own and not affiliated with any company mentioned. Some links may be affiliate links and may earn a small commission at no extra cost to you.#procoder© 2026 Greg L. Turnquist. All rights reserved.

You’ve got an offer letter in your hands. Now comes the tricky part: negotiation.Some say this is your moment to level up.Others warn: “Careful — they could rescind the offer. Don’t do it.”So which is it?In this episode of The Pro Coder Show, we break down what’s really going on so you can make the best decision for your career.====Grab your copy of 12 Rules for Pro Codershttps://www.procoder.io/12-rules/offer?sourceId=mnvWSDnxbhQ====Join the channel for perkshttps://www.youtube.com/@ProCoderIO/joinAlso see:How do I interview for a job?https://youtu.be/oN_B22doViYResources:Order 12 Rules for Pro Codershttps://www.procoder.io/12-rules/offer?sourceId=mnvWSDnxbhQGet more:Free tech ebook: https://procoder.io/joinFollow on Twitter: https://twitter.com/procodershowDo you uphold the Pro Coder motto, BE PROFESSIONAL?https://store.procoder.ioDisclosure: Opinions are my own and do not reflect any employer. All company and product names mentioned are unaffiliated with their owners. Some links may be affiliate links at no extra cost to you.#procoder© 2026 Greg L. Turnquist. All rights reserved.