https://lorenzopasquali.dev/en/blog Notes on backend, frontend and applied AI, by Lorenzo Pasquali. 2026-10-28T00:04:00.000Z Lorenzo Pasqualihttps://lorenzopasquali.dev/ https://lorenzopasquali.dev/en/blog/php2shell-node-gitlab-security-ai 2026-10-28T00:04:00.000Z 2026-10-28T00:04:37.014Z

A series of critical vulnerabilities in PHP, Node.js and GitLab raises a question: as AI accelerates vulnerability discovery, can teams patch systems just as quickly?

https://lorenzopasquali.dev/en/blog/future-saas-reverse-engineering-clones 2026-10-22T00:53:00.000Z 2026-10-22T00:53:53.778Z

The wave of software reverse engineering and cloning has me thinking about the future of SaaS and local applications. If reproducing features is getting easier, what will truly set a product apart?

https://lorenzopasquali.dev/en/blog/releases-didnt-speed-up-i-checked-the-math 2026-10-13T16:13:00.000Z 2026-10-14T19:39:42.704Z

A survey of 300 leaders says code ships faster with AI and releases don't. Instead of only arguing about the number, I went after why: writing code was a quarter of the week, release is a queueing problem, and organizations answer more code by adding gates.

https://lorenzopasquali.dev/en/blog/mcp-two-advisories-trust-boundary 2026-10-05T15:45:00.000Z 2026-10-14T19:39:47.322Z

On September 28th and 30th, two MCP security issues landed: one in the official Python SDK, one in the next dev MCP endpoint. Both are trust boundary failures, not implementation bugs. I had written about MCP in production days earlier, so I read both advisories in full.

https://lorenzopasquali.dev/en/blog/openai-devday-2026-25-launches 2026-09-30T15:44:00.000Z 2026-10-14T19:39:52.078Z

OpenAI announced 25 things at DevDay on September 29th. I counted them on the official recap page, pulled out what actually matters if you write code, and redid the math on the one-fifth-the-price claim using the numbers they published themselves.

https://lorenzopasquali.dev/en/blog/future-developer-more-product-than-code 2026-09-28T15:27:00.000Z 2026-10-14T19:39:56.878Z

AI is making software implementation increasingly cheaper. That made me wonder whether the differentiator for the developer of the future will be less about writing code and more about understanding problems, products, and context.

https://lorenzopasquali.dev/en/blog/llm-mcp-integration-on-premise-mes 2026-09-25T00:14:00.000Z 2026-10-14T19:40:01.646Z

How I built an MCP to connect an on-premise MES to GPT, Claude and Gemini, and the architectural problems that appeared along the way.

https://lorenzopasquali.dev/en/blog/jev-what-if-an-ai-didn-t-need-to-generate-text 2026-09-22T15:46:00.000Z 2026-10-14T19:40:05.653Z

Jev proposes a different way to use AI: instead of generating text, it makes structured decisions among predefined alternatives. The idea is simple, but it raises an interesting question about how many software problems really need a full LLM.

https://lorenzopasquali.dev/en/blog/gemini-hacked-3-companies 2026-09-22T00:57:00.000Z 2026-10-14T19:40:22.767Z

During an Irregular CTF in May, a test environment let Gemini reach the internet and the model ended up accessing three real companies. The least futuristic detail: one password was guessed and two sets of credentials were exposed in public repositories.

https://lorenzopasquali.dev/en/blog/should-ai-slow-down-or-is-this-just-politics 2026-09-17T01:16:00.000Z 2026-09-22T01:17:23.068Z

Anthropic CEO Dario Amodei called for the AI industry to slow down. Sam Altman and Elon Musk agreed. Days later, Trump argued for the opposite, raising a question: safety or a race for technological leadership?

https://lorenzopasquali.dev/en/blog/dropping-indentation-to-save-tokens-is-it-worth-the-trade-of 2026-08-09T15:45:00.000Z 2026-10-14T19:40:40.498Z

A study from Monash University and Singapore Management University tested stripping indentation, whitespace and newlines from code before sending it to an LLM. Input gets much cheaper; output, barely, and the reason matters more than the number.