https://lorenzopasquali.dev/en/blog Notes on backend, frontend and applied AI, by Lorenzo Pasquali. en-US Wed, 28 Oct 2026 00:04:00 GMT https://lorenzopasquali.dev/en/blog/php2shell-node-gitlab-security-ai https://lorenzopasquali.dev/en/blog/php2shell-node-gitlab-security-ai Wed, 28 Oct 2026 00:04:00 GMT A series of critical vulnerabilities in PHP, Node.js and GitLab raises a question: as AI accelerates vulnerability discovery, can teams patch systems just as quickly? security cve php nodejs gitlab ai devops cybersecurity https://lorenzopasquali.dev/en/blog/future-saas-reverse-engineering-clones https://lorenzopasquali.dev/en/blog/future-saas-reverse-engineering-clones Thu, 22 Oct 2026 00:53:00 GMT The wave of software reverse engineering and cloning has me thinking about the future of SaaS and local applications. If reproducing features is getting easier, what will truly set a product apart? ai saas reverse-engineering software developer-tools open-source https://lorenzopasquali.dev/en/blog/releases-didnt-speed-up-i-checked-the-math https://lorenzopasquali.dev/en/blog/releases-didnt-speed-up-i-checked-the-math Tue, 13 Oct 2026 16:13:00 GMT A survey of 300 leaders says code ships faster with AI and releases don't. Instead of only arguing about the number, I went after why: writing code was a quarter of the week, release is a queueing problem, and organizations answer more code by adding gates. ai llm research developer-tools agents productivity devops code-review https://lorenzopasquali.dev/en/blog/mcp-two-advisories-trust-boundary https://lorenzopasquali.dev/en/blog/mcp-two-advisories-trust-boundary Mon, 05 Oct 2026 15:45:00 GMT On September 28th and 30th, two MCP security issues landed: one in the official Python SDK, one in the next dev MCP endpoint. Both are trust boundary failures, not implementation bugs. I had written about MCP in production days earlier, so I read both advisories in full. mcp security ai llm nextjs developer-tools agents https://lorenzopasquali.dev/en/blog/openai-devday-2026-25-launches https://lorenzopasquali.dev/en/blog/openai-devday-2026-25-launches Wed, 30 Sep 2026 15:44:00 GMT OpenAI announced 25 things at DevDay on September 29th. I counted them on the official recap page, pulled out what actually matters if you write code, and redid the math on the one-fifth-the-price claim using the numbers they published themselves. ai openai llm developer-tools agents mcp https://lorenzopasquali.dev/en/blog/future-developer-more-product-than-code https://lorenzopasquali.dev/en/blog/future-developer-more-product-than-code Mon, 28 Sep 2026 15:27:00 GMT AI is making software implementation increasingly cheaper. That made me wonder whether the differentiator for the developer of the future will be less about writing code and more about understanding problems, products, and context. ai development product career developer-tools https://lorenzopasquali.dev/en/blog/llm-mcp-integration-on-premise-mes https://lorenzopasquali.dev/en/blog/llm-mcp-integration-on-premise-mes Fri, 25 Sep 2026 00:14:00 GMT How I built an MCP to connect an on-premise MES to GPT, Claude and Gemini, and the architectural problems that appeared along the way. ai mcp java mes llm architecture industrial developer-tools https://lorenzopasquali.dev/en/blog/jev-what-if-an-ai-didn-t-need-to-generate-text https://lorenzopasquali.dev/en/blog/jev-what-if-an-ai-didn-t-need-to-generate-text Tue, 22 Sep 2026 15:46:00 GMT Jev proposes a different way to use AI: instead of generating text, it makes structured decisions among predefined alternatives. The idea is simple, but it raises an interesting question about how many software problems really need a full LLM. ai jev llm agents developer-tools https://lorenzopasquali.dev/en/blog/gemini-hacked-3-companies https://lorenzopasquali.dev/en/blog/gemini-hacked-3-companies Tue, 22 Sep 2026 00:57:00 GMT During an Irregular CTF in May, a test environment let Gemini reach the internet and the model ended up accessing three real companies. The least futuristic detail: one password was guessed and two sets of credentials were exposed in public repositories. ai security llm cybersecurity devops agents https://lorenzopasquali.dev/en/blog/should-ai-slow-down-or-is-this-just-politics https://lorenzopasquali.dev/en/blog/should-ai-slow-down-or-is-this-just-politics Thu, 17 Sep 2026 01:16:00 GMT Anthropic CEO Dario Amodei called for the AI industry to slow down. Sam Altman and Elon Musk agreed. Days later, Trump argued for the opposite, raising a question: safety or a race for technological leadership? ai llm geopolitics anthropic openai elon-musk technology https://lorenzopasquali.dev/en/blog/dropping-indentation-to-save-tokens-is-it-worth-the-trade-of https://lorenzopasquali.dev/en/blog/dropping-indentation-to-save-tokens-is-it-worth-the-trade-of Sun, 09 Aug 2026 15:45:00 GMT A study from Monash University and Singapore Management University tested stripping indentation, whitespace and newlines from code before sending it to an LLM. Input gets much cheaper; output, barely, and the reason matters more than the number. ai java llm prompt-engineering research