Who builds the bridge

Blair Metcalf, a principal UX engineer at Reddit, built Reddit Proto, the company's in-house vibe-coding harness. According to the description of a Lenny's "How I AI" episode published October 26, it pairs a custom Figma MCP and a Cursor pipeline with a design-system MCP that maps Reddit's product language to production code. The pitch is that a designer goes from a blank slate to a shareable, production-shaped prototype in minutes, with no Git. The same description claims "100% adoption across Reddit's UX and product org" and more than 700 live prototypes. It doesn't say how adoption is measured or over what period.

Look at who built it. Not a platform team: a UX engineer, someone who sits between design and code, building the bridge the rest of the org walks across. That's the merged builder showing up as a job title. The load-bearing part is the design-system MCP. The machine-readable version of how the company builds is what lets a designer's prototype land close to production. Two cautions. Every number here is Reddit's own, relayed through a podcast blurb. And the page names a handoff step to engineering (a "feature capsule") without saying what changed for engineers, which is where I'd look for counter-evidence.

If you have a design system, ask whether an agent can actually read it: components, tokens and rules it can query, not a Figma file and a wiki page. Pick one designer and one real feature, build the prototype through that path, and measure what survives the handoff to engineering. Before you copy the approach, watch the episode (about 30 minutes), because the page doesn't show how the handoff works.

On October 21, PHP released fixes (8.5.12, 8.4.27, 8.3.36 and 8.2.35) for two unauthenticated remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, both rated CVSS 9.2. Per Huntress, a Hacker News post on October 20 claimed the flaws were headed for disclosure, ahead of an embargo that ran to Thursday, and PHP moved its release up to the 21st. An exploit exists for Apache with mod_php in which one request triggers the attack before any application code runs. CERT-EU said proofs of concept had started circulating. Huntress saw no exploitation on its partner systems as of the afternoon of October 21, while other reporters said attacks were emerging. Snyk writes that "These bugs were found with AI assistance," and CERT-EU added a third PHP vulnerability, CVE-2026-115560, to its advisory on October 23.

Two lessons, one old and one new. The old one: an embargo is only as strong as the people holding it, so your patch window can shrink from days to hours. The new one is my read, and the sources only partly support it. AI helped find these bugs, and Calif's write-up says it revisited earlier PHP findings through OpenAI's Patch the Planet initiative. None of the pages I read say AI was used to exploit them. But if finding critical bugs in mature code gets cheaper, the gap between "embargoed" and "known" shrinks for everyone, and the people who own more of the stack own more of that clock.

Today, inventory every PHP install you run, including ones bundled inside vendor software, control panels and CMS platforms. Confirm the running version with php -v or the image tag, because scan results alone can't confirm a fix and patched distribution builds can keep old version numbers. Update to a fixed version. If you can't yet, set session.upload_progress.enabled=0, restart workers and isolate the app from the internet, but treat that as reducing exposure, not fixing it. PHP's own position, per Snyk: "There are no complete mitigations; updating is the only safe choice." PHP 8.1 and older no longer get upstream fixes, and 8.2 reaches end of life on December 31, 2026.