SED News: PHP’s Megabug, a Hidden Mic at OpenAI, and Dead AI Products

Nov 5, 2026 by SED Production

SED News is a monthly podcast from Software Engineering Daily where hosts Gregor Vand and Sean Falconer break down the biggest stories shaping software engineering, Silicon Valley, and the broader tech industry.

In this episode, Gregor and Sean cover the PHP remote code execution flaw that hit an estimated 70 percent of the internet, the recording device an OpenAI employee hid in a conference room, and a busy run of deals including Chroma joining Replit, Cloudflare taking Deno, and Supabase acquiring Turso.

The main topic tours the AI graveyard, sorting recent product failures into patterns: features swallowed by bigger platforms, runaway hits too costly or risky to sustain, interfaces made redundant by agents, and hardware that never materialized.

As always, the episode wraps up with a few standout Hacker News threads, including why washing machines took 50 years to catch on, a location-aware local Wikipedia, and a Figma quirk that traces back to the Windows Numlock key.

Sponsorship inquiries:
sponsor@softwareengineeringdaily.com

Thanks to our sponsors

This episode is brought to you by:

Guardsquare
Think about your mobile app’s source code. Once it hits the app store, it’s out in the wild. And without the right protection, decompiling is easy for malicious actors looking to steal your IP or tamper with your software.
That’s where Guardsquare comes in. Guardsquare provides the highest level of mobile app security for Android and iOS applications and SDKs. Their advanced tools integrate seamlessly into your CI/CD pipeline. We’re talking polymorphic multi-layered code hardening techniques and automated runtime application self-protection, paired with mobile application security testing and real-time threat monitoring, to deliver the highest level of mobile app security without compromise.
Don’t leave your hard work exposed. Secure your mobile applications today. Go to guardsquare.com to learn more.
Deepgram
This episode is sponsored by Deepgram.
Origin
This portion of Software Engineering Daily is brought to you by Origin.
Your coding agents can launch each other. Theirs did.
An engineer asked Codex to pull data from staging. Codex had no connection there, but Claude Code did. So Codex launched Claude Code. When Claude Code said it lacked permission, Codex relaunched it with the dangerously skip permissions flag. Nobody was asked.
A permission check doesn’t mean much if another agent can switch it off.
Your logs might show a process that started with a flag. Their trace showed the whole job, and why Codex did it. Origin finds the agents on your company’s endpoints and reconstructs their work, from request to outcome, on one timeline.
Origin is endpoint AI observability. Read what they found in their own traces at originhq.com/sed. That’s O-R-I-G-I-N-H-Q dot com slash S-E-D.

Guardsquare

Deepgram

Origin

Subscribe to the newsletter

Related episodes

Subscribe
to the newsletter