Last Sunday I made a flash visit to Bern with A. As I’ve mentioned before, it’s one of my favorite cities in Switzerland, and it’s so easy to get to from Basel that even a short stop is worth it.

By the time I walked into the old town it was already dark and it had been raining. The cobblestones were still wet and reflected the lights from the shop windows and street lamps, as you can see in the picture above. In the center is the Käfigturm, with its clock and pointed spire, and on the right you can spot the green dome of the Federal Palace.

A short visit, but Bern never disappoints, even on a rainy evening.

The last couple of days at work have been intense. On Tuesday details of a new PHP vulnerability started leaking online, and by Wednesday afternoon the official patches were out. Everything else on the board stopped. For two days the only questions were: where do we run PHP, which version is it, and is it patched yet?

The bug has a name, PHP2Shell, and it is one of the most serious problems the web has seen in years.

What is PHP?

PHP is a programming language that runs on the server. When you open a web page, PHP builds the HTML before it reaches your browser. It was created by Rasmus Lerdorf in 1994 and is still everywhere. WordPress, Drupal, Joomla, Laravel, Symfony, Magento, and MediaWiki (the software behind Wikipedia) are all written in it.

The numbers are impressive. According to these PHP statistics from September 2026:

• PHP runs on 70.2% of all websites whose server-side language is known (W3Techs).
• Among PHP sites, 63.4% use PHP 8, 28.7% still use PHP 7 and 7.9% are still on PHP 5.
• Packagist, PHP’s package registry, lists 466,248 packages with almost 197 billion installs since 2012.
• About 19% of professional developers worked extensively with PHP last year (Stack Overflow 2025), and 64% of PHP developers use Laravel (JetBrains 2025).

PHP may not be fashionable, but it powers a huge part of the internet. That is exactly why a bug in PHP itself is such a big deal.

What was the vulnerability?

PHP2Shell is actually two bugs, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10:

1. CVE-2026-109618: when PHP runs out of memory, for example during a huge file upload, it can be interrupted while its internal request data is only half built. The cleanup step then treats that broken data as valid.
2. CVE-2026-109619: some internal state survives after its memory has been freed. The next request on the same worker can use that stale state, and the upload progress feature is one way to reach it.

Both lead to remote code execution, which means an attacker can run their own commands on your server. Here is why it was so bad:

• No login needed. A single anonymous request is enough to attack, and it happens before any application code runs. It doesn’t matter how secure your own code is.
• It’s in PHP itself, not in a plugin or framework, so it affected PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed, from PHP 5.4 all the way to 8.5.
• Attackers were early. Amazon saw an exploitation attempt on October 17, four days before the public disclosure. The details then leaked on October 20, a day ahead of schedule.
• Old versions don’t get proper fixes. PHP 7.4, 8.0 and 8.1 only received source patches, and nothing older got anything. With almost 37% of PHP sites still on PHP 7 or 5, many servers can’t simply “update”.

As a precaution, government sites in Europe and Canada, many Wikimedia services and even the Internet Archive went offline for a while. Interestingly, the bug was found with the help of AI models. One of the out-of-memory problems had been spotted back in 2024, but without a working exploit it was never fixed.

Patch everything, now

So what did we developers do? We patched as fast as we could. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. If you run anything with PHP, even a small blog on shared hosting, check today that it’s on a patched version.

Lets see what the next week will bring in this new crazy world of LLM driven security research and exploitation.

Every time I cross the border for groceries, I notice prices creeping up, so I was curious to see what the numbers say. According to the latest Eurostat release, annual inflation in the euro area rose to 3.8% in September 2026, up from 3.2% in August and 2.2% a year ago.

The chart above shows where that increase comes from. Energy is only about 9% of the basket, yet energy prices are up 18.9% year on year and now add 1.71 percentage points to the headline rate. That is almost half of all inflation. A year ago, energy was actually pulling inflation down slightly (-0.03 points).

Take energy out and the picture is much calmer. Inflation excluding energy is 2.3%, a bit lower than the 2.5% of September 2025. Services are still the largest steady contributor at 1.52 points, but they have barely moved in a year, and food has cooled from 3.0% to 1.3%.

So is this a real inflation problem or an energy shock? For now it looks like the second. The question is how long energy stays this expensive before it starts leaking into everything else :/. The next estimate probably will paint a clearer picture.

Note: Please find an interactive version of the chart above here.

Because of my living situation, I check train connections quite frequently, and I wanted to have a place where I could search using one tap instead of a page load, a cookie banner and a spinner. So I built CatCH: a small static site hosted on Cloudflare Pages that searches Swiss public transport with the same flow as sbb.ch, just lighter.

It is not a replacement for the official app. You can’t buy tickets, and there is no account. It does just one thing: show me the next connections between two stops, as fast as the network allows. If you want to try it out, check catch.jco.im.

What it does

If you have used sbb.ch, you already know how to use CatCH. The search form follows the same steps:

1. Type a From and To stop (or tap Stops near me to use your location). A swap button flips them.
2. Pick Leave now, Depart at or Arrive by, and optionally add a Via stop.
3. Hit Search and get the next connections: departure time, products (IC, IR, S-Bahn, bus…), platform and number of changes.
4. Open a connection to see each leg, walking transfers and the stops in between.

Two extras make it nicer: Saved routes pin trips I take often to the home screen, with a live “in 9 min” countdown to the next departure. A Departures tab shows the station board for any stop, like the yellow posters on the platform.

It also installs as a PWA on your phone, follows your system’s light or dark theme, and remembers your saved routes locally in the browser. No login, no tracking.

How it’s built

There is no backend. CatCH is an Astro site with a few React islands, built to plain HTML, CSS and JS and served from Cloudflare’s edge. The browser talks directly to the free Swiss public transport API at https://transport.opendata.ch/, which wraps the official timetable data from opentransportdata.swiss.

Some weeks ago, when I wrote about Noviodunum, the Roman town that became Nyon, I kept picturing how empty the shores of Lake Geneva must have been back in Roman times. Today it feels like the opposite. Switzerland now has about 9.1 million people, 2.7 times as many as in 1900, according to the About Switzerland population page from the Swiss foreign ministry.

Most of that growth comes from immigration. More than 2 million foreign nationals (raising my hand here) live in Switzerland, about 27% of residents, one of the highest shares in Europe. The flow also runs the other way: over 10% of Swiss citizens now live abroad. In recent years the population has grown about 0.8% a year, and 2025 alone added roughly 73,300 people.

All of this came to a head in June. On 14 June 2026, voters rejected the SVP’s “No to 10 million Switzerland!” initiative, which would have forced the government to act if the population passed 10 million before 2050. It failed 54.8% to 45.2%. The map was telling: French-speaking cantons and the big cities said no (Bern 83.6%, Zurich 75.9%), while rural cantons like Appenzell Innerrhoden and Schwyz said yes.

So what now? At 0.8% a year, 10 million is only about a decade away, vote or no vote. The real question isn’t whether Switzerland grows, but whether the trains, flats and schools can keep up. I guess only time will tell.

Next page