Kefong Studio 科奉工作室

Blog

12 articles

·14 min read

The PHP vulnerability unearthed by AI made the bank take its site down that very night, and the same week there was a second landmine

These past two days, a bunch of websites worldwide have been doing emergency maintenance, triggered by two things: one is a PHP remote code execution vulnerability that AI helped uncover (CVE-2026-109618/109619, 9.2 score, no authentication required, mod_php is the most dangerous, and IIS's php-cgi is also on the list); the other is that the private keys of 8 of eMudhra's intermediate CAs can be computed (one of them has a value of 4), which amounts to a root-of-trust leak. Clearly explain the difference in nature and handling between the two, why Go/Java/Node/Python each rushed out updates overnight, why Java's 9.1 score is not RCE, how to make the changes on Windows/IIS, and that the real hit targets are the CA copies nobody looks after—containers, CI, and already-compiled binaries.

·7 min read

General-purpose AI agents have stopped running ads; only two paths remain for this industry going forward.

General-purpose AI agents are clearly receding, and many people think this field is done for. My judgment is that it is merely forking: one path leads to industry solutions, the other to a niche market of fully localized, bespoke offerings. It's not that the big players can't do the latter—they don't dare to—and precisely because of that, it will become a word-of-mouth business within circles. At the end of the article, I also lay out three conditions that could overturn this judgment.

·10 min read

Is this a fact, or a rule? — Using first principles in leading people, dealing with people, and running projects

First principles is often made out to be more mysterious than it is. It really only does one thing: break a problem down until it can't be broken down any further, and distinguish which parts are inherent constraints and which are merely things other people have told you. This piece is written for people who lead teams, deal with people, and manage projects every day—how to use it in four specific scenarios, and three occasions when you absolutely should not use it.

·8 min read

Everyone had already nodded in agreement, so why did someone suddenly object right before launch?

Projects rarely die from someone explicitly objecting; they die from someone never being asked from start to finish. This piece lays out three things clearly: how to use three questions to flush out the stakeholders usually missed, why the people with the biggest stake may in fact be the most opposed, and a few sentences that can genuinely defuse surprise objections at key moments.

·5 min read

An Image in 15 Seconds, a Blank Answer After 155: Three Pitfalls of Local LLMs

Same prompt, same model: one run produces an image in 15 seconds, another runs 155 seconds and outputs nothing. The difference isn't model capability but three settings: thinking mode can eat up the output budget first, the output limit decides whether the result gets truncated, and agent-training habits make the model "go call a tool" instead of just delivering the result. All timings and token counts in this article come from real measurements on a local 125B sparse MoE, with four ready-to-use rules and the test methodology at the end.

·9 min read

The Pelican Test: One Prompt, 66 Models, and What Each One Drew

One 8-word prompt, "Generate an SVG of a pelican riding a bicycle," two years, 66 models, 103 images. This post lays out the results chronologically: 2024's "two circles and a triangle," 2025's Elo tournament, a small model running on a laptop beating frontier models in 2026, a grid of 21 quantizations that all fell apart, a 40× spread in per-image cost, $3.30 burned at the maximum thinking level, and what the "bird on a bike" looks like from six vendors in 2026. The final section shows a local 125B model taking the same test. Images come from public sources, each one credited.

·13 min read

What Is REA? Can It Bring Back the Legacy Systems Nobody Dares to Touch?

REA (Reverse Engineer Anything) is an MCP server that hooks reverse-engineering analysis into AI coding assistants: it doesn't analyze code itself, but connects veteran engines like Ghidra, Hopper and IDA to your agent, and attaches evidence and side-by-side verification to every conclusion. This article explains what it is, what it can do, and whether it can be trusted (claims graded by evidence, plus two reality checks), then turns to the most practical enterprise scenarios: how to get to the bottom of a legacy system whose source code is lost, how to integrate systems that have no interface documentation, why this has gone from "untouchable" to "let's find out first," and what the cost structure looks like, who should do the work, and where the boundaries are. Technical details and data are in the appendix for reference.

·9 min read

Strata Benchmarked: A 125B MoE on a Gaming Laptop with 62 GB of RAM (Before/After Tuning)

A hands-on benchmark log for local LLM enthusiasts. Running a 125B sparse MoE on a machine with an RTX 5090 Laptop GPU (24 GB VRAM) and 62 GB of RAM, I recorded the speed before and after five changes: keeping the entire expert pack resident in RAM gave 4.3×, an engine upgrade gave 39%, removing the resident-budget parameter gave 13%, and enlarging the prompt chunk size gave a 15% prefill improvement. Also included: a single-variable sweep of 10 parameters, showing that 5 of them are just measurement noise; the quality/speed trade-off across three quantization levels; 256K long context (tested with a 146K-token prompt); and a final set of parameters you can copy as-is.