Steve Grunwell

Blue elePHPant standing on top of a laptop, showing code in an editor

Upgrading PHP in response to php2shell

October 21, 2026

A major PHP security vulnerability, dubbed “php2shell”, was disclosed today, which can allow an attacker to execute Remote Code Execution (RCE) by exploiting vulnerable versions of PHP—pretty much any version released in the last twenty years leading up until today.

If you’re running an unpatched version of PHP 8.2 or newer, stop reading now and upgrade immediately; if you’re running any version of PHP 8.2 or higher, the latest release should be available via your package manager (apt, yum, etc.).

Continue reading→

Announcing TypeSnitch

September 6, 2026

In Code

When I was at Mailchimp, one of the hardest parts of making meaningful contributions was the total lack of type-safety; after all, it’s a decades-old monolith that predates things like scalar type-hints, enums, union & intersection types, etc. However, things broke more than once as a result of trying to add type-hints to even the […]

Continue reading→

I’ve Been Laid Off

May 25, 2026

In Career

Just about four years ago, I joined Mailchimp, the Atlanta tech darling focused on providing small businesses the tools they need to compete with the bigger players.

Mailchimp itself had been acquired a few months prior by FinTech giant Intuit, makers of software like TurboTax and QuickBooks for a whopping 13 billion dollars.

Last week, Intuit announced a Reduction in Force (RIF) of approximately 17% of the workforce—roughly 3000 employees. As you may have guessed from the title of this post, I was among the impacted.

Continue reading→

Black and white photo of two female-presenting scientists looking into adjoining microscopes

The True Meaning of Code Coverage

May 29, 2025

In Code

Whether you’re auditing third-party libraries or trying to toughen up your own test suites, you’ve likely come across a project boasting “100% code coverage”. It just sounds so official, right? 100% of this code is covered by automated tests, so it must be good!

I have good news and bad news. The good news is that a high percentage of code coverage does generally reflect an above-average effort to test the code—I’d much rather use a library with 60% code coverage than 15% (or zero!), wouldn’t you?

The bad news is that a high percentage of code coverage doesn’t mean that the code is necessarily working the way it’s supposed to!

In this post, we’re going to look at what code coverage really means as a metric (specifically within the context of PHP, but these lessons should be broadly applicable), as well as several ways that code coverage can give you a false sense of confidence.

Continue reading→

Factory Methods for Hydrating Objects from JSON

December 4, 2024

In Code

If you’ve worked in a lot of codebases, this scenario will be familiar: somewhere in the app, we’re JSON-decoding a string, then using that to pass arguments to a method (such as a constructor). It may look something like this:

$json = '{"first": "Steve", "last": "Grunwell"}';
$data = json_decode($json);

$person = new Person($data->first, $data->last);

I’d like to humbly ask that you stop doing this. Instead, this post is going to show you how to accomplish the same result with a static, factory method and explain why the latter approach will save you all sorts of headaches.

Continue reading→

An ornate, metal gate overlooking a body of water

What are Continuous Integration & Delivery (CI/CD)?

November 16, 2024

In Code

Lately, I’ve been thinking a lot about helping smaller teams—especially those working with “legacy applications”—modernize their workflows. Working for a Fortune 500 company on an “enterprise-scale” application every day can cause you to take things like Continuous Integration and Delivery (CI/CD) for granted.

With that in mind, I’m going to try to turn my attention to simplifying some of these concepts. If you’ve ever been told “you should be using continuous integration” and been left wondering “okay, but how?” this post is for you!

Continue reading→

Shelby in 2020, lying on carpet while her nice, soft bad sits empty in the background

R.I.P. to the Best Girl, Shelby

October 17, 2024

In Family

Today we say goodbye to Shelby Marie Grunwell, a.k.a. the Greatest Dog to Ever Live.

She came to our family by way of Canine Collective, a wonderful organization out of Plain City, OH that rescues dogs from high-kill shelters and puts them with loving homes. While we had originally visited the group’s weekly event at a local Petsmart in order to start the process for a chocolate lab named Cocoa, Shelby picked me out, stood on her hind legs, and perched on my arm as if to say “hey there, Steve, I’m the one you want!”

That was just shy of fourteen years ago.

Continue reading→

For a Great Time, Make it a DateTime

July 19, 2024

In Code

Let’s acknowledge something right out of the gate: working with dates and times can be a slog. Not a year goes by without some app breaking due to Daylight Saving Time or an assistant not realizing that March 31st exists.

For those of us working in PHP—especially more recent versions of the language—dates and times don’t need to be a source of pain. Instead of strtotime() this and date() that, we have functionality baked into PHP that dramatically simplifies the work of parsing, converting, and formatting dates and times.

Continue reading→

A typewriter with a sheet of paper reading "Equality"

Strict Equality for Better Code

July 1, 2024

In Code

A major focus of my day job right now is cleaning up the PHP in a decades-old monolith, which includes tests written for two different test runners by hundreds of engineers over the years.

I could write a book on the horrors I’ve seen (and currently have at least half a dozen blog posts in draft state), but I’m not interested in raking anyone over the coals for past engineering decisions—honestly, it’s to be expected with any project this size and age. Instead, I wanted to take a moment to talk about one of the most prevalent oversights made by engineers of all levels: strict equality.

Continue reading→

A pile of LEGO bricks spread out across a hardwood floor

Decouple Your Application Code with the Adapter Pattern

April 24, 2024

In Code

The last few months at work I’ve been deep in a refactoring project, cleaning up over twenty years of technical debt. It’s been a massive undertaking, but it’s rewarding work when I’m finally able to remove code that’s been hanging out well-past its expiration date.

One of the patterns that’s come in extremely handy is the Adapter Pattern, which lets me decouple application code from the underlying libraries that we use. This post will discuss how the Adapter Pattern works (with coffee-themed examples, as I tend to do), then demonstrate how it can help with refactoring.

Continue reading→

Steve Grunwell

Open-source contributor, speaker, and electronics tinkerer

Upgrading PHP in response to php2shell

Announcing TypeSnitch

I’ve Been Laid Off

The True Meaning of Code Coverage

Factory Methods for Hydrating Objects from JSON

What are Continuous Integration & Delivery (CI/CD)?

R.I.P. to the Best Girl, Shelby

For a Great Time, Make it a DateTime

Strict Equality for Better Code

Decouple Your Application Code with the Adapter Pattern

Topics

Latest Posts

Upcoming Talks

Connect