PHP Security Update: 2 Critical RCE Bugs, Quick Checklist
PHP security update for CVE-2026-109618 and CVE-2026-109619: which versions are fixed, how to check yours, and who patches it on your hosting.
· 15 min readInsights
WordPress security in practice: how sites actually get compromised, what to do in the first hour after one is, and which of the standard hardening advice is worth the friction. Includes the recovery steps — because the plugin that promised to prevent it is rarely the thing you need at 2am.

SecurityPHP security update for CVE-2026-109618 and CVE-2026-109619: which versions are fixed, how to check yours, and who patches it on your hosting.
· 15 min read
SecurityWordPress user roles range from 90 capabilities to 2. Six mistakes worth fixing today, including the raw HTML every editor can publish.
· 14 min read
SecurityA mixed content warning means the page requested HTTP over HTTPS. Eight hidden causes, the curl that finds them, and the search-replace that fixes it.
· 14 min read
SecurityLocked out of WordPress admin? Match your symptom to the cause, then reset the password, fix the site URL or disable the plugin — all without wp-admin.
· 13 min read
SecurityMost compromises stay quiet. Five checks that find one — core checksums, PHP in uploads, changed files, unknown admins — and what not to do first.
· 6 min read
SecurityRemoving malware is the easy half; removing the attacker's access is the half that counts. The ordered cleanup, with the salt rotation people skip.
· 6 min read
SecurityHardening that earns its keep, in order of impact — plus the widely repeated advice that stops nobody and is not worth your time.
· 6 min read
SecurityYou cannot stop the bots trying, only make trying pointless. Rate limiting, two-factor, the XML-RPC multiplier — and what is only noise reduction.
· 6 min read
SecurityCleanup is half the job. Work out what was reachable, rotate every credential, meet your notification duties, and watch for thirty days — not one.
· 7 min readWhen reading is not enough