[{"data":1,"prerenderedAt":113},["ShallowReactive",2],{"eYSaTaM6Yf":3,"related-performance-notes/php-rce-october-2026":26},{"id":4,"slug":5,"title":6,"excerpt":7,"meta_title":8,"meta_description":9,"page_content":10,"featured_image":18,"fields":19,"tags":21,"published":24,"published_at":25,"created_at":25,"updated_at":25},"8c927bad-0ebd-4572-929b-a2355d560995","notes/php-rce-october-2026","PHP just had its worst week in years. My HD CMS clients slept through it.","Two 9.2-rated PHP vulnerabilities dropped on 21 October. If you run PHP, patch today. If you're tired of weeks like this, here's the other way to build.","PHP's critical RCE flaws, and why I build without PHP","Two critical PHP flaws let one request take over a server. Here's how to patch today, and why none of my HD CMS clients had anything to fix.",{"blocks":11},[12],{"id":13,"data":14,"type":17},"69d8fbbe-fd82-4490-bf6d-2f1d9f1d0e9d",{"content":15,"maxWidth":16},"\u003Cp>On Tuesday the PHP team warned that a security release was coming. On Wednesday afternoon it landed, and it's a bad one.\u003C/p>\u003Cp>Two vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Both rated 9.2 out of 10. Both allow remote code execution without logging in. CERT-EU, the EU's own security team, has told organisations to patch immediately or pull internet-facing PHP apps offline until they can.\u003C/p>\u003Cp>I've spent this morning reading the advisory properly. Here's what it means if you run a PHP site, what to do today, and why none of the sites I host on HD CMS needed a single change.\u003C/p>\u003Ch2>What actually happened\u003C/h2>\u003Cp>The first flaw lives in how PHP handles running out of memory. PHP enforces its memory limit by aborting the request mid-flight. If that abort lands while PHP is half way through parsing something, a file upload form for example, the cleanup code can try to free memory that was never set up properly. That memory can still hold data an attacker sent earlier. That's the door in.\u003C/p>\u003Cp>The second flaw is about leftover state. After certain errors, a bit of internal state from one request can outlive the memory behind it. The next request on the same worker can pick it up before PHP resets things.\u003C/p>\u003Cp>The part that should worry you: the published exploit needs \u003Cstrong>one unauthenticated request\u003C/strong>, and it fires before any of your application code runs. Your WordPress security plugin, your Magento hardening, your carefully written validation, none of it gets a chance to run.\u003C/p>\u003Cp>Every way of serving PHP is in scope. PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP, LiteSpeed. The PHP team rates mod_php as the riskiest. Proofs of concept are already circulating.\u003C/p>\u003Ch2>If you run PHP, do this today\u003C/h2>\u003Col>\u003Cli>\u003Cstrong>Find every PHP install you're responsible for.\u003C/strong> Not just the main site. The old staging box, the forgotten microsite, the admin tool someone set up in 2019. Run \u003Ccode>php -v\u003C/code> on each.\u003C/li>\u003Cli>\u003Cstrong>Patch to a fixed version.\u003C/strong> That's 8.5.12, 8.4.27, 8.3.36 or 8.2.35. On managed hosting, check your host's status page or ask them directly when they're rolling it out.\u003C/li>\u003Cli>\u003Cstrong>If you're on PHP 8.1 or older, you have a bigger problem.\u003C/strong> Those versions are end of life. Some vendors have backports, and the PHP team published minimal source patches for 7.4, 8.0 and 8.1, but the real fix is an upgrade.\u003C/li>\u003Cli>\u003Cstrong>Can't patch today? Reduce exposure.\u003C/strong> The advisory lists temporary settings, such as turning off \u003Ccode>session.upload_progress\u003C/code> and tightening \u003Ccode>post_max_size\u003C/code>. They narrow the attack paths. They don't close them.\u003C/li>\u003Cli>\u003Cstrong>Then check nothing already got in.\u003C/strong> New admin users, unfamiliar files in upload folders, odd cron jobs.\u003C/li>\u003C/ol>\u003Cp>If that list made your stomach drop, I can do it for you. Patching, checking for compromise, and putting the mitigations in place while the upgrade is planned. Get in touch and I'll look at it today.\u003C/p>\u003Ch2>Why my HD CMS clients didn't need to do anything\u003C/h2>\u003Cp>This morning I didn't patch a single \u003Ca href=\"/hd-cms\">HD CMS\u003C/a> site. Not because I was quick. Because there was nothing to patch.\u003C/p>\u003Cp>HD CMS is a headless setup. The front end is Nuxt, built and served from Vercel. Content lives in Supabase, which is Postgres with a properly locked-down API in front of it. There's no PHP interpreter sitting on a server waiting for requests. There's no long-running worker holding state from the last visitor. There's no upload parser written in C from the early 2000s.\u003C/p>\u003Cp>That's not luck. It's the point of the architecture.\u003C/p>\u003Cp>A traditional PHP site is one big box. The public pages, the admin area, the database connection and the file uploads all run in the same process, on the same server, open to the internet. When the language runtime underneath has a hole, everything on that box is exposed at once.\u003C/p>\u003Cp>A headless build splits those apart. Public pages are mostly static files on a CDN. The admin lives somewhere else. The database only answers requests it has rules for. A flaw in one layer doesn't hand over the keys to all of them.\u003C/p>\u003Cp>None of this makes a site unhackable. Nothing does. Node has had its own bad weeks and so has every other runtime. The difference is how much of your stack is sitting on the open internet, and how much of it is yours to keep patched.\u003C/p>\u003Ch2>PHP isn't the villain\u003C/h2>\u003Cp>I want to be fair here. PHP runs a huge share of the web and the core team handled this well. They warned people a day ahead, gave Linux distributions the patches early, and shipped fixes for every supported branch at once. I've built plenty on PHP, including years of Magento work, and I'll keep supporting clients who run it.\u003C/p>\u003Cp>But look at the pattern. Patchstack logged 11,334 new vulnerabilities in the WordPress ecosystem alone in 2025, up 42% on the year before. For the ones attackers went after hardest, the median time from disclosure to first exploit was five hours. Five hours. If your plan for security is \"the developer updates things when they get round to it\", that plan stopped working a while ago.\u003C/p>\u003Cp>Every PHP site needs someone watching it. Core, plugins, extensions, the PHP version itself, the server. That's a permanent cost, and weeks like this one are when you pay it.\u003C/p>\u003Ch2>Is it time to move?\u003C/h2>\u003Cp>If you've got a brochure site, a small shop or a booking system running on PHP, it's a fair question to ask this week.\u003C/p>\u003Cp>Moving doesn't have to mean a six-month rebuild. Most small business sites are content, a few forms, maybe products or bookings. HD CMS starts from \u003Cstrong>£20 a month\u003C/strong>, which covers hosting and updates, and if you're on WordPress I'll \u003Cstrong>convert your site for free\u003C/strong>. The content comes across, the URLs stay the same so you keep your rankings, and you stop being the person who has to read CVE advisories over breakfast.\u003C/p>\u003Cp>If you're on a bigger PHP platform like Magento, moving is a bigger job, and patching comes first. But it's worth starting the conversation now rather than after the next one.\u003C/p>\u003Ch2>Need a hand?\u003C/h2>\u003Cp>Whether you need this patch done today or you want to talk about getting off PHP for good, \u003Ca href=\"/contact\">get in touch\u003C/a>. I'll tell you honestly which one makes sense for your site.\u003C/p>","lg","wysiwyg","",{"author":20},"Adam Jackson",[22,23],"headless","performance",true,"2026-10-22T05:41:13.421492+00:00",[27,30,44,54,67,78,88,101],{"id":4,"slug":5,"title":6,"excerpt":7,"meta_title":8,"meta_description":9,"featured_image":18,"fields":28,"tags":29,"published":24,"published_at":25,"created_at":25,"updated_at":25},{"author":20},[22,23],{"id":31,"slug":32,"title":33,"excerpt":34,"meta_title":35,"meta_description":36,"featured_image":18,"fields":37,"tags":38,"published":24,"published_at":41,"created_at":42,"updated_at":43},"6ef0142d-de21-4dfc-8894-c25e868783e0","notes/wordpress-image-optimiser-built-with-ai","I Built a WordPress Image Optimiser With AI (Instead of Reaching for Another Plugin)","Images are the number one cause of slow WordPress sites. Rather than bolt on another plugin to clean up after the fact, I built a small tool with AI that optimises them at source. Here's the thinking.","I Built a WordPress Image Optimiser With AI","Images are the top cause of slow WordPress sites. Instead of another plugin, I built a small tool with AI that optimises them at source. The thinking behind it.",{"author":20},[39,40,23],"wordpress","ai","2026-07-04T08:00:00+00:00","2026-06-20T05:36:07+00:00","2026-10-01T19:41:42.773395+00:00",{"id":45,"slug":46,"title":47,"excerpt":48,"meta_title":49,"meta_description":50,"featured_image":18,"fields":51,"tags":52,"published":24,"published_at":53,"created_at":42,"updated_at":43},"b1922741-01b6-4c28-ae7d-edb62420e816","notes/why-your-wordpress-site-is-slow","Why Your WordPress Site Is Slow (and What Actually Fixes It)","A senior developer's honest take on why WordPress sites get slow, the order I actually check things in, and the fixes that make a real difference versus the ones that don't.","Why Your WordPress Site Is Slow (and What Fixes It)","An honest take on why WordPress sites get slow, the order I check things in, and the fixes that make a real difference versus the ones that do not.",{"author":20},[39,23],"2026-06-20T08:00:00+00:00",{"id":55,"slug":56,"title":57,"excerpt":58,"meta_title":59,"meta_description":60,"featured_image":18,"fields":61,"tags":62,"published":24,"published_at":65,"created_at":66,"updated_at":43},"e3c8eb97-f553-4d03-988f-0c7bae3bd166","notes/modern-frontend-build-tooling-in-magento","Frontend Build Tooling in Magento: Gulp, Grunt, Webpack and Laravel Mix","How Magento frontend tooling went from Grunt to Gulp to Webpack to Laravel Mix, what each step actually fixed, and why the asset pipeline tells you a lot about why I left the platform.","Magento Build Tooling: Grunt, Gulp, Webpack, Mix","How Magento frontend tooling went from Grunt to Gulp to Webpack to Laravel Mix, what each step actually fixed, and why the asset pipeline tells its own story.",{"author":20},[63,64,23],"magento","dev-workflow","2026-07-13T08:00:00+00:00","2026-06-18T08:16:17+00:00",{"id":68,"slug":69,"title":70,"excerpt":71,"meta_title":72,"meta_description":73,"featured_image":18,"fields":74,"tags":75,"published":24,"published_at":76,"created_at":77,"updated_at":43},"530755d8-e290-49c5-8a49-82efa1ac28bc","notes/zero-downtime-magento-deployment","Zero-Downtime Magento Deployment (And Why It Is Really Minimum Downtime)","There is no true zero-downtime Magento deploy. Here is the release-folder pipeline I used to get close, the conditional setup:upgrade trick that makes most deploys genuinely downtime-free, and the gotchas that bite.","Zero-Downtime Magento Deployment (Almost)","There is no true zero-downtime Magento deploy. The release-folder pipeline I used, the conditional setup:upgrade trick, and the gotchas that bite.",{"author":20},[63,64,23],"2026-07-03T08:00:00+00:00","2026-06-13T08:26:19+00:00",{"id":79,"slug":80,"title":81,"excerpt":82,"meta_title":81,"meta_description":83,"featured_image":18,"fields":84,"tags":85,"published":24,"published_at":86,"created_at":87,"updated_at":43},"cecf5109-293e-440a-9bbd-fc79d0fdd284","notes/upgrading-magento-2-without-breaking-production","Upgrading Magento 2 Without Breaking Production","Upgrade day always starts with optimism, then you point it at a real store. The patch-or-upgrade call, the duplicate URL rewrite trap, the Zend to Laminas errors, and the process I use to get a Magento 2 upgrade through without an outage.","The patch-or-upgrade call, the duplicate URL rewrite trap, the Zend to Laminas errors, and the process I use to get a Magento 2 upgrade through with no outage.",{"author":20},[63,64,23],"2026-06-26T08:00:00+00:00","2026-06-09T07:09:00+00:00",{"id":89,"slug":90,"title":91,"excerpt":92,"meta_title":91,"meta_description":93,"featured_image":18,"fields":94,"tags":95,"published":24,"published_at":98,"created_at":99,"updated_at":100},"a7d4028e-a4b8-4d82-8a84-e9a7939981bd","notes/what-seo-companies-dont-tell-small-businesses","What SEO Companies Don't Tell Small Businesses","A page speed score without context is not an audit, it is a sales tactic. What that red number actually means, and the questions to ask before you panic.","A page speed score without context is a sales tactic, not an audit. What that red number really means, and the questions to ask before you panic.",{"author":20},[96,97,23],"seo","business","2026-06-22T08:00:00+00:00","2026-06-07T07:10:00+00:00","2026-10-01T14:52:13.167353+00:00",{"id":102,"slug":103,"title":104,"excerpt":105,"meta_title":106,"meta_description":107,"featured_image":108,"fields":109,"tags":110,"published":24,"published_at":111,"created_at":112,"updated_at":43},"f3c9a1d7-2b84-4e6a-9c15-7d0e8f4b6a23","notes/making-magento-fast-then-and-now","How I Used to Make Magento Fast (and How I Get 100/100 Now)","Years ago I made a video about squeezing speed out of Magento with a few admin settings. It worked, up to a point. Here is what I did then, and how a headless rebuild now scores a perfect 100 on Google PageSpeed.","Making Magento Fast: From Admin Tweaks to 100/100","I once squeezed speed from Magento with a few admin settings. It worked, up to a point. What I did then, and how a headless rebuild now scores 100 on PageSpeed.",null,{"author":20},[63,23,22],"2026-06-10T08:00:00+00:00","2026-06-04T09:00:00+00:00",1792676594318]