[{"data":1,"prerenderedAt":99},["ShallowReactive",2],{"RampGcuqsn":3,"related-supabase-notes/weekly-roundup-2026-10-23":27},{"id":4,"slug":5,"title":6,"excerpt":7,"meta_title":8,"meta_description":9,"page_content":10,"featured_image":18,"fields":19,"tags":21,"published":25,"published_at":26,"created_at":26,"updated_at":26},"373d4861-e13f-4d2b-9035-3447f516db09","notes/weekly-roundup-2026-10-23","Weekly round-up: a PHP patch that matters more than the Magento one","A critical PHP release, no new Magento bulletin, a Supabase TLS date 18 days out, and WordPress 7.2 Beta 1.","Weekly Round-Up: PHP Patch, Magento and Supabase","This week: a critical PHP release, Magento after APSB26-153, the Supabase TLS date and WordPress 7.2 Beta 1.",{"blocks":11},[12],{"id":13,"data":14,"type":17},"0f73e408-76fa-46b3-bea6-ff852f995ff2",{"content":15,"maxWidth":16},"\u003Cp>A thin week on release notes and a thick one on patching. Here is what I would act on.\u003C/p>\u003Ch2>PHP: update it, even though WordPress did not\u003C/h2>\u003Cp>On 21 October WordPress.org published a notice about a critical PHP security release. PHP fixed two critical vulnerabilities, and WordPress itself needs no update, because the problem sits underneath it. Any server running PHP applications is in scope, and that includes \u003Ca href=\"/magento\">Magento\u003C/a> stores. The notice says to update PHP as soon as possible, to confirm with your host what they have already rolled out, and to treat anything before PHP 8.2 as unsupported, since the PHP project no longer ships security fixes for it. For a self-managed server you cannot fix quickly, it quotes the UK NCSC advice to take it offline. It names no CVE numbers and does not describe the flaws, so I will not guess at them. The practical side is in \u003Ca href=\"/notes/php-rce-october-2026\">Thursday's PHP piece\u003C/a>.\u003C/p>\u003Ch2>Magento: nothing new, one loose end\u003C/h2>\u003Cp>There has been no new Adobe bulletin since APSB26-153 on 13 October: 11 vulnerabilities, 5 of them critical, Priority 2, no known exploitation. That bulletin also asks you to apply the hotfix for CVE-2026-75650 from the earlier APSB26-146. If your patch plan only mentions 153, check that one too. And keep the two jobs separate. A shop can be current on its Magento patches and still sit on an old PHP, or the other way round. Before you bump PHP, check which versions your Magento release supports, and do it on staging first.\u003C/p>\u003Ch2>Supabase: a quiet changelog and a loud date\u003C/h2>\u003Cp>The latest changelog entry is still 14 October, OpenTelemetry traces and metrics in the .NET SDK. Nothing since. The date to remember is 10 November, when Supabase disables an outdated subset of TLS 1.2 ciphers on project HTTP APIs. That is eighteen days from today. Anything that calls your \u003Ca href=\"/supabase\">Supabase\u003C/a> project from an old runtime or a forgotten script should be tested now, from the oldest client you have.\u003C/p>\u003Ch2>WordPress 7.2 Beta 1\u003C/h2>\u003Cp>Beta 1 landed on 20 October, with the final release scheduled for 8 December. Two items caught my eye for anyone building on WordPress: a new Secrets API for storing credentials, and client-side media processing, which resizes and compresses images in the browser before upload. The team says not to run the beta on live sites, and I agree. If you maintain plugins or a theme, put a staging copy on it this month rather than finding out in December.\u003C/p>\u003Ch2>Nuxt\u003C/h2>\u003Cp>Nothing new. Nuxt 4.6 from 5 October is still the latest release, and the blog has had no post since. If you are planning work on \u003Ca href=\"/vue-nuxt\">Vue and Nuxt\u003C/a>, that is a settled platform to plan against.\u003C/p>\u003Ch2>What went up here recently\u003C/h2>\u003Cp>Last Friday was the \u003Ca href=\"/notes/weekly-roundup-2026-10-16\">Magento APSB26-153 and Supabase TLS round-up\u003C/a>. This morning there is a piece on \u003Ca href=\"/notes/ai-for-small-business-hull-east-yorkshire\">AI for a small business in Hull and East Yorkshire\u003C/a>.\u003C/p>\u003Cp>That is the round-up. If you want a second opinion on a patch plan, a PHP upgrade or a Supabase setup, \u003Ca href=\"/contact\">get in touch\u003C/a>.\u003C/p>","lg","wysiwyg","",{"author":20},"Headless Digital",[22,23,24],"roundup","magento","supabase",true,"2026-10-23T07:06:14.944319+00:00",[28,31,41,52,63,77,88],{"id":4,"slug":5,"title":6,"excerpt":7,"meta_title":8,"meta_description":9,"featured_image":18,"fields":29,"tags":30,"published":25,"published_at":26,"created_at":26,"updated_at":26},{"author":20},[22,23,24],{"id":32,"slug":33,"title":34,"excerpt":35,"meta_title":36,"meta_description":37,"featured_image":18,"fields":38,"tags":39,"published":25,"published_at":40,"created_at":40,"updated_at":40},"3fa30c75-b63a-4414-8078-bf9a57b7eb3c","notes/weekly-roundup-2026-10-16","Weekly round-up: Magento APSB26-153 and a Supabase TLS deadline","Adobe's APSB26-153 has five critical Magento fixes, Supabase disables old TLS 1.2 ciphers on 10 November, and the .NET SDK grows up.","Weekly Round-Up: Magento APSB26-153, Supabase TLS","This week: Magento APSB26-153 with five critical fixes, Supabase disabling old TLS 1.2 ciphers on 10 November, and .NET SDK updates.",{"author":20},[22,23,24],"2026-10-16T07:14:57.117895+00:00",{"id":42,"slug":43,"title":44,"excerpt":45,"meta_title":46,"meta_description":47,"featured_image":18,"fields":48,"tags":49,"published":25,"published_at":51,"created_at":51,"updated_at":51},"cdfe1566-04cc-4260-96ab-1f2d0bf327d7","notes/weekly-roundup-2026-10-09","Weekly round-up: Nuxt 4.6, scoped Supabase tokens, and a December deadline","Nuxt 4.6 and the end of Nuxt 3, scoped Supabase personal access tokens, the 1 December adapter removal, and WordPress 7.1.3.","Weekly Round-Up: Nuxt 4.6, Supabase Scoped Tokens","This week: Nuxt 4.6 and Nuxt 3 end of life, scoped Supabase access tokens, a 1 December deprecation date, and WordPress 7.1.3.",{"author":20},[22,24,50],"nuxt","2026-10-09T07:14:08.209884+00:00",{"id":53,"slug":54,"title":55,"excerpt":56,"meta_title":57,"meta_description":58,"featured_image":18,"fields":59,"tags":60,"published":25,"published_at":62,"created_at":62,"updated_at":62},"4b57ca81-a3e2-4785-a023-dcbdf8c077d5","notes/weekly-roundup-2026-10-02","Weekly round-up: Postgres security release, OrioleDB beta, and Supabase Middleware 1.0","Supabase's Postgres security release with four breaking changes, OrioleDB in public beta, Supabase Middleware 1.0, and a note on WordPress 7.1.2.","Weekly Round-Up: Postgres Release, OrioleDB Beta","This week: Supabase's Postgres 17.11 security release and its four breaking changes, OrioleDB public beta, and Supabase Middleware 1.0.",{"author":20},[22,24,61],"wordpress","2026-10-02T07:13:16.097003+00:00",{"id":64,"slug":65,"title":66,"excerpt":67,"meta_title":68,"meta_description":69,"featured_image":18,"fields":70,"tags":72,"published":25,"published_at":74,"created_at":75,"updated_at":76},"fd7b0e56-d3d2-4824-a2ce-2948a6ecfa7d","notes/why-16000-supabase-databases-were-left-exposed","16,326 Supabase Databases Were Left Exposed. Here's Why","UpGuard found over 16,000 public Supabase databases leaking real personal data this week. The cause traces back to one setting, and it's worth checking on your own project.","16,000 Exposed Supabase Databases: What Happened","UpGuard found 16,326 public Supabase databases leaking real data this week. The cause was one setting. Here's what to check on your own project.",{"author":71},"Adam Jackson",[24,73],"ai","2026-10-02T08:00:00+00:00","2026-09-27T07:18:05.689274+00:00","2026-10-02T08:00:01.68075+00:00",{"id":78,"slug":79,"title":80,"excerpt":81,"meta_title":82,"meta_description":83,"featured_image":18,"fields":84,"tags":85,"published":25,"published_at":86,"created_at":86,"updated_at":87},"d75fb417-2460-4469-b103-4e062f46d229","notes/weekly-roundup-2026-09-25","Weekly round-up: a critical WordPress RCE, Nuxt's build layer swap, and Claude gets serious about small business","A critical WordPress RCE worth patching today, Nuxt 4.5's build layer swap, Claude for Small Business grows up, and a quick look at this month's Supabase changelog.","Weekly Round-Up: WordPress RCE, Nuxt 4.5, Claude for SMBs","This week: a critical WordPress RCE worth patching today, Nuxt 4.5's new build layer, Claude for Small Business grows up, and a Supabase changelog look.",{"author":71},[22,61,50,73,24],"2026-09-25T07:19:43.316037+00:00","2026-10-01T19:41:42.773395+00:00",{"id":89,"slug":90,"title":91,"excerpt":92,"meta_title":93,"meta_description":94,"featured_image":18,"fields":95,"tags":96,"published":25,"published_at":97,"created_at":98,"updated_at":87},"37675193-0337-4634-bafa-c503df69b0c6","notes/weekly-roundup-2026-09-18","Weekly round-up: StyleSmuggler clean-up, a Supabase deadline, and the Claude Code limits shuffle","A week on from the Magento zero day, the mopping-up is where the real work is. Plus a Supabase logs endpoint being removed on 23 September, and the Claude Code limits change that is both a rise and a cut.","Round-up: StyleSmuggler clean-up and a Supabase deadline","The week after the Magento zero day: patching is the easy part, Supabase removes logs.all on 23 September, and Claude Code's limits moved.",{"author":71},[22,23,24,73],"2026-09-19T06:13:53.415+00:00","2026-09-18T06:10:00+00:00",1792742459773]