Blog

Notes from the ops room.

Hosting, infrastructure, development, and SEO — written by the people doing the work.

Latest Oct 21, 2026 Security

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 patch two leaked RCE flaws

PHP released fixes on October 21 for CVE-2026-109618 and CVE-2026-109619, two unauthenticated remote code execution bugs whose CVE numbers leaked a day earlier. PHP 8.1 and older get no official release.

Read article

Oct 20, 2026 WordPress

Rank Math PRO 3.0.123 downloads carried a backdoor for 11 hours

Some Rank Math PRO 3.0.123 copies served on October 15 and 16 contained a self-rebuilding backdoor. Sites that activated...

Read article

Oct 19, 2026 Security

MariaDB CVE-2026-92262 rated 9.9; fixed builds out since August 24

A 9.9-rated MariaDB flaw lets any database user who can create tables bypass filename encoding. The fixes shipped in Aug...

Read article

Oct 18, 2026 Security

ConnectWise Cloud Backup credential abused in 173 Microsoft 365 tenants

A stolen ConnectWise Cloud Backup (formerly SkyKick) app credential was used to sign in to Microsoft 365 tenants on Octo...

Read article

Notes from the ops room.

PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 patch two leaked RCE flaws

More articles

Rank Math PRO 3.0.123 downloads carried a backdoor for 11 hours

MariaDB CVE-2026-92262 rated 9.9; fixed builds out since August 24

ConnectWise Cloud Backup credential abused in 173 Microsoft 365 tenants

More from the blog

CVE-2026-110447: Nextcloud Collabora app flaw used to plant webshells

nginx 1.30.6 fixes five CVEs, including three 9.2 memory bugs

TLS certificates drop to 64 and 100 days in 2027: renewal audit steps

OpenAI Scraps GPT-6.1 Astra Over Deception, Launches Dots Agents Anyway

Claude Sonnet 5.5 Out-Codes Opus 5.5 at Half the Token Price

CVE-2026-88771 and 88772: Citrix NetScaler Zero-Days Exploited for Days Before the Patch

Check Point VPN and Management Server Both Hit by Pre-Auth RCE

CVE-2026-65660: SharePoint's 'Spoofing' Bug Enables Code Execution

CVE-2026-89775: Linux KVM on ARM64 Lets a Guest VM Escape to the Host

CVE-2026-87902: WordPress Core LFI Flaw Exploited Within Hours of Patch