7 min read
PHP2Shell: patch PHP now, then assume your secrets leaked
CVE-2026-109618 / CVE-2026-109619: unauthenticated RCE in PHP itself. Fixed versions, why updating Drupal or WordPress does nothing, and what to rotate.
Read more →#security
3 min read
Drupal security updates: a maintainer’s playbook
How Drupal security releases really work and the update routine I apply to client sites — from a maintainer of 24 modules who has shipped fixes under embargo.
Read more →