news
Content Management Systems (CMS) / Static Site Generators (SSG) Picks With Concerns or Focus on PHP
-
Ronalds Vilciņš ☛ How I Organize My Hugo Site · Ronalds Vilciņš
The best Hugo project structure is not the cleverest one. It is the one I can open after six months and understand without searching through three abstraction layers.
-
Raymond Camden ☛ Adding a PDF Display to Eleventy
A while back I realized I wasn't being consistent with how I did... "stuff" here, like call outs, Youtube links, etc. I started a guide doc so I'd have a quick way to remember what I did last time, and be more consistent.
-
LWN ☛ Today's PHP Security Release, and How We're Strengthening PHP Security (PHP Foundation)
The PHP Foundation has put out a
blog entry explaining how the vulnerabilities disclosed today came
about and why they took so long to fix.
-
Scoop News Group ☛ PHP releases emergency fixes for 2 critical vulnerabilities
The project overseeing the programming language is releasing patches Wednesday, with the internet racing to patch the 9.2 rated flaw.
-
Jeff Geerling ☛ Upgrade your PHP installs immediately to protect against php2shell
I'm glad I finished migrating this website from a PHP-based CMS to Hugo earlier this year—having a static website and a minimal commenting system saves on hosting costs and dramatically reduces attack surfaces. Especially in this era of AI tooling making exploit discovery easier.
-
Security Week ☛ PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors
Several cybersecurity companies saw exploitation attempts of CVE-2026-109618 and CVE-2026-109619 before PHP released the patches.
-
LWN ☛ PHP patches released for two critical RCEs
The PHP project has published PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to address two critical vulnerabilities that could allow unauthenticated remote code Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.
-
PC World ☛ Why is everyone talking about PHP’s ‘critical’ security flaws?
Many websites use server-side languages to serve content, and of those that do, some sources (like W3Techs) estimate that almost 70 percent rely on PHP. Across the broader internet, W3Techs believes around 40 percent of all websites (yep, all!) run on WordPress—a major adopter of PHP.