12 articles
Every article tagged PHP, newest first. Search all articles
Security11 min read
PHP session upload progress vulnerability after the PHP2Shell patch
The PHP session upload progress vulnerability remains open after the PHP2Shell patch. On 23 October 2026, php.net warned about an unlikely remote code execution path tracked as CVE-2026-115560; the 21 October security releases still fix the two original PHP2Shell vulnerabilities.
Security14 min read
PHP critical security update: PHP2Shell leak and fixes
PHP released a PHP critical security update on Wednesday, October 21, 2026, for two vulnerabilities known as PHP2Shell that allow remote code execution without authentication. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Development8 min read
ACF blocks vs native Gutenberg blocks: what to build for a client site
For most client sites, the ACF blocks vs Gutenberg blocks choice comes down to editor needs, team skills and how much JavaScript you want to own. ACF Blocks reduce custom editor code when ACF fields fit the UI, and v3 can provide inline editing for simple fields.
Security7 min read
Secure WordPress REST API endpoints: permission callbacks that hold up
A WordPress REST API permission_callback should answer one question: can this authenticated user perform this specific action on this specific object? Pair that check with the right authentication method, strict argument validation, a narrow response shape, and limits on expensive or sensitive requests.
Development8 min read
WooCommerce payment gateways for the Checkout block: a working integration
A WooCommerce payment gateway Checkout block integration needs a PHP payment method type and a JavaScript payment method registration. Your existing WC_Payment_Gateway can still process the payment, but the block will not list it until both sides are registered with the same gateway ID.
Monitoring7 min read
The WordPress debug log: turn it on safely, find it, and read it
To turn on the WordPress debug log, set WP_DEBUG and WP_DEBUG_LOG to true in wp-config.php, then set WP_DEBUG_DISPLAY to false so errors are not printed into pages.
Performance7 min read
WordPress OPcache settings: size it, check it and keep it warm
WordPress OPcache settings should be sized from the cache your PHP-FPM workers are using, not from a copied tuning block. Check the live OPcache status, count the PHP files in the active release, then make deployment resets and warm-up part of the release process.
Performance8 min read
WordPress PHP workers: size them, spot saturation and use fewer
WordPress PHP workers are PHP-FPM child processes that execute uncached PHP requests, and pm.max_children caps how many a pool can serve at once. Size the pool from measured worker memory and available RAM, then confirm saturation with the PHP-FPM status page and logs before adding workers.
Development5 min read
WordPress plugin database migrations with dbDelta, done safely
WordPress plugin database migrations should compare a stored schema version with the version your plugin expects, then run only the missing steps. Use dbDelta() for table creation and supported schema changes, and use explicit, guarded migrations for destructive or unsupported changes.