8 articles
Every article tagged Server Optimization, newest first. Search all articles
Security10 min read
cPGuard supply chain attack: check your server and WordPress sites
The cPGuard supply chain attack put root-level server credentials at risk through a malicious automatic update on November 2, 2026. Check your cPGuard update history first, even if you have already patched the server.
Security13 min read
WordPress 7.1.4 security release: exploited updater flaw and what to do now
The WordPress 7.1.4 security release fixes 22 vulnerabilities, including an updater flaw that needs no login and can lead to remote code execution. Wordfence recorded attack attempts, and on November 3, 2026, CISA added the flaw to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation.
Security11 min read
HTTP2Shell (CVE-2026-111497): WordPress and Next.js exposure
HTTP2Shell is CVE-2026-111497, a flaw in Google's Brotli decoder that can corrupt memory when software decompresses malicious data. Also called Node2Shell and Broccoli2Shell, it has fixes in Node.js 22.23.4, 24.22.1 and 26.12.1, plus Brotli 1.0.10, 1.1.1 and 1.2.1.
Security11 min read
PHP session upload progress vulnerability after the PHP2Shell patch
The PHP session upload progress vulnerability remains open after the PHP2Shell patch. On 23 October 2026, php.net warned about an unlikely remote code execution path tracked as CVE-2026-115560; the 21 October security releases still fix the two original PHP2Shell vulnerabilities.
Security14 min read
PHP critical security update: PHP2Shell leak and fixes
PHP released a PHP critical security update on Wednesday, October 21, 2026, for two vulnerabilities known as PHP2Shell that allow remote code execution without authentication. The fixed versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
Performance7 min read
WordPress OPcache settings: size it, check it and keep it warm
WordPress OPcache settings should be sized from the cache your PHP-FPM workers are using, not from a copied tuning block. Check the live OPcache status, count the PHP files in the active release, then make deployment resets and warm-up part of the release process.
Performance8 min read
WordPress PHP workers: size them, spot saturation and use fewer
WordPress PHP workers are PHP-FPM child processes that execute uncached PHP requests, and pm.max_children caps how many a pool can serve at once. Size the pool from measured worker memory and available RAM, then confirm saturation with the PHP-FPM status page and logs before adding workers.
Performance7 min read
How to reduce WordPress TTFB: a diagnostic guide
To reduce WordPress TTFB, measure the same request at each layer instead of tuning WordPress blindly. Separate DNS, connection and TLS time from time to first byte, compare CDN hits with origin requests, then profile PHP, database work and external calls on the slow path.