Security flaws I’ve reviewed, and what I did
When a security flaw is published in the software the sites I host run on, I check whether it reaches them and act on it. This page lists every one I’ve looked at, newest first, with a link to the full write-up.
- Last updated 26 October 2026
Published flaws (CVEs)
| Flaw | Published | Status | What I did | More |
|---|---|---|---|---|
| CVE-2026-109618: PHP memory corruption (critical) | 21 Oct 2026 | Fixed 21 Oct | Every WordPress site moved to PHP 8.3.36 the same day, one copy at a time with no downtime. Checked every copy; no sign of a break-in. | Read the post |
| CVE-2026-109619: PHP stale request state (critical) | 21 Oct 2026 | Fixed 21 Oct | Fixed by the same PHP 8.3.36 update as the flaw above. | Read the post |
| CVE-2026-87902: WordPress page-template flaw | September 2026 | Not affected | Every site already had the fixed WordPress release. I also added a server-level lock to every WordPress site that stops this whole kind of attack, fixed or not. | Read the post |
Other security notices
Some problems never get a CVE number but still need action.
| Problem | Published | Status | What I did | More |
|---|---|---|---|---|
| eMudhra certificate issuer: signing keys could be worked out | 17 Oct 2026 | Fixed 25 Oct | Removed the issuer from the trusted list on every site, app and server, and switched WordPress to the server’s list so future removals apply straight away. | Read the post |
How I handle them
- I keep a copy of every site’s logs before changing anything, so I can look back if something did happen.
- Fixes are rolled out one copy of a site at a time, so your site stays up while it’s updated.
- I check every running copy is on the fixed version before marking a flaw as fixed here.
- For anything serious, I post on the news page while the work is under way and update the post when it’s done.
Found a problem?
If you think you’ve found a security problem with a site I host or with this service, please tell me through the contact page.