The network for creativity
Join 1.25M professional creatives like you
Connect with clients, get discovered, and run your business 100% commission-free
Creatives on Contra have earned over $150M and we are just getting started
Back to feedPost
Is your PHP server one bad request away from a takeover? šØ
The UK's NCSC just flagged two critical PHP bugs (CVE-2026-109618 and CVE-2026-109619). An out-of-memory condition can corrupt memory and, under certain conditions, let an attacker run code on your server without logging in. Every version of PHP is affected, not just old ones.
My quick checklist:
ā
Find every PHP install, internet-facing ones first
ā
Update to the latest fixed PHP release
ā
Check bundled apps and appliances that ship PHP
ā
Can't patch yet? Apply the PHP team's temporary mitigations or take the system offline
Laravel and PHP folks: have you patched yet, or is there that one legacy box nobody wants to touch? š
Source: https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php
Timely and genuinely useful. The bundled apps line is the one people skip most. Everyone patches their own server and forgets the appliance or plugin that ships its own PHP copy. The checklist format makes this immediately actionable. Do you manage a mix of your own servers and client boxes when something like this drops?
The network for creativity
Join 1.25M professional creatives like you
Connect with clients, get discovered, and run your business 100% commission-free
Creatives on Contra have earned over $150M and we are just getting started
Related posts
Every great digital product stars with a problem worth solving.
Maybe you need a website that does more than look good. Maybe you're planning a mobile application, improving your infrastructure or looking for a stronger approach to security.
Whatever stage you're at, let's start with the right questions.
tell us what you're building.
SYRAX - we design, build & protect digital systems.
startupssoftwareengineeringwebdevelopmentCybersecurityFull Stack DevelopmentWeb DevelopmentCanvaFigma
š§ I spent about 6 months in an electronics repair shop while I was at school.
So when I built a website for a repair shop (a concept project), I asked: what do customers actually want to know?
š āWhatās wrong with my device?ā
š āIs it ready yet?ā
I turned those into a symptom checker and a repair status page.Live demo: https://me.aleex.workers.dev/work/bench-and-byte/
Nice effort š
My best commit this month deleted 16,808 lines.
I ran an end-to-end security audit on Orbit, my finance side project. The worst find: an old backend I had stopped using was still live in production, and it trusted tokens it shouldn't have. Nothing in the app called it anymore, so nobody was looking at it.
What changed:
ā Deleted the old backend and the unused screens that went with it, so it can't be redeployed
ā Capped request bodies and kept database and API error text in the logs, not in responses
ā Locked the database down by default and kept closed periods closed
ā Added security headers (CSP, frame blocking) and a dedicated security test file
126 files changed, +565 / ā16,808 lines.
The PM lesson: unused code isn't harmless. If it's deployed, it's attack surface. "We don't use that anymore" should mean "it's deleted", not "it's ignored".
What dead code is still live in your product?
