Author
PHP 8.2 reaches end of life December 31, 2026, the same day PHP 8.4 quietly loses active support. Here's the full official PHP schedule going into 2027, and which version to actually target for a new or existing project.
Two critical, unauthenticated CVEs (CVSS 9.8) hit The Events Calendar plugin a day apart, putting 600,000+ WordPress sites at risk. Here's what each attack path does, how to check for compromise, and why this landed in an unusually busy month for WordPress security.
Hetzner CX22 is now CX23, still €5.99/month for 2 vCPU and 4GB RAM. Full pricing tables for the whole CX, CAX, and CPX lineup, a link to Hetzner's official pricing page, and why the plan may be unorderable right now.
The usual fix for this Laravel migration error caps every unspecified string column at 191 characters, not just the one that failed. Here is a targeted fix instead, and whether this error still shows up on modern MySQL 8.
Nginx shows 502 Bad Gateway but your app is confirmed running? Check for an IPv4 vs IPv6 localhost mismatch in proxy_pass. Here is how to spot it in the error log and the one-line config fix.
Cloudflare Tunnel lets you expose a self-hosted app to the internet without opening a single port, using an outbound-only connection instead. Here is the setup, the catch-all rule most people miss, and a real firewall gotcha reported just weeks ago.
Laravel Cloud added a genuinely usage-based, hibernation-enabled entry plan, changing the math against a plain VPS for a small project. Here is what you get for the extra cost, the real cold-start tradeoff, and when a VPS still wins.
Composer added real malware protection this year through composer audit and Packagist's new scanning, but a recent attack hid malicious code in package.json instead. Here is what these tools actually catch, and the dependency file most PHP security reviews skip.
2026 has had a steady run of npm supply chain attacks hitting packages with hundreds of millions of weekly downloads. If your build pipeline runs npm install for Tailwind or Vite, you're exposed too, even if PHP is your main language. Here's how to actually reduce that risk.
Let's Encrypt is shortening certificate lifetimes over the next few years, and a lot of advice is telling people to check their renewal automation. If you use Caddy, here's exactly why you almost certainly don't need to do anything.
Tailscale switched to seat-based billing in April 2026, meaning you now pay for every assigned seat whether it's used or not. Here's how to find and remove the idle ones before they quietly inflate your bill.
Caddy 2.11.3 shipped a regression that breaks Caddyfiles using multiple localhost-based site blocks on different ports, exactly the pattern from our multi-app VPS guide. Here's how to check if you're affected and why updating to 2.11.4 matters.
