Website security guides
Short, practical guides on the vulnerabilities and deadlines that hit real websites: PHP and Node.js releases, certificates, and apps built with AI.
PHP2Shell (CVE-2026-109618 / 109619): Check and Patch Your PHP Server
Two critical unauthenticated RCE bugs in PHP core were fixed on October 21, 2026. Which versions are affected, how to check yours, and what to do if you cannot upgrade today.
SiteXray
Node.js End of Life: Node 20 Is EOL, and the October 2026 Security Release
Node.js release lines and their end-of-life dates, what the October 21, 2026 security release fixed, and how to find every place an old Node version is still running.
SiteXray
PHP End of Life Dates (2026): Which PHP Versions Are Still Supported
Every PHP branch with its end-of-life date, what end of life really means for a live site, and a practical order for upgrading from PHP 7.4, 8.1 or 8.2.
SiteXray
SSL Certificate Validity: 200 Days Now, 100 in 2027, 47 Days by 2029
The CA/Browser Forum timeline for shorter TLS certificate lifetimes, what Let's Encrypt is changing, and how to automate renewal before manual certificates become a monthly chore.
SiteXray
Vibe Coding Security Checklist: 12 Checks Before You Launch an AI-Built App
The security mistakes AI coding tools make most often, from leaked API keys to Supabase tables without Row Level Security, and a 12-point checklist to run before launch.
SiteXray