Notes

Two critical flaws in PHP itself let attackers run code on a server without logging in. What they are, why a login page doesn’t help, and what to do.

Find your site’s PHP version from the WordPress dashboard, then follow the path that applies to you.

Setting session.upload_progress.enabled = 0 is a useful stopgap, but it blocks one route into one of the two flaws. PHP’s own advisories say so.

The government’s register of Energy Performance Certificates is public, but it isn’t a dataset you can count from. What it took to make it one for the Tees Valley, and the traps along the way.

What I learned building ActionPoints, my first product on a language model. The guarantees worth having are the ones you enforce in code, not the ones you ask the model for.