Andrew Clark: developer of twenty years, data engineering for North Yield, and notes on building software, working with data, security and property.https://www.andrewclark.dev/https://www.andrewclark.dev/notes/php2shell-plain-english/https://www.andrewclark.dev/notes/php2shell-plain-english/Two critical flaws in PHP itself let attackers run code on a server without logging in. What they are, why a login page doesn’t help, and what to do.Wed, 21 Oct 2026 15:30:00 GMTsecurityphpwordpresscve-2026-109618cve-2026-109619https://www.andrewclark.dev/notes/wordpress-php-version-check/https://www.andrewclark.dev/notes/wordpress-php-version-check/Find your site’s PHP version from the WordPress dashboard, then follow the path that applies to you.Wed, 21 Oct 2026 15:20:00 GMTsecuritywordpressphphttps://www.andrewclark.dev/notes/upload-progress-is-not-a-fix/https://www.andrewclark.dev/notes/upload-progress-is-not-a-fix/Setting session.upload_progress.enabled = 0 is a useful stopgap, but it blocks one route into one of the two flaws. PHP’s own advisories say so.Wed, 21 Oct 2026 15:10:00 GMTsecurityphpcve-2026-109619https://www.andrewclark.dev/notes/epc-register-dataset/https://www.andrewclark.dev/notes/epc-register-dataset/The government’s register of Energy Performance Certificates is public, but it isn’t a dataset you can count from. What it took to make it one for the Tees Valley, and the traps along the way.Fri, 16 Oct 2026 00:00:00 GMTdataepcpostgresqlelixiropen-datanorth-yieldhttps://www.andrewclark.dev/notes/llm-cannot-invent-a-quote/https://www.andrewclark.dev/notes/llm-cannot-invent-a-quote/What I learned building ActionPoints, my first product on a language model. The guarantees worth having are the ones you enforce in code, not the ones you ask the model for.Mon, 03 Aug 2026 00:00:00 GMTdevllmelixirphoenixtestingactionpoints