Blesta: Not Everything Should Be Vibe Coded. Apparently, Security Reports Can Be Vibe Ignored.
A WHMCS refugee, two AI assistants, 32 security findings, twelve matching code fixes, and a support ticket that has apparently taken a vow of silence.
Month: October 2026
PHP2Shell Day: Everyone Else Took Their Sites Offline. We Merged a WAF Rule.
Two critical PHP RCEs, a leaked embargo, a continent of nervous sysadmins, and one daemon that spent the afternoon arguing with its own code reviews. What CFM rules 10021/10022 catch for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) — and what they don’t.