Insights
Our Blogs
Discover our latest insights from our expert team on product engineering, AI automation, design, and the systems that have to work.
Latest Articles
Field notes, playbooks, and perspectives from the people building with our clients.
12 Nov 20267 min read
Why Older PHP Websites Struggle With the Live Features Customers Now Expect
Classic PHP starts fresh for every visit and forgets everything at the end. That's simple and robust, but it makes live dashboards, chat, notifications and long running jobs slow,…
10 Nov 20267 min read
A Forgotten Testing Tool on Your Website Could Hand Attackers Your Server
CVE 2017 9841 lets anyone on the internet run code through a developer testing file that should never have been public. It was fixed in 2016, CISA lists it as exploited, and…
6 Nov 20267 min read
The Upgrade Treadmill: Why Older PHP Applications Fall Off Security Support
PHP 7.4 lost security support in 2022, yet a quarter of PHP websites still run PHP 7. The reason is rarely laziness: upgrading an old application can break it. Here's what that…
4 Nov 20267 min read
Drupalgeddon: When a Flaw in Your Website's Core Puts Every Page at Risk
Two critical flaws in Drupal's core let attackers take over unpatched sites, and attacks followed within days. Here's what that means for any business still running an old or…
3 Nov 20266 min read
CosmicSting: How One Magento Flaw Put Card Skimmers on Thousands of Online Stores
CosmicSting (CVE 2024 34102) let attackers steal a Magento store's secret key without logging in, then copy customers' card details at checkout. Sansec counted 4,275 stores…
3 Nov 20267 min read
Webshells: The Hidden File That Lets Attackers Keep Coming Back to Your Server
A webshell is one small file that turns your web server into an attacker's remote control, and fixing the original weakness doesn't remove it. Here's why ageing PHP websites make…
2 Nov 20267 min read
Nobody Is Maintaining This: The Hidden Risk of Abandoned Plugins and Packages
Plugins and code libraries stop being maintained all the time, and your website keeps running them, often without any warning. Here's why abandoned components are a growing…
2 Nov 20267 min read
An Old PHP Coding Habit That Can Let Attackers Run Code on Your Server
Older PHP code often rebuilds stored data with a function called unserialize(). When that data comes from a visitor, it can let an attacker run code on your server. It sits behind…
30 Oct 20267 min read
Debug Mode Left On: How a Laravel Error Page Can Hand Attackers Your Server
On older Laravel applications, a developer setting left switched on let anyone on the internet run code on the server. The US government lists the flaw, CVE 2021 3129, as used in…
Showing 9 of 46 articles
Build with us. Deploy with us. Win with us
We don't deliver projects and walk away. We build with you, inside your mission.