Two Critical PHP Flaws Prompt Rethink of Self-Hosting Versus Managed Hosting

·2 views

Two critical PHP vulnerabilities disclosed this week could allow attackers to execute code on servers without authentication. A blogger received a Hetzner notice stating that patching a self-managed server is the owner's responsibility. Checking their setup, they found their WordPress sites on managed hosting were already patched by the provider, while their Hetzner server had no PHP installed. The experience led them to keep their sites on managed hosting, citing the cost of same-day patching and the risk a compromised site poses to other services on the same machine. Their stated rule is to self-host only systems they can patch the same day.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Arista VeloCloud Orchestrator Exposure: What ZoomEye Data Shows and Doesn't

A ZoomEye search on 22 October 2026 for the title fingerprint "VeloCloud" returned 520 matching internet-facing assets. That figure reflects hosts advertising a VeloCloud-related page title, a broad product-family signal rather than a count of vulnerable orchestrators or of systems on affected versions. A narrower query for "VeloCloud Orchestrator" with an HTTP service match returned only a handful of results. Arista has reported active exploitation of CVE-2026-114625 and named two source addresses seen in the attacks. Experts stress that organisations should inventory their own orchestrators and compare release versions against the patched builds instead of relying on external counts.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Private Image Storage: Signed Links, Retention Deadlines and Object-Store Costs

The article argues that images should live in a private bucket and be delivered through short-lived signed URLs issued only after an authorization check. It stresses that retention and deletion matter more to cost and compliance than metadata, especially for property-management apps handling leases and inspection photos. The author recommends a per-object ledger tracking scope, deadlines, legal holds, size and downloads, with monthly storage, request and egress estimates derived from it. Deletion should be handled by a frequent queue-based worker that verifies removal and keeps an audit manifest with a content hash. Signed URLs should never be exposed in pages, logs or analytics, and their expiry should be tuned to the sensitivity of the file.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Parsing Property Owner Names in pandas: Individuals, Joint Owners, Trusts and LLCs

Property owner fields in county assessor records often combine several people and entities in one cell, which complicates contact-finding work. Co-owner markers such as ETUX and ETAL, trustee designations, business suffixes, and estate wording all need to be recognized before a list is used for skip tracing. A tutorial shows how to build a pandas pipeline that classifies each owner as an individual or an entity, splits joint owners into separate rows, and parses LAST FIRST MIDDLE names while flagging ambiguous cases instead of guessing. The approach keeps the raw column unchanged and adds a parse_status column, with tests written as plain assert statements. Because naming conventions vary by county and over time, the author recommends sampling each export before relying on any keyword rule.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Part 5 of the Communications series covers capturing delivery events after dispatch

Part 4 ended with messages marked as Dispatched, meaning a provider accepted them but not that recipients received them. Real providers such as Twilio report later stages like sent, delivered, or undelivered, and email and push services report bounces, opens, and invalid tokens. This article records those delivery events in Communications, stores them, and displays them to buyers on a new Messages page. Communications now sends each buyer a single message on the first channel that can reach them, using only verified email addresses and phone numbers. Delivery events are represented by a provider-agnostic DeliveryReport structure that captures the event, channel, provider, and outcome.

0 comments Read more at DEV Community