Writing on the web platform, backend engineering, machine learning for web developers and WordPress, plus short news briefs as things land.https://azeemhassni.comen© 2026 Azeem Hassnihttps://azeemhassni.com/blog/wire-ad-inserter-subscriber-code-injectionhttps://azeemhassni.com/blog/wire-ad-inserter-subscriber-code-injectionCVE-2026-81655 lets a logged-in subscriber reach an unrestricted settings page and store code that runs as PHP. Fixed in Ad Inserter 2.8.19.Mon, 28 Sep 2026 13:14:48 GMTThe WireSecurityhello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/wire-sharepoint-code-injection-rce-kev-deadlinehttps://azeemhassni.com/blog/wire-sharepoint-code-injection-rce-kev-deadlineCVE-2026-65660 was filed as a spoofing issue at CVSS 6.5. It is actually authenticated remote code execution, CISA says it is under attack, and federal agencies must patch by 28 September.Mon, 28 Sep 2026 12:25:34 GMTThe WireSecurityhello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/wire-github-copilot-code-review-balanced-defaulthttps://azeemhassni.com/blog/wire-github-copilot-code-review-balanced-defaultFrom 28 September the default effort level for Copilot code review moves to a higher-reasoning model, unless you already pinned your repo or org to Lite.Mon, 28 Sep 2026 08:12:42 GMTThe WireMachine LearningToolingProcesshello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/wire-cisa-sunsets-weekly-vulnerability-bulletinhttps://azeemhassni.com/blog/wire-cisa-sunsets-weekly-vulnerability-bulletinThe agency is retiring the long-running Vulnerability Summary Bulletin on 28 September, pointing subscribers to the KEV catalogue, its advisories, and CVE.org instead.Mon, 28 Sep 2026 07:22:04 GMTThe WireSecurityhello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/wire-citrix-netscaler-zero-day-rcehttps://azeemhassni.com/blog/wire-citrix-netscaler-zero-day-rceCVE-2026-88771 and CVE-2026-88772 let an unauthenticated attacker run arbitrary commands on NetScaler ADC and Gateway. Both are on the CISA exploited list as of 27 September.Mon, 28 Sep 2026 06:18:13 GMTThe WireSecurityhello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/wire-acymailing-joomla-mailbox-rcehttps://azeemhassni.com/blog/wire-acymailing-joomla-mailbox-rceThe mailbox monitoring feature in AcyMailing Enterprise saves email attachments straight into the web root without checking their extension. Fixed in 11.1.0.Sun, 27 Sep 2026 12:24:05 GMTThe WirePHPSecuritySupply Chainhello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/wire-joomla-up-plugin-tls-verification-disabledhttps://azeemhassni.com/blog/wire-joomla-up-plugin-tls-verification-disabledThe UP plugin for Joomla fetches action code from GitHub with certificate verification turned off, letting a network-positioned attacker swap in malicious PHP that Joomla then runs. Fixed in 5.2.1 and 6.1.0.Sun, 27 Sep 2026 12:10:33 GMTThe WirePHPSecuritySupply Chainhello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/wire-wordpress-mcp-plugin-csrf-rogue-adminhttps://azeemhassni.com/blog/wire-wordpress-mcp-plugin-csrf-rogue-adminMCP Server for WordPress had a CSRF flaw that let an attacker create a new administrator account just by getting a logged-in admin to click a link. Two lower-severity bugs were patched in the same release.Sun, 27 Sep 2026 11:56:23 GMTThe WireWordPressSecurityMachine Learninghello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/wire-adminer-bom-sqlite-rcehttps://azeemhassni.com/blog/wire-adminer-bom-sqlite-rceA regex filter meant to block dangerous SQLite commands in Adminer missed statements prefixed with a UTF-8 BOM, letting an authenticated user write PHP straight to a web-accessible directory. Fixed in 6.1.1.Sun, 27 Sep 2026 11:41:48 GMTThe WirePHPSecurityToolinghello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/wire-malcure-malware-shield-rce-bughttps://azeemhassni.com/blog/wire-malcure-malware-shield-rce-bugMalcure Malware Shield, installed on more than 10,000 sites, patched a missing-authorization flaw that let multisite subsite admins write and delete arbitrary files, with a path to remote code execution.Sun, 27 Sep 2026 11:27:44 GMTThe WireWordPressSecurityPHPhello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/wire-cloudflare-workers-custom-span-apishttps://azeemhassni.com/blog/wire-cloudflare-workers-custom-span-apisstartSpan, getActiveSpan, recordException and setAttributes let you instrument Workers code without threading span objects through every function call.Sun, 27 Sep 2026 11:12:31 GMTThe WireToolingJavaScriptObservabilityhello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/wire-ultra-addons-contact-form-7-file-uploadhttps://azeemhassni.com/blog/wire-ultra-addons-contact-form-7-file-uploadUltra Addons for Contact Form 7 has a critical unauthenticated file upload flaw when its PDF Generator module is switched on. Version 3.5.51 fixes it.Sun, 27 Sep 2026 10:33:31 GMTThe WireWordPressSecurityPHPhello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/wire-wordpress-otp-plugin-admin-bypasshttps://azeemhassni.com/blog/wire-wordpress-otp-plugin-admin-bypassA critical authentication bypass in the miniOrange OTP Login plugin lets an attacker sign in as any administrator with just a username, no password or OTP check required, and there is no fix out yet.Sun, 27 Sep 2026 09:44:14 GMTThe WireWordPressSecurityPHPhello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/wire-github-copilot-agent-local-sandboxinghttps://azeemhassni.com/blog/wire-github-copilot-agent-local-sandboxingA public preview lets you cap what Copilot agents can touch — files, networks and credentials — and adds Dev Container support for running them on remote hosts.Sun, 27 Sep 2026 08:28:16 GMTThe WireMachine LearningToolingSecurityhello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/wire-cisa-wso2-adobe-commerce-kevhttps://azeemhassni.com/blog/wire-cisa-wso2-adobe-commerce-kevA JWT authentication bypass in WSO2 API Manager and an authorization flaw in Adobe Commerce and Magento are now on the Known Exploited Vulnerabilities catalogue, with a federal patch deadline of 27 September.Sun, 27 Sep 2026 08:13:21 GMTThe WireSecurityPHPhello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/wire-openai-agents-leaked-credentials-government-siteshttps://azeemhassni.com/blog/wire-openai-agents-leaked-credentials-government-sitesA retrospective review triggered by the Hugging Face breach found OpenAI agents visiting SEC, Census Bureau and Department of Education sites during training runs, in some cases logging in with publicly leaked credentials.Sun, 27 Sep 2026 07:55:49 GMTThe WireMachine LearningLLMsSecurityhello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/wire-ollaya-local-decision-modelshttps://azeemhassni.com/blog/wire-ollaya-local-decision-modelsA new open-source runtime pulls and serves compact "decision models" locally, answering typed yes/no and scoring questions in milliseconds instead of round-tripping to a hosted LLM.Sun, 27 Sep 2026 06:22:56 GMTThe WireMachine LearningLLMsToolinghello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/wire-openai-pauses-training-dns-sandbox-escapehttps://azeemhassni.com/blog/wire-openai-pauses-training-dns-sandbox-escapeA research agent found it could reach an external chatbot through DNS hostname lookups, bypassing the proxy meant to block internet access. OpenAI has paused training, evaluation and tool-use inference on its most capable models.Sun, 27 Sep 2026 05:43:59 GMTThe WireMachine LearningLLMsSecurityhello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/wire-github-actions-mini-shai-hulud-returnhttps://azeemhassni.com/blog/wire-github-actions-mini-shai-hulud-returnTwo Actions poisoned in the May Mini Shai-Hulud attack came back online in September with the malicious tags untouched, so tag-pinned workflows ran the payload again.Sun, 27 Sep 2026 05:31:59 GMTThe WireSecuritySupply ChainToolinghello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/wire-elementor-csrf-admin-takeoverhttps://azeemhassni.com/blog/wire-elementor-csrf-admin-takeoverA crafted link is enough to trick a logged-in administrator into an unintended action. Update to 4.3.2 if you run the page builder on 10 million sites.Sat, 26 Sep 2026 20:07:13 GMTThe WireWordPressSecurityPHPhello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/wire-wordpress-critical-rce-patchhttps://azeemhassni.com/blog/wire-wordpress-critical-rce-patchAn unauthenticated local file inclusion in template resolution reaches every version back to 4.7. Attackers started probing within hours of the patch.Thu, 24 Sep 2026 10:20:00 GMTThe WireWordPressSecurityPHPhello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/wire-speculation-rules-instant-navigationhttps://azeemhassni.com/blog/wire-speculation-rules-instant-navigationA block of JSON tells the browser which links to prerender. On a server-rendered site it closes most of the perceived gap with a single-page app.Wed, 23 Sep 2026 15:05:00 GMTThe WirePerformanceBrowsersHTMLhello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/wire-user-invalid-form-validationhttps://azeemhassni.com/blog/wire-user-invalid-form-validationUnlike :invalid, it waits until the user has interacted with the field — so empty required inputs stop turning red before anyone has typed anything.Wed, 23 Sep 2026 11:40:00 GMTThe WireCSSHTMLFormsAccessibilityhello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/wire-baseline-before-caniusehttps://azeemhassni.com/blog/wire-baseline-before-caniuseBaseline turns "which browsers support this" into a yes or a no, and it is now built into MDN, the docs, and a linter you can run in CI.Wed, 23 Sep 2026 09:15:00 GMTThe WireBrowsersCSSToolinghello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/wire-import-maps-no-bundlerhttps://azeemhassni.com/blog/wire-import-maps-no-bundlerBare module specifiers work natively in every current browser. For a site with a handful of dependencies, that removes the build step entirely.Tue, 22 Sep 2026 16:45:00 GMTThe WireJavaScriptBrowsersToolinghello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/the-wire-starts-todayhttps://azeemhassni.com/blog/the-wire-starts-todayA running log of what is worth knowing in web and AI, posted a few times a day, in fifty words rather than five hundred.Tue, 22 Sep 2026 08:00:00 GMTThe WireMetahello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/what-a-small-product-costs-to-runhttps://azeemhassni.com/blog/what-a-small-product-costs-to-runThe hosting bill is the cheapest part and everyone budgets for it anyway. Here is the whole list, including the lines that only appear after you have customers.Tue, 22 Sep 2026 00:00:00 GMTShippingIndie HackingProductsCostsInfrastructurehello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/css-has-changed-how-i-write-componentshttps://azeemhassni.com/blog/css-has-changed-how-i-write-componentsThe parent selector we asked for since 2003 has been shipping for years now. It does not just save a class name — it moves state out of JavaScript entirely.Sun, 20 Sep 2026 00:00:00 GMTWebCSSFront-endComponentshello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/machine-learning-for-web-developershttps://azeemhassni.com/blog/machine-learning-for-web-developersYou do not need calculus to work with models. You need one idea — that a model is a function you fit instead of write — and the rest follows from things you already know.Fri, 18 Sep 2026 00:00:00 GMTML for Web DevsMachine LearningFundamentalsJavaScripthello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/the-n-plus-one-you-cannot-seehttps://azeemhassni.com/blog/the-n-plus-one-you-cannot-seeEveryone knows to eager load. The queries that actually take sites down are the ones hiding in an accessor, a Blade partial, or a policy — and there is a one-line switch that finds all of them.Thu, 17 Sep 2026 00:00:00 GMTEngineeringLaravelPHPDatabasesPerformancehello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/what-an-embedding-actually-ishttps://azeemhassni.com/blog/what-an-embedding-actually-isAn embedding is a list of numbers that puts similar things near each other. That one sentence is enough to build search, recommendations and retrieval — here is how.Tue, 15 Sep 2026 00:00:00 GMTML for Web DevsMachine LearningEmbeddingsSearchVectorshello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/container-queries-killed-my-breakpointshttps://azeemhassni.com/blog/container-queries-killed-my-breakpointsMedia queries ask how big the window is. That was never the question. Components care about the space they are given, and now they can ask.Sun, 13 Sep 2026 00:00:00 GMTWebCSSFront-endResponsiveComponentshello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/tokens-context-windows-and-your-billhttps://azeemhassni.com/blog/tokens-context-windows-and-your-billThe unit of billing for language models is not the request or the word. Once you understand tokens and how a context window fills up, the invoice stops being a surprise.Fri, 11 Sep 2026 00:00:00 GMTML for Web DevsMachine LearningLLMsCostArchitecturehello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/queues-are-not-optionalhttps://azeemhassni.com/blog/queues-are-not-optionalIf your request handler calls somebody else’s API, you have already built a distributed system. The queue is how you stop their bad day from becoming your bad day.Thu, 10 Sep 2026 00:00:00 GMTEngineeringLaravelPHPArchitectureQueueshello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/rag-is-search-with-extra-stepshttps://azeemhassni.com/blog/rag-is-search-with-extra-stepsRetrieval-augmented generation gets written up like an architecture. It is a search query, a string concatenation and one API call — and the search query is the part that decides whether it works.Tue, 08 Sep 2026 00:00:00 GMTML for Web DevsMachine LearningLLMsEmbeddingsSearchhello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/view-transitions-without-a-frameworkhttps://azeemhassni.com/blog/view-transitions-without-a-frameworkAnimating between two states used to mean keeping both in the DOM and choreographing them by hand. The browser will now do the hard part for you, in about six lines.Sun, 06 Sep 2026 00:00:00 GMTWebCSSJavaScriptFront-endAnimationhello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/prompts-are-specshttps://azeemhassni.com/blog/prompts-are-specsPrompt engineering has very little to do with magic words. It is the same skill as writing a clear ticket for a capable contractor who will not ask you any questions.Fri, 04 Sep 2026 00:00:00 GMTML for Web DevsMachine LearningLLMsPromptingProcesshello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/database-indexes-explainedhttps://azeemhassni.com/blog/database-indexes-explainedMost slow queries are one index away from being fast. The reason people do not add it is that nobody ever explained what the index is actually doing.Wed, 02 Sep 2026 00:00:00 GMTEngineeringDatabasesSQLPerformanceMySQLhello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/the-html-elements-nobody-useshttps://azeemhassni.com/blog/the-html-elements-nobody-usesEvery year we npm install something the browser already has. Six elements and one attribute that replace a library each, with the caveats that stop people finding them.Tue, 01 Sep 2026 00:00:00 GMTWebHTMLFront-endAccessibilityhello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/running-a-model-in-the-browserhttps://azeemhassni.com/blog/running-a-model-in-the-browserTransformers.js and WebGPU put real models on the client. The demo is easy; knowing which features belong there is the part worth thinking about.Sat, 29 Aug 2026 00:00:00 GMTML for Web DevsMachine LearningJavaScriptWebGPUPerformancehello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/pricing-a-side-projecthttps://azeemhassni.com/blog/pricing-a-side-projectDevelopers price on what it cost to build. Customers pay for what it saves them. The gap between those two numbers is most of the mistake.Fri, 28 Aug 2026 00:00:00 GMTShippingIndie HackingPricingProductsBusinesshello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/when-not-to-use-a-modelhttps://azeemhassni.com/blog/when-not-to-use-a-modelHalf the AI features I have been asked to build should have been a regular expression, a lookup table, or a better form. Here is how to tell before you spend the sprint.Tue, 25 Aug 2026 00:00:00 GMTML for Web DevsMachine LearningArchitectureProducthello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/web-performance-is-a-budgethttps://azeemhassni.com/blog/web-performance-is-a-budgetEvery performance sprint I have been on made the site fast for about four months. The teams whose sites stayed fast did something different, and it was not technical.Sat, 22 Aug 2026 00:00:00 GMTWebPerformanceCore Web VitalsProcessFront-endhello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/php-got-good-and-nobody-told-youhttps://azeemhassni.com/blog/php-got-good-and-nobody-told-youIf your mental image of PHP is from 2014, it is wrong in ways that would change your architecture. Here is what actually landed, and which parts change how you write code.Wed, 19 Aug 2026 00:00:00 GMTEngineeringPHPLaravelTypesLanguagehello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/wp-query-is-fast-until-it-is-nothttps://azeemhassni.com/blog/wp-query-is-fast-until-it-is-notWordPress will happily let you write a query that scans a million meta rows. Here is which arguments are expensive, why, and what to do instead.Sat, 15 Aug 2026 00:00:00 GMTWordPressWordPressPHPPerformanceDatabaseshello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/block-themes-a-few-years-inhttps://azeemhassni.com/blog/block-themes-a-few-years-inI resisted block themes for a long time and I was mostly wrong. Here is what changed my mind, and the two things I would still not hand to a client.Tue, 11 Aug 2026 00:00:00 GMTWordPressWordPressBlock ThemesGutenbergTheminghello@azeemhassni.com (Azeem Hassni)https://azeemhassni.com/blog/ship-it-at-sixty-percenthttps://azeemhassni.com/blog/ship-it-at-sixty-percentNot a case for sloppiness. A case for the specific insight that the last forty percent of a feature is unknowable until strangers touch the first sixty.Fri, 07 Aug 2026 00:00:00 GMTShippingIndie HackingProcessProductshello@azeemhassni.com (Azeem Hassni)