Section
Security
Vulnerabilities, hardening and incident coverage: what actually breaks sites, and what to do about it.
Article
The plan is not the document, it is the rehearsal
During the November 2026 Microsoft outage, courts kept running on paper because the fallback existed and someone had practised it. A quarterly drill calendar that fits a small business: one restore, one failover, one comms check, one map refresh, plus tabletop scenarios built from the real events of October and November 2026.
18 November 2026Article
Your attack surface includes everyone else's
17 November 2026Article
The same AI that finds the exploits can audit your stack
16 November 2026Article
Technical debt is a vulnerability with a nicer name
The PHP2Shell postmortems showed the same truth twice: the bug class was known for years and shelved as too difficult to exploit, until AI made exploitation cheap. Every end-of-life runtime, abandoned plugin and deferred upgrade on your stack is pre-positioned for exactly that moment. How to inventory the debt, order the burn-down by exposure, and fund it as maintenance rather than heroics.
15 November 2026
Article
The Microsoft outage was not a hack, and that is the problem
The 12 to 14 November 2026 Microsoft 365 outage took down Outlook, Teams and Copilot worldwide for over a day, and Microsoft says a network capacity upgrade, not an attack, was the cause. Why one subprocessor holding your email, calendar and chat is a business continuity risk, what the same-day FAA ground stop says about AI in critical systems, and what an actual continuity plan contains.
14 November 2026Article
CVE-2026-119618: the Apache HTTP/2 flaw your WordPress updates cannot fix
Apache's 11 November 2026 release fixed a critical HTTP/2 flaw that can give unauthenticated remote code execution, and the fix lives one layer below WordPress, in the web server itself. What CVE-2026-119618 is, how to find out whether your host left you exposed, and what a managed platform like Cloudways does with server-level patches while you sleep.
12 November 2026
Article · Guides
PHP2Shell: the full timeline, what it exposed, and what it means for how you host
The two critical PHP remote-code-execution flaws of October 2026, discovered by AI and exploited within days: an interactive timeline of what happened hour by hour, who went offline and why, how Cloudways patched every customer server before most of them read the news, and what to check on your own sites now.
3 November 2026Article · Guides
WordPress security: the realistic checklist
A WordPress security list ordered by what stops most compromises: updates, backups you have restored, least-privilege accounts, limited login exposure, a WAF or CDN in front, and two lines in wp-config. Plus the plugin inversion and the hardening products you can skip.
3 September 2026
Article · Deploy
Environment variables and secrets in production, without the ceremony
Environment variables hold the config that changes between environments, and production means they live in platform settings instead of .env files. How the local habit fails, which keys count as burned, and how to prove the plumbing before real secrets arrive.
29 July 2026