Skip to content LFW 
Featured Security PHP2Shell (CVE-2026-109618 and CVE-2026-109619): what we checked, and what we'd do PHP fixed two critical vulnerabilities on October 21, 2026, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell. What we checked on our own servers, what governments told organizations to do, and the steps we'd take on a site that runs WordPress or Drupal. 
Leland Fiegel· 8 minutes - Security Node.js Brotli vulnerability (CVE-2026-111497): we ran an affected version, patched it and found no sign of exploitation Node.js fixed CVE-2026-111497 and nine other vulnerabilities on October 21, 2026. LFW.com runs on Node.js. How it reached us, how we patched it the same day, how we checked we weren't exploited, and what to check on your own systems. Leland Fiegel· 5 minutes
- Forms Web forms that people actually submit A guide to the forms people use to register, renew, apply and get in touch, with a working example of every pattern: input masks, error messages, email typos and more. Leland Fiegel· 12 minutes
- Audit findings What a stranger learns about your site in one minute What a curious visitor, a vendor or an unfriendly scanner can read about your website in about a minute, and how the free audit runs the same checks for you. Leland Fiegel· 4 minutes
- Audit findings Login names are half a login By default, WordPress lists every author's login name for anyone who asks, so attackers only have to guess the passwords. Four changes close the list without locking anyone out. Leland Fiegel· 3 minutes
- Audit findings One color value: fixing contrast without a redesign Light gray text on white is the most common accessibility finding there is, and the fix is usually one color value in the theme's palette. Leland Fiegel· 3 minutes
- Audit findings Embedding video without breaking accessibility A pasted YouTube link arrives with no name for screen readers and often no captions. Here is what an embedded video needs and how to add it without touching the video. Leland Fiegel· 3 minutes
- Audit findings Why the page is blank for a second When a page stays white for a second, the browser is usually waiting on a stylesheet, a font or a script in the wrong place. Three changes end the wait on most sites. Leland Fiegel· 4 minutes
- Operations Your web host is not your web team Good hosting is essential, but it is only one part of running a website. Here is how to evaluate a managed host for WordPress, what the host should handle, and what still needs a web team. Leland Fiegel· 3 minutes
- Operations What website management actually includes Plugin updates are one small part of website management. A useful agreement also spells out who does the rest of the work, where routine work ends, and how quickly you'll hear back. Leland Fiegel· 3 minutes