Bringing clarity to WordPress builders and companies at the intersection of performance, tooling, strategy & education. 👷🏻♂️@Scanfullyapp 👨🏼💻@Within_WP
All the links 👉🏻
- Tweets 81,827
- Following 3,424
- Followers 16,572
- Likes 60,302
Pinned Tweet
If you’re serious about delivering fast WordPress sites , or just tired of fighting performance without a clear roadmap, this is the course you’ve been waiting for.
Let’s make WordPress fast.
withinwp.com/courses/make-wo…
7
5
23
4,828
PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities. The rules are available to all customers, including free.
We are seeing early attacks emerging and are updating mitigations as new vectors show up.
This is a STOPGAP only. Patch as soon as @ThePHPF releases the update at 14:00 UTC today.
51
The official advice is "consider isolating internet-facing applications from public networks until a fix is available." cert.europa.eu/publications/…
Basically a PHP vulnerability that goes back 22 years.
10
Remkus de Vries retweeted
PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities. The rules are available to all customers, including free.
We are seeing early attacks emerging and are updating mitigations as new vectors show up.
This is a STOPGAP only. Patch as soon as @ThePHPF releases the update at 14:00 UTC today.
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.
PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
45
401
2,325
174,542
Remkus de Vries retweeted
Recommend this, I scripted a CF worker that does 503 at the Edge for now.
Exploits are already out, so right now you're a sitting duck, until 10am est
PoCs are already circulating.
I've temporaly 503d my sites with a maintenance message via a Cloudflare worker.
Less drastic version is likely blocking all POST requests.
Clock is ticking, the GPUs are running
1
1
75
Remkus de Vries retweeted
The official advice is "consider isolating internet-facing applications from public networks until a fix is available." cert.europa.eu/publications/…
Basically a PHP vulnerability that goes back 22 years.
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.
PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
8
6
21
2,269
The official advice is "consider isolating internet-facing applications from public networks until a fix is available." cert.europa.eu/publications/…
Basically a PHP vulnerability that goes back 22 years.
The PHP security team is giving advance notice: Upcoming security release Wed, Oct 21st 2026, 14:00UTC, two critical vulnerabilities, both rated CVSSv4 9.2.
PHP users are encouraged to prepare to update. Earlier release if details become public or active exploit evidence.
8
6
21
2,269
Remkus de Vries retweeted
If you're still wondering whether to book that last-minute trip to Barcelona for @PressConf, I have something to say to you: GO!
There are plenty of WordPress events where you can catch up on the talks afterward, watch the recordings, and tell yourself you'll attend next year.
PressConf is a different beast. One track, off the record, and conversations that stay in the room. You actually have to BE THERE. And you get to learn from and exchange with fellow business owners. I can genuinely say you will literally grow during this event.
And having watched Mark Weisbrod's (CEO of @greyd_suite) recent interview by @mattmedeiros from @TheWPMinute about his upcoming talk, I'm even more convinced that this is exactly the kind of event our industry needs.
Mark's session is called "It's the Economy, Stupid."
He's going to challenge some pretty uncomfortable assumptions about the WordPress business ecosystem. Pricing, competition, supply and demand, and why incredibly talented people build fantastic products but struggle to turn them into sustainable businesses.
And yes, he's opinionated. Very. Which is precisely why I want to hear what he has to say!
What excites me about PressConf is the opportunity to have these conversations with the people actually making decisions, building businesses, and shaping the future of WordPress. Without worrying about how every sentence might sound in a recording.
You can't recreate that experience by watching YouTube afterward. There won't BE a recording.
So if Barcelona is still a possibility for you, take another look at your calendar. October 27–30.
The interview with Mark: piped.video/watch?v=7pWiKvVt…
Check out the event here: pressconf.events/locations/b…
PS Hat down for @raquel__karina and her team for bringing this event to Europe!
2
4
218
PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities. The rules are available to all customers, including free.
We are seeing early attacks emerging and are updating mitigations as new vectors show up.
This is a STOPGAP only. Patch as soon as @ThePHPF releases the update at 14:00 UTC today.
75
PHP folks, please don't rely on the ini config change to protect your apps. It won't help when the full details are out - it only protects against a single vector, if that. You need to apply the patches as soon as they drop.
phpc.social/@joepferguson/11…
75
Remkus de Vries retweeted
After the past week, I trust nothing. Spent the morning manually backing up everything. Starting to feel like a digital doomsday prepper. 😳
The official advice is "consider isolating internet-facing applications from public networks until a fix is available." cert.europa.eu/publications/…
Basically a PHP vulnerability that goes back 22 years.
1
1
2
150
Remkus de Vries retweeted
What’s shaping the future of #WordPress? Catch up on our conversations with our selected speakers ahead of #PressConf Europe.
🎥 Daphne Monro — WordPress, community, and how AI is changing the web
piped.video/M5jgK-jFmm4?si=XdCG…
🎥 Mark Weisbrod — Product strategy, pricing, positioning, and finding the right customers
piped.video/7pWiKvVtOPA?si=iJgp…
🎥 Remkus de Vries — AI-powered workflows, WordPress moving upmarket, and the evolving role of web professionals
piped.video/FZ6XkcphAcY?si=kFWz…
🎥 Ivana Ćirković — Organic marketing, meaningful brand storytelling, and staying human in the AI era
piped.video/3gxDdG3w-oA?si=A9BT…
A special thank you to @mattmedeiros and @TheWPMinute for making these conversations possible and helping share our speakers’ perspectives with the wider #WordPress community.
The conversations continue in person at PressConf Europe, October 27–30, in Barcelona. We don’t record the talks. You have to be there.
🌴 pressconf.events/locations/b…
2
5
367
Oh boy. It just keeps on going, doesn’t it?
🚨 Attackers hijacked five OVHcloud CLI releases on GitHub, replacing legitimate downloads with malware designed to steal secrets from infected machines.
The malicious files were available for up to 94 minutes on October 19.
Users who downloaded or updated affected builds during that window should rotate exposed secrets.
Read more: thehackernews.com/2026/10/ha…
2
11
866
Remkus de Vries retweeted
Clare Liguori's coding-agent principles include readable codebases, fast tests and keeping your quality standards. There's upfront work involved. Useful reading before adding more agents.
kiro.dev/topics/frontier-eng…
2
1
73
Remkus de Vries retweeted
A table can look clear and still be awkward with a screen reader. The WP Accessibility Knowledge Base explains the Table block's header setting, with an audio example. Worth sharing with editors.
wpaccessibility.org/docs/top…
1
95
Remkus de Vries retweeted
For anyone about to spend their whole week (and probably half of the weekend) building a custom tool for #WordPress:
Take 30 minutes to check the plugin directory first.
Scratching your own itch is fun, but downloading something that already works is hard to beat. Super simple, super polished.
#BuildVsBuy #DeveloperProductivity
8
2
12
635
Remkus de Vries retweeted
If the RankMath problem wasn't your wake-up call to secure ALL THE THINGS in your build and release flow, maybe now it is?
Get to work!
⚡️We're tracking a large scale attack against UpdraftCentral connected websites. Updraft has been hacked and stolen access keys are used to backdoor the websites.
patchstack.com/articles/updr…
6
2
27
3,353
Classy how you get called out for stating comments that are factually incorrect, and when I point that out, you immediately go ad hominem.
Haha you are so stupid. You are a WordPress cult member and it’s broken software with many issues, some of them because no one will stand up to WordPress itself on these issues.
4
6
954