Tags: #php

A security audit of a legacy PHP and CodeIgniter mobile backend: nine real flaws, a frozen API contract, and how to patch it without locking out old apps.

We debugged a WordPress slot spam infection and found attackers hiding rogue admin accounts and backdoor plugins using a simple CSS override in functions.php.

A café, a library, and a gym - three management systems built in plain PHP and MySQL with no framework, where the real lessons were all about transactions.