General Discussion Archives

October 23, 2026October 23, 2026

PHP2Shell: How MDDHosting Responded to the Critical PHP Security Vulnerabilities

On October 21, 2026, the PHP development team released emergency security updates for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. Both carry a CVSS 4.0 score of 9.2 and both allow an unauthenticated attacker to run code on a vulnerable server with nothing more than a crafted HTTP request. Because the flaws are in PHP itself, not in any particular application, every PHP site was affected regardless of how clean its own code was.

Every one of our managed servers was patched by 9:27 PM Eastern that same day. More importantly, we had multiple layers of protection in place throughout the incident, including measures we put in place before PHP’s official fixes were released.

We published a status notice throughout the day as events unfolded. This post is the longer version: what the vulnerabilities actually were, what we did before the patches existed, why there was a gap between the PHP release and our ability to install it, and a clean timeline of the day.

April 25, 2026April 25, 2026

The Cloudflare 520 Mystery: How a Threat Intel Feed Took Down One Customer Through One Specific PoP

The Setup

A client running an OpenCart store and a WordPress site reported intermittent Cloudflare 520 errors. Initial reports mentioned issues with custom security software they were running (a proof-of-work challenge being injected via auto_prepend_file), which we helped them disable. The 520s continued.

The Pattern That Made No Sense

Over the following days, the client did remarkably thorough testing on their end and identified a pattern none of us could explain:

520 errors only occurred when traffic routed through Cloudflare’s LAX (Los Angeles) PoP
Other Cloudflare PoPs worked perfectly
DNS-only mode (no proxy) worked perfectly
Direct origin access via hosts file worked perfectly
A clone of the site on a different host, behind the same Cloudflare configuration, worked perfectly

By every measure available to them, the issue was specific to the combination of their site + Cloudflare LAX + our infrastructure.

July 30, 2024July 30, 2024

Hosting Resource Series – CPU Cores

Most web hosting providers offer resource limits on their services. Understanding these resource limits can help you make an informed decision when purchasing or upgrading a hosting service.

Layman Explanation – “The Car Analogy”

I often like to use what I call “The Car Analogy” to explain CPU cores. I use a car to represent a CPU core and people being transported to represent website visits.

Single CPU Core:

Imagine for a moment that you have one car instead of one CPU core. One individual car (CPU core) can move people (website visits) from one location to another, and it is designed and intended for this purpose.

Let us also imagine that the car will always move as fast as it is capable of doing. You do, after all, want to get where you’re going as quickly as you can, right? Your one car can only move people so fast, and it can go no faster.

April 27, 2023April 27, 2023

Understanding TTFB: Why Lower TTFB Isn’t Always Better

Time to First Byte (TTFB) is a metric used to measure the responsiveness of a web server. It is the time taken for the server to send the first byte of data to the client. While a lower TTFB is generally desirable, it’s not always the best indicator of overall website performance. In this blog post, we will explore the relationship between TTFB and PHP output buffering, and discuss how optimizing for a low TTFB can sometimes be misleading.

TTFB and PHP Output Buffering

TTFB can be influenced by various factors, such as network latency, server processing time, and PHP output buffering. PHP output buffering is a technique where the server buffers the output of a script before sending it to the client. This can help improve performance by allowing the server to send larger chunks of data at once, rather than sending small bits of data as they become available. Additionally, output buffering can be beneficial when running a site built with plugins from various developers, such as is common with WordPress. In these situations, different plugins may send headers at different times, and without output buffering, this can cause errors as the server is only allowed to return response headers once.

However, focusing on a low TTFB can lead to a false sense of optimization. For example, you can artificially deflate TTFB by sending a single byte of data immediately before doing any significant processing and flushing the output buffer. This will result in a lower TTFB, but the overall load time for the user remains the same. In other words, a low TTFB doesn’t always equate to a better user experience.

October 14, 2022October 14, 2022

How many visitors can my account handle?!?!?

Long Exposure of Vehicles Traveling at Night

Quite often our clients and potential clients ask us a question that on its face seems simple: How many visitors can my account handle? This question is not as simple as it seems.

As with any deceptively simple question there is more to it than a simple number. We wish we could simply give a number as a response but to do so would be disingenuous and deceptive from our perspective. We know that there is far more to the question and the answer than a simple number.

If all sites were created equal and all sites used the same amount of resources per visit, transmitted the same amount of data, performed the same SQL queries, etc – the answer would be simple. In the real world every website is different. We have some clients that are handling more than 100,000 visitors per month on our cheapest and least-powerful plans and then we have other clients on our most powerful and most expensive plans that are struggling with only a few thousand.

We don’t want to make what seems like a promise – that you can hit a particular number of monthly visitors – when it’s not something we can guarantee as we do not control your content or applications.