Migrating a WordPress site to a new host without downtime
Switching hosts exposes a WordPress site to downtime when DNS TTL and cutover order aren't planned ahead of time. This checklist covers preparation, syncing, and final checks before switching off the old server.
Back-end
Node.js 26.9.0 ships node:bench and enables FFI by default
Node.js 26.9.0, released on 16 September 2026, adds the built-in benchmarking module node:bench and switches the FFI on by default.…
Symfony 8.2 adds KeyManagement, one API to encrypt data behind any KMS
Unveiled on 15 September 2026, the KeyManagement component gives Symfony 8.2 a single API to encrypt sensitive data behind AWS…
CORS explained: configuring cross-origin resource sharing without the guesswork
Cross-origin resource sharing stays a stubborn source of confusion in web development. Grasping what the browser protects and which headers…
Node.js refreshes its TLS chain: NSS 3.126 roots, OpenSSL 3.5.8, and STORE-loader private keys
Node.js 24.21.0 LTS and 26.8.2 refresh their bundled NSS 3.126 root certificates and OpenSSL 3.5.8. The LTS line also gains…
Laravel 13.31 hardens cookie-based auth and makes Redis queues cluster-safe
Laravel 13.31.0, released on 8 September 2026, closes a security gap in the “remember me” cookie flow and makes Redis…
Python 3.15 locks in: lazy imports, UTF-8 by default, and a sharper JIT
Python 3.15 shipped its final release candidate on 1 September 2026, ahead of a 1 October launch. Explicit lazy imports,…
Security
OpenAI Breached Through an ImageMagick Flaw Exploited With Claude Opus 5
Researchers chained a flaw in the libheif library used by ImageMagick with a single sign-on weakness to reach OpenAI employee…
WordPress 7.1.1 ships an urgent fix for eleven security flaws
WordPress 7.1.1 closes eleven security flaws in core and the block editor, including an authenticated path traversal in REST templates.…
Chrome ships an emergency fix for an actively exploited V8 flaw (CVE-2026-85046)
Google shipped an emergency Chrome update on 4 September 2026 to patch CVE-2026-85046, a type-confusion bug in the V8 engine…
Content-Security-Policy: building a policy that protects without breaking the site
A Content-Security-Policy is an HTTP header that limits the impact of script injection by filtering allowed sources. This guide walks…
Next.js ships a critical patch: two remote code execution flaws fixed in 16.3.3 and 15.5.24
Next.js has shipped 16.3.3 and 15.5.24 on short notice, fixing two critical unauthenticated remote code execution flaws. One hits Windows-hosted…
Cloudflare makes OAuth scopes optional for Wrangler and its MCP server
Cloudflare now lets you grant only part of the permissions Wrangler and its MCP server request. The change brings command-line…
DevOps & servers
Migrating a WordPress site to a new host without downtime
Switching hosts exposes a WordPress site to downtime when DNS TTL and cutover order aren't planned ahead of time. This…
HTTP caching: getting Cache-Control, revalidation and URL versioning right
HTTP caching is the cheapest performance lever a site has, provided Cache-Control, ETag revalidation and URL versioning are set right.…
GitHub Actions locks down CI cache access with cache-mode
GitHub is generally rolling out cache-mode, a setting that applies least privilege to the cache used by Actions workflows. The…
Backing up a production site: applying the 3-2-1 rule and testing your restores
The 3-2-1 rule protects a site against hardware failure, human error and ransomware. But it only counts if backups are…
Symfony lsp:check brings framework-aware diagnostics to your CI pipeline
The Symfony 5.20 CLI ships lsp:check, a command that replays the editor's diagnostics inside continuous integration. It catches unknown routes,…
Deploy a Node.js application to production: systemd and a reverse proxy
Running node app.js is fine for a demo, not for production. A systemd service and an Nginx reverse proxy make…
Front-end
Debouncing and throttling in JavaScript: taming event frequency
Typing, scrolling, resizing: some events fire dozens of times a second and flood the main thread. Debouncing and throttling rein…
Vite 8.3.0 respects the root tsconfig and minifies component CSS
Released on 10 September 2026, Vite 8.3.0 finally honours a root-level tsconfig and minifies CSS inside style tags. This minor…
SvelteKit 3 reaches Release Candidate: migration, Vite, and what Svelte 5.57 adds
SvelteKit 3 has reached Release Candidate, days after Svelte 5.57 shipped. A reworked Vite plugin, the move from $lib to…
Chrome moves to a two-week release cycle
From 8 September 2026, Chrome ships a new stable version every two weeks. Manual version tracking gives way to feature…
htmx 4.0 moves to fetch() and makes attribute inheritance explicit
Released on 28 August 2026, htmx 4.0.0 rebuilds its engine around fetch() and ships deliberate breaking changes. Attribute inheritance, event…
SvelteKit 3 reaches release candidate: configuration moves into Vite and remote functions arrive
SvelteKit 3 has reached release candidate: configuration moves into Vite, remote functions bring server code straight into components, and a…
The feed
All articles
The publication
Technical news for web professionals, verified and dated
Mail Studio covers front-end and back-end development, infrastructure, security, email and deliverability, AI applied to the web, and running an independent business. Every article is dated, its sources are named, and any reported factual error is corrected visibly.