Tagsecurity³

On Wednesday PHP shipped emergency releases for two flaws in its core, CVE-2026-109618 and CVE-2026-109619, known together as PHP2Shell. A single request from somebody who never logged in can be enough to run code on the web server, and every PHP installation that serves web requests is affected, whatever runs on top of it. The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35; anything older needs a backport from a vendor or a patch built from source.

A site built with ./blog.sh has nothing for it to hit. There is no PHP in it, no database behind it and no admin page in front of it. What the web server hands out are files the build wrote earlier: pages, a stylesheet, a search index, pictures. A request can ask for one of them and get it, and that is all a request can do; nothing on the server runs because somebody asked. That is not a hardening step somebody remembered to take. It is what Built for one blog on purpose meant by "nothing needs a security patch on a Tuesday". This time it was a Wednesday.

Up to 1.9 the engine had one door for programs, and it was narrow. The phone delivered a post through it: a shortcut sent a file over SSH, receive.sh took it on the other side and answered with one object. Two commands kept that promise — add --json and publish --yes --json. Everything else was a screen for a person: the listing, a post's properties, the queue, the trash. A program that wanted to see what was in the archive had nothing to call.

1.10 opens the door wide, and that is exactly why it is careful about what may come through.

Every screen as data

Every screen a person reads before acting, and every action it offers, now has a --json form: one object on standard output and nothing else, every key always present. A refusal is an object too, {"ok": false, "error": "not_found", …}, with a zero exit — the status says whether an answer arrived at all, the object says what it was. A program that has to test whether a key exists is a program writing its own parser; that is what this prevents.

There's no /admin on this site. No login form to try a password against, no session cookie to steal, no plugin list to check against last month's CVEs — not because a checklist said to strip them out, but because none of them were ever built in the first place.

The engine's own architecture notes put the rest of it plainly: the threat model is a static site with no server of its own. Nothing here listens on a port. The goal was never to harden a complex system against everything that could go wrong with it. The goal was to avoid needing one in the first place.

What's left to get wrong, once that's true, is narrower than a normal blog's list — what the pages carry, what the working directory holds, and the one thing that does arrive from outside.

The one thing that arrives from outside

Writing from a phone means one door does accept bytes from a stranger's own device: scripts/receive.sh, running as the forced command of an SSH key. It listens on nothing — no socket, no daemon, just a key that can run exactly this script and nothing else.