This morning PHP released fixes for two critical vulnerabilities nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Both are rated CVSS 9.2 and allow unauthenticated remote code execution, and they're in PHP itself, so every Joomla and WordPress site is affected until its server is patched. Today on Watch Me Work I'm patching my own hosting servers live and showing you how to check yours. The fixed versions are PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. PHP 8.1 and older get no fix at all, and roughly one in five sites still runs one of those versions. Here's what I'll cover live:
โ
What PHP2Shell is, in plain English, and why "unauthenticated RCE" is as bad as it gets
โ
How to check whether your site is affected: Joomla System Information, cPanel MultiPHP Manager and mySites.guru
โ
How the fix reaches you on shared hosting, cPanel servers and CloudLinux
โ
Live on my own servers: one already patched this morning, one still waiting on CloudLinux
โ
The stopgap setting to use if you can't patch yet, and why it's only partial
โ
Sites still on PHP 7.4, 8.0 or 8.1: why they'll never be fixed, and moving them to 8.3
โ
What I told my hosting clients today
โ
Your questions in chat
๐ Links:
CVE-2026-109618 advisory: https://github.com/php/php-src/securi...
CVE-2026-109619 advisory: https://github.com/php/php-src/securi...
PHP downloads and release notes: https://www.php.net/
mySites.guru on the PHP critical release: https://mysites.guru/blog/php-critica...
Cybersalt Consulting: https://www.cybersalt.com
Joomla 6.2 came out yesterday, so today on Watch Me Work I'm updating my own site, cybersalt.org, from Joomla 6.1.4 to 6.2 live, then testing my own extensions on it to see what (if anything) breaks. 6.2 is a minor release with no backward-compatibility breaks and the same server requirements as 6.1. It doesn't contain security fixes itself, but the next Joomla 6 security release will be a 6.2.x, so now is the time to get your sites onto it. Here's what I'll cover live:
โ
What's actually new in Joomla 6.2, and the one feature that was pulled before release
โ
Pre-flight checks: Akeeba backup, Joomla's Pre-Update Check, and asking Claude via MCP for Joomla
โ
Staging the site with StageIt, then updating to 6.2
โ
Testing extensions on 6.2: 0-9 & A-Z Menu, Override Checker, Newsletter Vault, MCP for Joomla and StageIt
โ
The new TinyMCE tools: Media Manager image picker, link picker and Read More button
โ
Image and figure CSS classes, subcategory images, and the new login module options
โ
Security flags on extension updates, and what they mean for site owners
โ
SMTP with OAuth 2.0 for Microsoft 365 and Google mail
โ
Your questions in chat
๐ Links:
Joomla 6.2 release announcement: https://www.joomla.org/announcements/...
Joomla 6.2.0 on GitHub: https://github.com/joomla/joomla-cms/...
Joomla 6.1 to 6.2 migration notes: https://manual.joomla.org/migrations/...
mySites.guru on Joomla 6.2 readiness: https://mysites.guru/blog/joomla-6-2-...
Cybersalt Consulting: https://www.cybersalt.com
A client wants to put detailed information about their service providers on their website, but they don't want it scraped. robots.txt won't do it: it's a polite request, and the bots that matter most ignore it. So on this stream I'm building a new Joomla 6 extension, CS Page Protector, that makes a visitor pass a human check before the pages you choose will show their content. Here's what we'll work through:
โ
Why robots.txt and hidden-content tricks don't stop scrapers
โ
Joomla 6.1's new built-in Proof-of-Work CAPTCHA: no Google, no API key
โ
Picking which pages need protecting
โ
Keeping protected content out of the page source until the check is passed, because a scraper reads the source, not the screen
โ
Remembering the visitor for the session, so real people only solve it once
โ
What this does and doesn't stop, and why you shouldn't turn it on for pages you want Google to index
โ
Building it on a Joomla 6 test site from a blank start If you publish directory listings, staff or provider profiles, pricing, or anything else you'd rather not see copied into someone else's database, this one is for you.
Got a Joomla category with 100+ articles? Your visitors are stuck clicking through pages. Today I'm introducing the Cybersalt 0-9 and A-Z Menu โ a
Joomla 5/6 module that drops an A-Z and 0-9 browse bar on category pages and filters the list to articles starting with that letter.
But first, the embarrassing part: I built this module months ago and it NEVER WORKED. Not "buggy" โ it fataled on every single click. In this episode I show you why, and the Joomla 5 detail that fixed it.
โญ THE GOTCHA
Joomla 5's category page does NOT build the CategoryModel. It builds the ArticlesModel. I spent ages overriding a class the category page never
even creates. If you've ever tried to filter a Joomla category listing, this one will save you hours.
WHAT THE MODULE DOES
โข A-Z + 0-9 browse bar on com_content category pages
โข Filters the listing to articles whose title starts with that character
โข Filters at the QUERY level โ so pagination counts stay correct and your
template/page-builder layout keeps working
โข Only appears on category pages; pick exactly which categories
โข Full styling control (colours, size, spacing, alignment, custom CSS)
โข Joomla 5 + 6 ยท PHP 8.1+
Grab a plate โ today we're having a robots.txt picnic. No build, no fixing. We're just reading our way through some really good writing on robots.txt, poking at real files, and figuring out what that little text file actually does in 2026. And there's a clock on this one. On September 15th, Cloudflare changes its default bot policy on free plans and new sites โ training bots and agent bots get blocked, search crawlers get through. That lands in six days, so this is a good week to know what your own site is telling the robots. On the picnic blanket:
โ
Phil Taylor's mySites.guru guide on Joomla media and template folders โ the blocking mistake that hides your CSS from Google
โ
Philip Walton's Joomla Magazine article "The robots have changed, and your robots.txt hasn't" โ the best plain-English map of the new bot landscape I've read
โ
The bot roll call โ GPTBot, ClaudeBot, OAI-SearchBot, Claude-SearchBot, Google-Extended, Applebot-Extended, PerplexityBot, CCBot, Bytespider, Amazonbot
โ
Search bots vs agent bots vs training bots, and why the difference is the whole ballgame
โ
Cloudflare's new Content-Signal line, plus TDMRep, RSL, AIPREF and Web Bot Auth
โ
Reading the actual robots.txt on cybersalt.com and seeing what's wrong with it
โ
A peek into the Cloudflare settings before the 15th
โ
Wherever else the reading takes us