[{"data":1,"prerenderedAt":455},["ShallowReactive",2],{"blog-/en/php-vulnerabilities-dont-affect-neleto":3,"blog-related-/en/php-vulnerabilities-dont-affect-neleto":227},{"id":4,"title":5,"author":6,"body":7,"date":210,"description":211,"extension":212,"image":213,"meta":214,"navigation":215,"path":216,"seo":217,"stem":218,"tags":219,"__hash__":226},"blog/en/php-vulnerabilities-dont-affect-neleto.md","PHP Just Got Two Critical CVEs. Neleto Never Had to Patch.","Marc Zinser",{"type":8,"value":9,"toc":198},"minimark",[10,19,22,27,39,42,46,49,52,61,65,68,75,78,82,85,92,95,98,111,115,126,129,133,136,139,143,146,153,157,182,185,190],[11,12,13,14,18],"p",{},"On Tuesday, October 20, the PHP security team announced a critical security release ",[15,16,17],"em",{},"before any details had been published",". They only do that when it's serious. Two vulnerabilities, both rated CVSS 9.2, with the patch scheduled for today, October 21, at 14:00 UTC. CERT-Bund scored it 9.8 (critical). CERT-EU went further: the flaws could lead to remote code execution, and they affect every PHP version from 5.0 onward.",[11,20,21],{},"If you run WordPress, Laravel, Drupal, or any of the tens of millions of other sites on PHP, that last sentence is a fire drill. Patch now, or take your internet-facing apps offline until you can.",[23,24,26],"h2",{"id":25},"what-the-cves-are-so-far","What the CVEs are (so far)",[11,28,29,30,34,35,38],{},"The two identifiers are ",[31,32,33],"strong",{},"CVE-2026-109618"," and ",[31,36,37],{},"CVE-2026-109619",". At the time of writing, no technical details have been published. The PHP team reserved the right to ship the release early \"should details of either vulnerability become public, or should evidence of active exploitation appear in the wild.\"",[11,40,41],{},"That clause is the scary part, because it means the fix may be racing attackers. Without public details there's nothing to evaluate yet. All you have is a deadline.",[23,43,45],{"id":44},"why-neleto-was-never-in-the-blast-radius","Why Neleto was never in the blast radius",[11,47,48],{},"Neleto's request-serving path has no PHP interpreter in it.",[11,50,51],{},"The backend is Rust, built on axum, talking to Postgres through sqlx. Pages render through our handlebars engine, and Caddy sits in front as the gateway. The admin panel is a Vue 3 SPA. None of that is PHP, so there is no interpreter on the serving path for these CVEs to run inside.",[11,53,54,55,60],{},"You can't be hit by a PHP interpreter bug if you never load one. We didn't plan for this particular CVE. It follows from the choice we explained in ",[56,57,59],"a",{"href":58},"/blog/why-neleto-runs-on-rust","why we wrote the backend in Rust",".",[23,62,64],{"id":63},"any-runtime-can-rot","Any runtime can rot",[11,66,67],{},"The problem this week isn't specific to PHP. Every language that ships a runtime has it.",[11,69,70,71,74],{},"An interpreted language carries its interpreter with it, on every server, behind every app. That interpreter is one large shared program, compiled once by the language team and inherited by every application that runs on it. A bug in it affects every app on every machine running that version, ",[15,72,73],{},"no matter how careful the application author was",". The developer who wrote your CMS didn't write the vulnerable line. They inherited it along with the language.",[11,76,77],{},"PHP isn't alone here. Ruby, Python, Node.js and the JVM all ship a runtime, all of them have had runtime-level CVEs, and all of them will have more. The runtime is a big codebase that every app on top of it shares, and it's usually older than those apps. When it has a bug, every app pays for it, whether it wanted to or not.",[23,79,81],{"id":80},"why-compiled-languages-are-inherently-better-here","Why compiled languages are inherently better here",[11,83,84],{},"A compiled backend bakes its code into its own binary. At request time there is no interpreter between the request and the code, so there is no interpreter attack surface to inherit. The kind of bug PHP just got hit by, a flaw in a shared runtime underneath every app, doesn't exist in a compiled backend.",[11,86,87,88,91],{},"So ",[15,89,90],{},"for this kind of vulnerability",", compiled languages are inherently better: no runtime, no runtime bugs.",[11,93,94],{},"That doesn't make \"compiled\" a synonym for \"safe.\" C and C++ are compiled, and they are still famous for buffer overflows and use-after-free bugs. Removing the interpreter closes one attack surface and leaves another. You stop inheriting the runtime team's bugs and start owning the ones the application author writes.",[11,96,97],{},"Rust goes one step further. The borrow checker rejects a whole class of memory-safety bugs at compile time, so many of the bugs that make C and C++ scary never compile in the first place. For this class of problem, the ranking looks like this:",[99,100,101,105,108],"ol",{},[102,103,104],"li",{},"Interpreted runtime bugs, PHP's problem this week.",[102,106,107],{},"Compiled-but-unsafe memory bugs, C and C++'s problem.",[102,109,110],{},"Rust, where the compiler catches a large slice of both before they ship.",[23,112,114],{"id":113},"another-reason-we-chose-rust","Another reason we chose Rust",[11,116,117,118,121,122,125],{},"When we picked the language, we wrote it up as a performance and cost decision. Both reasons held up, and the numbers are in the ",[56,119,120],{"href":58},"benchmarks post",". But this week reminded us of a benefit we'd underweighted: with a compiled backend, we patch ",[15,123,124],{},"our"," code, not someone else's interpreter.",[11,127,128],{},"A PHP CVE hits millions of servers at once. Everyone shares the same upgrade window and installs a patch they didn't write and can't fully audit. A bug in Neleto is in code we own, and the compiler already argued with us about it before it shipped. When the next critical bug shows up, it's ours to fix, not buried in a decades-old interpreter we depend on.",[23,130,132],{"id":131},"what-neleto-isnt-immune-to","What Neleto isn't immune to",[11,134,135],{},"Neleto is not immune to everything, and anyone who tells you otherwise is selling something. The admin frontend is TypeScript running in a JavaScript runtime, just in the browser instead of on the server. And every server depends on system libraries, OpenSSL above all. A compiled language shrinks the attack surface. It doesn't make it zero.",[11,137,138],{},"What the serving path does rule out is this week's failure mode: one flaw in a shared interpreter putting millions of apps at risk at the same time. When a bug does land in Neleto, it's in code we can read and audit ourselves, not in a runtime we inherited from 2004.",[23,140,142],{"id":141},"what-this-means-for-you","What this means for you",[11,144,145],{},"If you run PHP today: the release is out, go patch. CERT-EU's advice was blunt. Identify your PHP assets and upgrade as soon as fixed versions are available, or isolate internet-facing apps from the public network until you can.",[11,147,148,149,152],{},"If you're choosing a CMS for the next few years, ask a question most comparison articles skip: ",[15,150,151],{},"what language is the backend written in, and does it ship a runtime?"," The interpreter is part of your attack surface whether you wrote it or not, and this week showed what that costs when it breaks.",[23,154,156],{"id":155},"sources","Sources",[158,159,160,168,175],"ul",{},[102,161,162],{},[56,163,167],{"href":164,"rel":165},"https://www.php.net/archive/2026.php#2026-10-20-1",[166],"nofollow","PHP security team announcement, October 20, 2026",[102,169,170],{},[56,171,174],{"href":172,"rel":173},"https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-4055",[166],"CERT-Bund, WID-SEC-2026-4055: \"PHP: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff\"",[102,176,177],{},[56,178,181],{"href":179,"rel":180},"https://cert.europa.eu/publications/security-advisories/2026-018/",[166],"CERT-EU, Security Advisory 2026-018: \"Critical Vulnerabilities in PHP\"",[183,184],"hr",{},[11,186,187],{},[31,188,189],{},"Fast websites. Easy content. Agent ready.",[11,191,192,193,197],{},"Start free at ",[56,194,196],{"href":195},"/pricing","neleto.io",", a CMS whose backend doesn't share a runtime with half the web.",{"title":199,"searchDepth":200,"depth":200,"links":201},"",2,[202,203,204,205,206,207,208,209],{"id":25,"depth":200,"text":26},{"id":44,"depth":200,"text":45},{"id":63,"depth":200,"text":64},{"id":80,"depth":200,"text":81},{"id":113,"depth":200,"text":114},{"id":131,"depth":200,"text":132},{"id":141,"depth":200,"text":142},{"id":155,"depth":200,"text":156},"2026-10-21","On October 20, the PHP security team flagged two critical vulnerabilities (CVSS 9.2) affecting every PHP version since 5.0. Here's why Neleto's stack was never in the blast radius, and what it says about interpreted versus compiled backends.","md","/img/blog/php-vulnerabilities-dont-affect-neleto.svg",{},true,"/en/php-vulnerabilities-dont-affect-neleto",{"title":5,"description":211},"en/php-vulnerabilities-dont-affect-neleto",[220,221,222,223,224,225],"PHP","Security","CVE","Rust","CMS","Neleto","ho-4EkMaTjOb1wb4MX-fQkgh9b2U9yleFriRNeY4xKw",[228,230,241,252,263,275,286,298,307,316,323,334,342,352,361,369,376,385,395,404,412,422,430,440,447],{"path":216,"title":5,"description":211,"date":210,"author":6,"image":213,"tags":229},[220,221,222,223,224,225],{"path":231,"title":232,"description":233,"date":234,"author":235,"image":236,"tags":237},"/en/story-of-neleto","The Story of Neleto","Six years of real customer websites before we ever called it a product. Here's how a tool we built for our own client work became a CMS you can start for free.","2026-10-19","Martin Swoboda","/img/blog/story-of-neleto.svg",[225,238,239,240,224],"Build in Public","Story","Triple-A Soft",{"path":242,"title":243,"description":244,"date":245,"author":235,"image":246,"tags":247},"/en/templates-are-dead","Templates Are Dead","Every CMS starts by asking you to pick a template. Now that AI generates real designs and a native MCP server places them straight into your CMS, you can start from your own idea instead of someone else's theme.","2026-10-07","/img/blog/templates-are-dead.svg",[224,248,249,250,251,225],"AI","MCP","Web Design","Templates",{"path":253,"title":254,"description":255,"date":256,"author":235,"image":257,"tags":258},"/en/best-cms-for-agencies","Best CMS for Agencies Managing 10+ Client Sites (And What to Check Before You Commit)","The four things that actually decide it, the per-site maths at 10 and 25 sites, and an honest look at where each option falls apart.","2026-10-05","/img/blog/best-cms-for-agencies.svg",[259,260,261,262,249,225],"Agencies","CMS Comparison","Pricing","Client Sites",{"path":264,"title":265,"description":266,"date":267,"author":235,"image":268,"tags":269},"/en/host-without-us-cloud","How to Host a Website Without US Cloud Providers (And What Actually Counts as 'EU')","An EU data centre is not the same thing as being outside US legal reach. Here is the difference, layer by layer.","2026-09-28","/img/blog/host-without-us-cloud.svg",[270,271,272,273,274,225],"GDPR","EU Hosting","Digital Sovereignty","CLOUD Act","Data Compliance",{"path":276,"title":277,"description":278,"date":279,"author":235,"image":280,"tags":281},"/en/native-mcp-vs-wrapper","Native MCP vs an MCP Wrapper: Why the Difference Shows Up in Production","Both speak the same protocol. The gap opens in what they can reach, who they act as, and how many round-trips one instruction costs.","2026-09-21","/img/blog/native-mcp-vs-wrapper.svg",[249,282,224,283,284,285,225],"AI Agents","Integration","Claude Code","Permissions",{"path":287,"title":288,"description":289,"date":290,"author":235,"image":291,"tags":292},"/en/jimdo-to-neleto-migration","Jimdo to Neleto: A Real Migration Story","We rebuilt a live Jimdo one-pager on Neleto with Claude. The first pass hurt accessibility; two prompts later Lighthouse showed 99/100/100/100.","2026-09-14","/img/blog/jimdo-to-neleto-migration.svg",[293,294,295,296,297,249,225],"Case Study","Migration","Jimdo","Accessibility","Lighthouse",{"path":299,"title":300,"description":301,"date":302,"author":235,"image":303,"tags":304},"/en/mcp-server-faster-image-ingest","The same AI build went from 30 minutes to 4 — here's what we changed in our MCP server","Image uploads were the slowest part of building a site with an AI agent. What we changed in Neleto's MCP server, with before-and-after numbers.","2026-09-07","/img/blog/mcp-server-faster-image-ingest.svg",[225,249,248,305,238,306],"Agents","Performance",{"path":308,"title":309,"description":310,"date":311,"author":235,"image":312,"tags":313},"/en/full-cms-vs-headless","Full CMS vs Headless: Why All-in-One Wins for Most of the Web","Headless earned its reputation for real reasons. Here's the honest trade-off — and why, for most sites, a complete CMS is the better deal.","2026-08-31","/img/blog/full-cms-vs-headless.svg",[314,224,315,249,271,225],"Comparison","Headless",{"path":317,"title":318,"description":319,"date":320,"author":235,"image":321,"tags":322},"/en/self-verifying-ai","The AI That Checks Its Own Work","Most AI-plus-CMS setups write content and hope it rendered. Neleto checks three ways: structured output, LSP checks and a look at the live page.","2026-08-24","/img/blog/self-verifying-ai.svg",[225,248,249,305,238,224],{"path":324,"title":325,"description":326,"date":327,"author":235,"image":328,"tags":329},"/en/five-plugins-built-in","Five New Neleto Plugins — Built In, Not Bolted On","Search, comments, Google reviews, SEO and accessibility audits, and galleries: five plugins that run inside your Neleto instance, no third-party scripts.","2026-08-17","/img/blog/five-plugins-built-in.svg",[225,330,224,238,331,332,333],"Plugins","SEO","Search","DSGVO",{"path":335,"title":336,"description":337,"date":338,"author":235,"image":339,"tags":340},"/en/why-neleto-runs-on-rust","Why Neleto Runs on Rust (And the Benchmarks to Prove It)","Why Neleto runs on Rust: real benchmarks (11 ms TTFB, ~9,400 req/s, 78 MB RAM) and what it cost us in dev speed, hiring and young libraries.","2026-08-10","/img/blog/why-neleto-runs-on-rust.svg",[225,223,306,341,238],"Benchmarks",{"path":343,"title":344,"description":345,"date":346,"author":235,"image":347,"tags":348},"/en/page-builder-walkthrough","Building a Landing Page in Neleto: A Real Walkthrough (Mouse and Prompt)","I built the same landing page twice, by hand in the visual builder and by prompting Claude, and timed both. Including the parts that were slower.","2026-07-27","/img/blog/page-builder-walkthrough.svg",[225,349,224,249,350,351],"Page Builder","AI CMS","No-Code",{"path":353,"title":354,"description":355,"date":356,"author":235,"image":357,"tags":358},"/en/mcp-connectors","Connect Neleto to Anything: The Native MCP Server and Connector Ecosystem","Your CMS shouldn't be an island. Here's how Claude, Cursor, and Windsurf talk to your content directly — and where it goes next.","2026-07-20","/img/blog/mcp-connectors.svg",[249,359,248,284,360,225,224],"Connectors","Cursor",{"path":362,"title":363,"description":364,"date":365,"author":235,"image":366,"tags":367},"/en/wordpress-migration-walkthrough","40-Page WordPress Migration: Honest Walkthrough","The content migration took under an hour. The full cutover (domain, DNS, redirects, forms, QA) took most of a day. Every step, every gotcha.","2026-07-13","/img/blog/wordpress-migration-walkthrough.svg",[368,294,224,270,271,225],"WordPress",{"path":370,"title":371,"description":372,"date":373,"author":235,"image":374,"tags":375},"/en/html-to-editable-cms","Turn a Static HTML Site into an Editable CMS","Web designers lose days rebuilding finished designs as a CMS. With Neleto's MCP server it takes one prompt, animations and custom cursor included.","2026-07-06","/img/blog/html-to-editable-cms.svg",[249,282,250,284,224,225],{"path":377,"title":378,"description":379,"date":380,"author":235,"image":381,"tags":382},"/en/console-launch-free-tier","Neleto Console Is Live — and the Free Tier Is Open","Sign up at console.neleto.io, get a real CMS, and pay us nothing. Here's why we built it that way.","2026-06-29","/img/blog/console-launch-free-tier.svg",[238,225,383,384,271,224],"Free Tier","Self-Serve",{"path":386,"title":387,"description":388,"date":389,"author":235,"image":390,"tags":391},"/en/mcp-server-explained","MCP Server Explained: The Deep Dive","How the Model Context Protocol enables secure, native AI agent interaction with your applications — and why native implementation matters.","2026-06-22","/img/blog/mcp-server-explained.svg",[249,392,393,282,394],"MCP Server","Model Context Protocol","AI Integration",{"path":396,"title":397,"description":398,"date":399,"author":235,"image":400,"tags":401},"/en/neleto-vs-contentful","Neleto vs Contentful: Which CMS Should You Choose in 2026?","A practical comparison for developers, agencies, and growing businesses — covering pricing, performance, AI integration, editor experience, and EU compliance.","2026-06-16","/img/blog/neleto-vs-contentful.svg",[225,402,403,260,350],"Contentful","Headless CMS",{"path":405,"title":406,"description":407,"date":408,"author":235,"image":409,"tags":410},"/en/agentic-traffic-surpassed-humans","Bots Just Out-Numbered Us: What the Agentic Web Means for Your CMS","Cloudflare says AI agents now drive the majority of web traffic — 18 months early. Here's why that changes how you publish content, and what to do about it.","2026-06-08","/img/blog/agentic-traffic-surpassed-humans.svg",[411,282,249,224,225],"Agentic Web",{"path":413,"title":414,"description":415,"date":416,"author":235,"image":417,"tags":418},"/en/glw-gmbh-case-study","Modernizing a 40-Year Family Business: GLW GmbH's New Website with Neleto","How we delivered a fast, multilingual, and CRM-integrated website for a leading German cable processing specialist — in close collaboration with agency Inhalt.","2026-06-05","/img/blog/glw-gmbh-case-study.svg",[293,419,225,420,421],"Customer Story","CRM Integration","Custom Plugin",{"path":423,"title":424,"description":425,"date":426,"author":235,"image":427,"tags":428},"/en/eu-hosting-compliance","Why EU Hosting Compliance Matters for Your Website","Data sovereignty, GDPR, and choosing the right infrastructure in 2026","2026-06-01","/img/blog/eu-hosting-compliance.svg",[270,271,274,429,225],"Privacy",{"path":431,"title":432,"description":433,"date":434,"author":235,"image":435,"tags":436},"/en/buergerstiftung-ravensburg","Bürgerstiftung Ravensburg: A Modern Website for Community Impact with Neleto","How we built a clear, fast, and emotionally engaging website for a regional community foundation using Neleto CMS — in close collaboration with agency Inhalt.","2026-05-29","/img/blog/buergerstiftung-ravensburg.svg",[293,437,438,225,439],"Nonprofit","Foundation","Website",{"path":441,"title":442,"description":443,"date":444,"author":235,"image":445,"tags":446},"/en/what-is-mcp","What is the Model Context Protocol (MCP)?","The new standard connecting AI agents to your tools and data","2026-05-25","/img/blog/what-is-mcp.svg",[249,248,393,282,224],{"path":448,"title":449,"description":450,"date":451,"author":235,"image":452,"tags":453},"/en/why-neleto-exists","Why Neleto Exists","The CMS Built for Speed, Simplicity, and the AI Era","2026-05-18","/img/blog/why-neleto-exists.svg",[224,248,454,306,225],"Web Development",1792590667446]