Andrew Engstrom

PHP2Shell: What Happened, Why, and How We Responded

On October 21, the people who maintain PHP released fixes for two serious security flaws in PHP itself. The flaws are tracked as CVE-2026-109618 and CVE-2026-109619, and they quickly picked up a nickname: "PHP2Shell." By that evening, government security agencies in the US, the UK, Australia, and the EU were telling everyone who runs PHP to update right away. Attackers had started testing the flaws before the fixes were even out.

Why Monthly Maintenance Windows Can’t Keep Up With Critical WordPress Patches Anymore

For most of the time we have maintained WordPress sites, a monthly update window was a sound way to run maintenance. Updates were batched, tested on a staging copy of the site, applied on a predictable day, and documented for the client. That cadence still works well for most of what a maintenance plan covers. It no longer works as the only path for security patches. Attackers now start using a newly disclosed WordPress vulnerability within hours, while a monthly cycle measures its response in weeks.

How AI Crawlers Are Rewriting Your Traffic Logs (and What to Do About It)

If your website traffic reports have dropped while your hosting bills have climbed, AI crawlers are often part of the explanation. These are automated programs from companies like OpenAI, Anthropic, and Perplexity that read your site to train AI models, power AI search, or answer a question someone asked a chatbot. They show up in your server records but rarely in Google Analytics, so the two sources your team reports from now tell different stories. At Curious Minds Media, we’ve spent the past year reconciling those records on client sites, and the decisions that follow affect both hosting cost and whether your company appears in AI answers.

Virtual Patching Buys Time: What a WAF Stops and What It Misses

When a WordPress plugin vulnerability goes public, clients usually ask us one thing first: does the firewall already cover it? The answer depends on the kind of vulnerability. 

Virtual patching means a web application firewall (WAF) rule written to block the known exploit for one specific flaw. It can protect a site within hours of disclosure, often before the plugin developer ships a fix. It is weakest against the vulnerability class attackers exploited most in 2025, and it cannot reach code or malware already on the server. 

What a Forced PHP Migration Reveals About Your Maintenance Coverage (and What to Ask Your Host)

PHP 8.2 reaches end of life on December 31, 2026, and managed WordPress hosts are already scheduling the move to newer versions. 

For a well-maintained site, the move is routine infrastructure work. For a site where plugin compatibility, custom code, and staging have gone unchecked, the host’s upgrade date is when those gaps reach production.

WordPress or Headless: How We Actually Make the Call

We get this question in some form on nearly every new build. Should this be WordPress, or should it be headless? Usually it arrives already loaded with an assumption, because someone on the client's side read an article, or a competitor relaunched on a newer-looking platform, and now headless sounds like the modern answer and traditional WordPress sounds like the thing you graduate out of.

Why Over-Permissioned WordPress Users Are a Bigger Risk Than Bad Passwords

We get asked about password policy more than almost anything else in a security review. Two-factor authentication, password managers, forced resets on a schedule. All reasonable questions. None of them determines how bad a breach gets once someone's in. That comes down to one thing: what the compromised account was allowed to do.

WordPress 7 Is Building an AI Platform. Here's What That Means, and What's Coming in 7.1.

We've been building AI directly into WordPress environments and custom applications for clients before WordPress had a native framework for it. For years, AI features in WordPress meant plugins. Each one built its own connection to an external AI provider, managed its own API keys, handled its own authentication, and operated independently of every other AI tool on the site. If you used three AI-powered plugins, you had three separate AI configurations to manage, three separate points of failure, and no consistent way for any of them to understand the WordPress context they were running in.

The Security Case for Static Sites: What 2026's WordPress Vulnerabilities Changed

We've been building on WordPress since 2004. It's our core practice, and for a significant majority of the organizations we work with, it's the right platform. But 2026 has been a year that makes the platform security question harder to dismiss than it used to be.

When a Plugin Becomes a Weapon

Plugins are the most underestimated risk surface in a WordPress environment. Most conversations about WordPress security focus on passwords, outdated core installs, and hosting infrastructure. But the plugin stack, the collection of tools that accumulates on a site over time, is where the most consequential problems show up, and it gets the least scrutiny.

BigScoots, Cloudflare, and IP Reputation: Why Your Hosting Stack Is a Security Decision

Most WordPress security conversations focus on plugins, passwords, and patching. Those things matter. But the hosting infrastructure your site runs on quietly shapes your security posture in ways that only become visible when something goes wrong.

WPackagist Has a New Owner. If You Use Composer for WordPress, Pay Attention.

Most developers who use WPackagist don't think about it much. It does one thing, does it reliably, and mostly stays out of the way. That's exactly the kind of infrastructure that deserves attention when something changes.

Choosing the Right Hosting Environment: When WP Engine Fits and When BigScoots Makes More Sense

Hosting decisions tend to get revisited only after something starts to strain. Performance slows. Deployments feel riskier. Traffic spikes cause anxiety instead of confidence. At that point, teams are no longer asking who their hosting provider is. They are asking whether their environment still fits the site they are running today.

Website Maintenance Plans That Match How Your Site Actually Operates

Website maintenance is not a checklist. It is an operating decision.

Some sites benefit from a stable, automated system that quietly does its job in the background. Others need ongoing developer involvement because the site itself plays an active role in how the business runs, changes, and grows.

What a Long-Term Technical Partner Actually Does Differently

Enterprise teams don’t usually wake up one morning and decide they need a long-term technical partner. They get there after the platform has been through enough change to start showing its limits.

The site grows. Integrations are added. More teams rely on it. What once felt flexible starts to feel fragile. Changes take longer. Risk becomes harder to judge. Confidence fades quietly, even though the site still works.

Who Owns Your Website Stack? Licensing, Access, and Hidden Risk

Most businesses think they own their website. What they actually own is the idea of it.

The real site lives somewhere else: in a registrar account, a hosting dashboard, a DNS provider, a handful of plugin licenses, and several tools no one has logged into in years. Everything works fine until something goes wrong. That’s usually the moment people realize they don’t know who controls what, or how to get access quickly.

How Apple’s Intelligent Tracking Prevention (ITP) Changed Marketing Data Tracking and Analytics

Apple didn’t just take away a few cookies; they changed how measurement works across the web. With iOS 17 and Safari 17, tracking gaps began appearing in places teams had relied on for years. As more clients ask us about attribution issues and unexpected analytics drops, we’ve been digging deeply into what’s happening under the hood and how to build more resilient data setups moving forward.

AI Crawlers Are Increasing: How to Manage Bot Traffic and Use Rate-Limiting Safely

AI-powered crawlers are showing up on e-commerce sites far more often than they used to. Some help your store, search indexers, link preview bots, and assistants that might recommend your products elsewhere. Others scrape aggressively, burn server resources, and bury your analytics in junk visits.

How to Keep Your E-Commerce Store Running Smoothly During Traffic Spikes

Running an e-commerce store is hard enough on a slow Tuesday. Now imagine a viral post hits or your Black Friday promo goes live — thousands of shoppers flood in. Great problem to have, right? Until your site lags. Or worse, crashes.

WP Engine Launches AI Toolkit for WordPress

The way people use websites has shifted. A visitor doesn’t just want content anymore—they want the right content, and they want it now. If the search bar doesn’t understand them, or if the recommendations feel random, they’ll bounce without a second thought.

Hardening WordPress in the Age of AI: What’s Changing and How to Prepare

As AI continues to shape both sides of the security equation, WordPress users—especially developers, agencies, and site owners—need to think differently about how they protect their sites. At Curious Minds Media, we handle WordPress builds for healthcare groups, nonprofits, and other teams where security isn’t just a checkbox—it’s part of the job.

The State of WordPress Security in 2025: What Agencies and Site Owners Need to Know

WordPress security isn’t what it used to be—and that’s not a bad thing. At Curious Minds Media, we’ve seen firsthand how the threat landscape is evolving in real time, from AI-powered exploits to plugin vulnerabilities and platform politics. We’ve also seen what works: custom-built security stacks, proactive planning, and a development mindset that treats protection as part of the core build—not an afterthought.

Security Showdown: Is Headless WordPress Really More Secure?

You've probably heard headless WordPress is picking up steam, and for some great reasons: it offers more flexibility, can make your sites super fast, and generally makes delivering content cleaner. But let's get to that big question, the one that’s like an elephant in the server room: what about security?

The Unified E-commerce Platform: Building for Smart Growth, Easier Scaling, and Better Long-Term Value

To succeed in today's online market, you need more than just a working website; you need a smart tech setup built to help you win. We'll explore how choosing the right way to structure your e-commerce tools – specifically using an all-in-one e-commerce solution – directly affects your ability to follow your long-term plans, grow without headaches, and manage costs wisely. We're not just talking about saving a few minutes here and there; we're focused on building a strong, flexible foundation that helps you stay competitive and grow your business profitably.

Scaling Your Online Store: Choosing a Platform That Can Keep Up

Editorial Workflow Made Easy with WordPress Plugins

Publishing demands adaptability and collaboration to thrive. WordPress publishing tools provide a robust framework for media teams to enhance their workflows. Whether you're steering a busy newsroom or maintaining a specialized blog, WordPress's built-in tools and integrations can dramatically boost your team's efficiency. Let's explore how this powerful platform can refine your editorial operations.

Elevate Your Travel and Hospitality Website: Using WordPress to Captivate and Engage

For any travel and hospitality organization, creating a website is no longer an option but an imperative task in this digital era. WordPress can prove to be a very powerful platform on which one needs to develop an attractive and functional website, which will engage the travelers and allure them. Imagine this: beautifully portrayed destinations and a seamless booking procedure, all within a click of the mouse. Well, this is not just a pipe dream but quite achievable with the stunning feature set and tool arsenal that WordPress boasts.

Navigating the WP Engine & WordPress Storm: Your Websites are Safe with Us

The WordPress community is currently facing a tumultuous period, with a public feud between WP Engine, a major hosting provider, and Automattic, the company behind WordPress itself. This dispute has raised concerns among many website owners, especially those hosted on WP Engine. At Curious Minds Media, we want to assure you that we are actively monitoring the situation and taking proactive steps to ensure your websites remain safe, secure, and fully functional.

Your Website's Vital Signs: Ongoing Healthcare Website Maintenance

In the world of healthcare, your website is more than just a digital front door - it is a vital hub for essential services. From patient scheduling to telehealth appointments and accessing medical records, a well-maintained healthcare website ensures patients receive timely and efficient care. But what happens when the website goes down or, even worse, gets hacked? 

Empower Your Nonprofit's Mission with WordPress Maintenance, Training and Support

Managing a WordPress website can be tough, especially for nonprofits with limited tech skills. With the right training and support, your team can confidently handle website tasks, keeping your online presence strong. By giving your staff the necessary knowledge and tools, you can make operations smoother, enhance security, and focus more on your mission.

ADA Compliance: Creating Inclusive Spaces in Website Development

The accessibility of a website isn't solely a stipulation of the Americans with Disabilities Act (ADA). In fact, it's a cornerstone for cultivating an inclusive digital presence. We aim to help you ensure your online platform caters to everyone's needs. By identifying common obstacles, implementing changes, and aligning your web features, we provide effective methods to transform your website into a welcoming environment for all users.

Why WooCommerce Falls Short for High-Traffic E-commerce Sites

Uncover the critical limitations of WooCommerce, including its struggle with high traffic volumes, security vulnerabilities, and SEO challenges. We reveal when it's time for businesses to consider more robust e-commerce platform alternatives to ensure scalability, enhance security, and improve marketing strategies for sustained growth.

Page Speed Scores: How WP Engine's Page Speed Boost Can Help

An optimized website is much more than just a luxury, it is a necessity. Business owners should maximize every opportunity to improve their site's performance, and this starts with your page speed. The importance of improved page speed couldn't be understated, as this metric directly impacts both user experience and search ranking. 

When to Consider a New WordPress Website Build

Your website is your company's first touchpoint for many potential customers. It reflects your company's reputation and provides the chance to turn prospects into actual clients. Having an outdated or poor-performing website can damage your online presence, create a negative first impression, and lower your potential customer conversion rate.

The Importance of Round-the-Clock Managed Hosting for Enterprise WordPress Sites

Managed hosting providers take care of all the technical stuff, like managing servers, updating software, and keeping things secure, making managed hosting an excellent option for large websites with high traffic, specifically WordPress. Round-the-clock managed hosting is perfect for important business websites that must be dynamic and complex to succeed.

Finding the Perfect Balance: Quality and Cost in Managed Hosting Services

A strong online presence is not just nice to have-it's a must-have. It can really make a difference for businesses, what with e-commerce and influencers, and the like. Picking the ideal web hosting service is more than a technical choice- it's a decision that influences both your website's performance and reputation.

Managed WordPress Hosting: What It Is & Why You Need It

WordPress isn't just a popular platform, but a foundation for a diverse array of websites, from small businesses to bustling e-commerce giants. The heart of a WordPress site's success, however, beats in its hosting environment. This is where Managed WordPress Hosting shines, offering a bespoke solution that dramatically elevates the standards of typical hosting. Tailored exclusively for WordPress, this hosting type is all about enhancing performance, tightening security, and ensuring scalability, fundamentally transforming WordPress websites into something more efficient, secure, and adaptable.

Wordpress.com vs Wordpress.org

Explore the differences between WordPress.com and WordPress.org to make an informed choice for your website or blog. Learn about hosting, customization, costs, and technical expertise required for each platform. Discover how Curious Minds Media can provide expert support for your WordPress web design and development needs. Make the right decision to create a website that suits your goals and preferences.

Guide to WooCommerce Maintenance & Why It Is Important

If you're operating a WooCommerce store, maintenance isn't optional, it's a must-do!

Maintaining your WooCommerce store requires time and effort, but the payoffs are endless and will make your life as an online store owner much easier. Ongoing WordPress ecommerce support and maintenance should be a non-negotiable part of your WooCommerce operation, and here is why.

Why Post-Launch Website Support Matters

An exciting milestone for any business is the launch of a website. It represents the fruit of all your hard work, planning, and ingenuity. Yet it doesn't end with the launch, as any seasoned company would attest. In actuality, the launch is just the start. The remaining phases, especially post-launch support, are just as important, or perhaps more so. Let's explore why this stage is so crucial.

The Future of WordPress: Predicted Changes & Developments

So, what is the future of WordPress? Serving as the globe's most popular content management system, WordPress has proven transformative for both businesses and individuals. However, with the progression of technology, WordPress must also evolve. Let's explore the future direction of this platform and the predicted changes and developments that will shape its course.

Website Maintenance: An Unavoidable Necessity in the WordPress World

WordPress is the most popular content management system (CMS) in the world, powering millions of websites. Consequently, the topic of maintenance becomes a top-tier priority for website owners far and wide. We delve into the intricacies of maintaining your WordPress website, highlighting its significance, and showcasing why website maintenance is important.

Client Communication: How to do it, and Why it’s Important

Client communication is essential for maintaining healthy and productive relationships with your client. Without proper communication, things break down and go wrong.

Remote Work with a Newborn Baby

Working from home can be great but challenging. Add a newborn into the mix, and that takes it to an entirely new level. Before having a baby, the house was quiet.

Improving Stability and Security on Your WordPress Site

Have you ever heard of the term “deferred maintenance?” It’s commonly used in the real estate business to describe work needed on a property that has been delayed until the owner has the time and money to deal with it.

How to Properly Set Up Transactional Email on Your WordPress Site

What are transactional emails? The name may sound fancy or technical, but almost everyone has experience with them.

Differences Between a Prebuilt Theme vs. Building a Custom Theme

Configuring WPEngine for WooCommerce

Many people underestimate WooCommerce. Internally, there’s a lot going on. It’s frequently disliked for a lack of full-featured e-commerce functionality.

How to set up Laravel auth scaffolding using Jetstream in Laravel 8.x

In a popular move among developers, Laravel 8 has distanced itself from its auth scaffolding for a more modern approach using the Jetstream package.

Proper Deployment Procedures and the Importance of Version Control in WordPress Development

Have you ever worked in a group setting? Each person has their own list of responsibilities, deadlines, and goals, but everyone on the team is utilizing the same file base for storing updates to the project. Has this happened to you?

WordPress Security: How to Protect Your Site from Brute Force Attacks with URL Masking

Imagine it’s 10pm on a Friday night. You’re catching up on some (insert cool, recent TV show), trying to relax. Suddenly, you get a concerning text from your employee telling you to look at your website.

Do I Need a Staging Site?

Picture this – you’re making a change to your custom WordPress E-Commerce theme. You click save, and you get the infamous white screen. You refresh the page a dozen times and wonder where you went wrong, and what you did to deserve this fate?

Using CORS and Ember-Data to point an Ember app to multiple backend deployments

At Curious Minds we have developers working from different offices doing backend and frontend work on the same projects, so we need a deployment scenario that allows developers to make local changes without fear of breaking things for everyone.

Updating Lookup Fields From PHP – Force.com Toolkit for PHP

Utilizing a Force.com backend for your data can prove to be a very challenging project. Perhaps you are trying to minimize development costs, or you are trying to utilize the Force.com backend that you already have.

CSV / XLS Exporting in Adobe Coldfusion 9

Let’s talk about XLS Exporting in Adobe Coldfusion 9 (Excel Spreadsheets). ColdFusion has this neat little tag called cfspreadsheet. It allows the writing of, updating of, and reading of CSV/XLS files in ColdFusion.

New Website Launch

Welcome to our new website, and apologies for the mess during our construction phase. Something about the shoemaker’s kids not having a pair?

Jersey Boys Becomes 27th longest running show in Broadway History!

“JERSEY BOYS, the Tony, Olivier and Grammy Award-winning Best Musical, surpassed Oklahoma! with 2,213 performances last night, March 17, making it the 27th longest-running Broadway show in history.”

Magic Tree House: The Musical

The challenge of the Magic Treehouse Musical was to create interactive website that captured the vibrancy of the stage production, yet still had good search visibility.

Embedding Irregular Fonts in Flex 3

Often in programming, what seems to be a simple task can trip you up. Yesterday I was trying to embed the font Helvetic Neue LT Com Bold 77 in a css style sheet for a project of ours.

Jersey Boys Named 5th Best Theatre Production of the Last 25 Years

Entertainment Weekly recently came out with their list of “The New Classics”, and named their 50 best plays and musicals of the last 25 years. Coming in at number 5 was Jersey Boys.

Jersey Boys Videos for The Palazzo

Curious Minds Media just finished a series of videos for the Las Vegas production of Jersey Boys. This hit musical will be premiering in Vegas in April 2008 at The Palazzo Hotel and Casino.

Double Happiness Creations Flex Store Launch

We’ve just completed a cool little application for Yvonne Wong’s company Double Happiness Creations. She specializes in creating custom greetings and invitations.

Curious Minds!

Welcome to the Blog of Curious Minds Media, Inc. We’re a web dev group in upstate NY. I figured that it might be a good idea to start keeping track of the strange stuff that goes on around here.