I use WP Umbrella right now for plugin and core updates, but I’m still hesitant about just letting everything auto-update.

My main concern is a core or plugin update breaking something and not catching it right away.

For those managing 30+ sites, what are you using that’s been reliable? Do you leave auto-updates on, wait a few days on bigger releases, or have some kind of testing/rollback process?

Building Cashvelope was a massive personal challenge. I wanted a true envelope budgeting app that put data control back in the user's hands.

Working on this late at night after my main work hours meant dealing with severe burnout, redesigning local data structures three times, and fighting through backend edge cases solo. Building a app end-to-end alone is a completely different beast than writing code for a client.

To fellow devs who built and released your own side projects:

How do you balance feature scope creep with actually getting the app across the finish line?

My WordPress site was compromised — suspicious MU-plugins and heavily obfuscated JavaScript

I'm investigating a WordPress site that was compromised. My coding/security knowledge is limited, so I used AI to help me analyze the files and understand what was happening.

I found a suspicious MU-plugin called:

focal-extension-evo

The file is currently 0 bytes, but its filesystem timestamps are interesting. It appears to have been created around August 14, 2026, and there is also a serialized reference to it in wp_options.

With the help of AI, I was able to reconstruct part of the heavily obfuscated JavaScript associated with the infection.

The JavaScript makes a POST request to:

https://fashion-chicken.com/x9i32md/w1/

It also contains an eval() mechanism that appears capable of executing the response received from the remote server.

I did not execute the code or contact the remote server.

Threat-intelligence checks also show that fashion-chicken.com is associated with malicious infrastructure/C2 activity.

Plugins currently installed

These are the plugins actually reported by WordPress on this installation:

Active:

• Classic Editor 1.7.0
• Elementor 4.2.4
• Elementor Pro 3.35.0
• JetEngine 3.8.14.3
• WPvivid Backup Pro 2.2.30

Inactive:

• BDThemes Element Pack Lite 8.8.2
• JetFormBuilder 3.6.5.2
• WP Lorem Ipsum Generator 0.3
• Rank Math 1.0.277.2
• Rank Math Pro 3.0.106
• WooCommerce 11.0.1
• WP Cafe 3.0.19
• WP Cafe Pro 3.0.5
• WP Mail SMTP 4.9.0

Suspicious MU-plugins found

WordPress is also reporting these as must-use plugins:

• focal-extension-evo
• ionic-dashboard-ultra
• jolt-librarian-vox
• lumen-logger-io
• max-exporter-tag
• page-compiler-jet
• web-extension-evo

There are also these drop-ins:

• advanced-cache.php
• db.php
• maintenance.php

I'm now working on cleaning the installation and determining how the malicious files were introduced.

The AI assistance has been extremely useful because my knowledge of malware analysis and heavily obfuscated JavaScript is limited. It helped me decode the JavaScript and identify the suspicious external communication without executing the malware.

Is anyone else dealing with something similar? Are you using any of the plugins listed above? Has anyone seen focal-extension-evo, web-extension-evo, or the other MU-plugins mentioned here before?

A feature common to a great very many HTML boilerplates is this line:

html <meta name="viewport" content="width=device-width, initial-scale=1.0">

The initial-scale=1.0 bit was present to fix an ancient issue on iPhones. When rotating the screen into a landscape orientation, the page would keep the same width as when it was in portrait, making everything appear very zoomed in.

This isn't an issue any more. I've tested it across very many devices, and it appears it was fixed in iOS 9, which released back in 2015. In addition to testing, I've consulted a great number of other professionals, and nobody has been able to find evidence of it being needed any longer.

You can safely simplify the meta viewport declaration down to:

html <meta name="viewport" content="width=device-width">

It isn't hurting you to leave it there, but it is vestigial and unnecessary.

Further details: - https://vale.rocks/micros/20260902-1350 - https://quirksmode.org/quirksblog/2026/0902-initial.html

I'm parting with my ElePHPant collection after 13 years of collecting them. I'm raising money for my startup and also will need open heart surgery in the next 5 years. As the UG leader of PHP Vegas for over 10 years, its been a hell of a run. I still love PHP and my startup is built in it, but I also need funds as I'm quitting my full time to do all this. If we crossed paths before, thank you for all the fish. You can find my collection for sell here: https://www.ebay.com/sch/i.html?_dkr=1&iconV2Request=true&_blrs=recall_filtering&_ssn=pokemastercenter&store_cat=0&_nkw=elephpant&store_name=pokemastercenter&_oac=1

Hello,

When I do any search for non-profit CRMs, I reliably only see feedback about how it works for development staff. I never see anyone review how they handle tracking program participant data of any kind (ie, tracking someone's progress through program phases, intaking program applications, etc.). You'd think more people would report on how their CRM does at, say, reporting how many people stayed in stable housing or the % growth in student test results or whatever other relevant topic a non-profit might have. I wonder if I'm biasing my search in some way that programs-focused reviews never seem to come up? I am curious if anyone has any experience using one tool for dual purposes:

1) Donor/Volunteer management

2) Programmatic documentation and reporting

If it helps to tailor the response, we have ~20k records on the development side and annually have about ~1k records on the program side.

CRM migrators/implementers/trainers: have you ever had a client come to you to move away from their own custom-coded CRM and migrate over to the platform you work with ?

Bonus question: what was the breaking point that made them realize coding their own system was a mistake ?

I just published the landing page for a mobile CRM called Stuvo. It’s designed for independent, solo operators and micro-businesses who still manage bookings, clients, and batches using paper notebooks or messy WhatsApp threads.

The app is explicitly built for these categories:

Private tutors and coaching centers

Wedding photographers and video studios

Dance academies and dance instructors

Music studios and music teachers

Yoga studios and yoga instructors

Makeup artists

Art studios and art teachers

Fitness studios, gyms, and personal trainers

Most business software defaults to heavy cloud sync, but I went with a 100% offline-first approach using React Native and a local on-device SQLite database. The goal is to make it open instantly with zero network lag on spotty mobile data, while keeping their client list entirely private on their phone.

I want to know if the core idea lands properly. Does a purely offline utility focus feel like a realistic trade-off over a standard cloud web app for these types of local businesses?

Web- stuvo.in

Any feedback on the concept or the positioning would be highly appreciated.

I’m based in the UK and looking for a modern sales/outbound tool or CRM that can help me:

• Find local leads
• Enrich contacts
• Send cold emails/sequences
• Call from a UK number
• Log calls/emails/notes properly in a CRM

I’ve looked at Apollo, but it seems you can only call from a US/Canada number unless you pay around £150/month for the Advanced Dialer add-on, which feels steep when I’m UK-based and need a UK caller ID.

Are there any good alternatives that combine lead finding, email outreach, UK calling, and CRM logging in one place? Or is the better setup something like Apollo/Instantly for data/email plus Close, Aircall, Ringover, etc. for UK calling?

Would appreciate any recommendations from UK-based sales teams or founders.