Practical PHP, Laravel, devops, and AI-assisted workflow notes from Md Zia Uddin.
I wanted a publishing stack I control — posts, members, newsletters — not another hosted CMS. Ghost on Ubuntu 24.04 with Docker or Ghost-CLI is fine until Nginx 502s because nothing is listening on 2368, or Ghost-CLI refuses to install under /root. Here's that wall.
Jun 29, 2026 · 3 min read
Read article
I wanted browser tag edits on the same VPS as Jellyfin, not another media server. Tagr came up on Docker. Official compose comments the /music binds and ships AUTH_SECRET as change-me. A scan with zero tracks is the missing mount. AUTH_URL left as your-domain.com sent logout to the wrong host. Loopback 3000, real bind, persisted /data — that is the lab path.
Oct 5, 2026 · 9 min read
PHP 8.5.11 shipped 24 Sep 2026 for CVE-2026-91765. I would run php -v, php-fpm -v, and php -m before I claim I am patched. This is a SoapServer DoS on ext-soap, not a Laravel-core CVE. Ubuntu 24.04 archive PHP is still not that tag.
Oct 2, 2026 · 9 min read
I wanted one directory for Nextcloud and Grafana without standing up OpenLDAP. lldap came up on Docker. Official compose comments out 3890; I uncommented it and put the directory on the public internet. Skip JWT, key seed, and /data and the admin password is still password. Loopback UI plus Docker-network LDAP is what is running in the lab now.
Sep 28, 2026 · 9 min read
mongodb/laravel-mongodb 5.11.0 tagged 10 Sep 2026 for CVE-2026-88022. A 3-arg where('=', $array) is now a literal $eq. I would run composer show and composer audit --locked before I claim I am patched. This is not a Laravel core CVE.
Sep 25, 2026 · 8 min read
13.31 adds Queue::totalSize() so I stop adding pending + delayed + reserved by hand, and a JobInterrupted event that only fires when an Interruptible job is actually in handle(). SQS still returns 0. An idle SIGTERM is still WorkerInterrupted. I would run composer show laravel/framework before I claim either.
Sep 23, 2026 · 9 min read
I wanted a self-hosted BaaS with Postgres instead of another Firebase bill. Appwrite 2.0’s installer came up on :20080. localhost was the VPS, not my laptop, and a 2 GB droplet OOM’d before Console IV loaded. Wizard hostname matching Traefik Host, 4 GB RAM plus swap, then close 20080 — that is the lab path.
Sep 14, 2026 · 12 min read
No spam. One short email per new article — practical PHP, Laravel, devops, and AI-assisted workflows.
PHP 8.6.0beta3 tagged 10 Sep 2026. GA is still scheduled 19 Nov. I would not put beta FPM on a VPS. I would run the official CLI container, try clamp() and ? placeholders, and leave Laravel 13 on 8.5.
Sep 11, 2026 · 8 min read
On 13.29, Storage::get('../../../.env') already threw. Storage::path() of the same string still concatenated past the disk root. 13.30 runs path() through Flysystem's WhitespacePathNormalizer. I would bump composer show laravel/framework before I trust a query-string download again.
Sep 9, 2026 · 9 min read
I wanted merge, OCR, and compress off a hosted PDF site. Stirling came up on Docker. The compose I copied set SECURITY_ENABLELOGIN=false on a public 8080, and ultra-lite would have dropped login anyway. Login on, bind localhost, Nginx in front — that is what is running in the lab now.
Sep 7, 2026 · 9 min read
PHP 8.5.0 shipped 20 Nov 2025; 8.5.10 is the latest I can cite (27 Aug 2026). I would not start with the pipe operator. I would make php-fpm match php -v, stop calling array_first() like a Laravel helper, and only then touch clone-with and Uri\Rfc3986\Uri.
Sep 4, 2026 · 8 min read
I wanted a photo instance I actually own. Pixelfed is Laravel 12, and the homepage never tells you that Composer will OOM a 1GB VPS or that feeds stay empty until Horizon is a systemd service. Redis, Intervention Image, and Flysystem are the packages that decide whether the box is useful.
Sep 1, 2026 · 12 min read
I wanted runbooks off Notion. Wiki.js came up on Docker, then login died because DB_PASS did not match POSTGRES_PASSWORD, and search stayed empty until pg_trgm was actually in play. After that, HTTPS and a dump script were the boring parts.
Aug 31, 2026 · 7 min read