Operations | Monitoring | ITSM | DevOps | Cloud

The data to explain a slow endpoint is usually already sitting in your project. Blackfire has the profile. Continuous profiling has the flame graph. The traffic numbers show which route matters. The code is in git. What takes the afternoon is putting those four things next to each other and working out which function is responsible. That afternoon is what the Upsun Performance Agent is for.

On 21 October 2026, the team behind PHP released an emergency fix for two critical security flaws. PHP is the programming language behind a large share of the web, including WordPress, Drupal and many online stores. Researchers at Wiz named the flaws PHP2Shell. An attacker could use them to take control of a website without ever logging in. Updating a website, its CMS, or its plugins doesn't help. The only real fix is (and was) a new version of PHP itself.

Earlier this year, I spent time with technology leaders across four major cities – San Diego, Boston, London and Dallas, as part of four Leadership Circles. Taken together, the conversations reinforced how far digital employee experience has matured for many organizations. The focus has shifted from understanding why DEX matters to exploring what it takes to operationalize its success. San Diego focused on the changing role of IT and the strategic case for DEXOps.

When a critical flaw surfaces in the language behind a large share of your web applications, how quickly can your organization name every server that runs it? PHP2Shell puts that question in front of every IT leader who runs PHP. The answer decides how long the business stays exposed. Here's the short version. PHP2Shell covers two flaws in the PHP engine, and either one lets an attacker run code on a web server with no login at all.