Vikas Singhal
Vikas builds tools that take the friction out of WordPress development. He writes about WP-CLI, dev workflows, and running WordPress at agency scale.
php2shell in the Wild: What Attackers Tried in the First 14 Hours, and What Stopped Them
Attacks on php2shell reached InstaWP-hosted sites 2h20m after disclosure. None succeeded. What each campaign tried, and which PHP setting stopped it.
PHP Security Vulnerabilities CVE-2026-109618 and CVE-2026-109619 (php2shell): What InstaWP Customers Need to Know
Live updates on the php2shell PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619): what InstaWP has done, and what you need to do based on your site's PHP version.
WordPress Virtual Patching: How We Block a Plugin Exploit Before You Can Update
Virtual patching blocks a WordPress exploit at the web server, before PHP runs, so a site is protected while it still runs the unpatched plugin. How…
I Cloned 15 Agent Skill Repos So You Don’t Have To: 7 That Actually Survive Client Work
Most public agent skill repos will not survive contact with a client site. I cloned fifteen, measured what was inside each one, and found seven worth…
Vercel Alternative: The Best Option for Full-Stack Apps in 2026
Vercel is excellent at what it was built for. If your app needs a real server, a database on disk, background jobs or a bill you…
Elementor Pro Critical RCE (CVE-2026-32475): What It Means and What We Did
A critical unauthenticated file upload to RCE flaw in Elementor Pro, affecting every version up to 4.2.1. What the bug actually is, who is really at…
How to Connect n8n to WordPress: Node, Webhooks and n8n MCP
Connect n8n to WordPress with an application password, webhooks or n8n MCP. Five workflows for WooCommerce, forms and publishing, an n8n AI Agent wired to InstaMCP,…
Inside Our wp2shell Response: How We Protected the Fleet From a WordPress Core RCE (CVE-2026-63030)
The full engineering story of how InstaWP detected, blocked and verified protection against wp2shell (CVE-2026-63030), a pre-auth WordPress core RCE, fleet-wide and within hours.
InstaWP CLI: 5 WordPress tasks you can run from the terminal
Connect, bulk-update, search-replace, reset admin, and export your database, fast, from the command line.
How to Make WordPress Headless with Astro (2026 Guide)
Headless WordPress with Astro means you keep WordPress purely as your content editor and serve the public site as static HTML built by Astro. WordPress exposes…