Your Host Patched PHP2Shell. Did You Patch Your Dev Machine?

solarbluseth / October 23, 2026

Security Alert · PHP2Shell

Your Host Patched PHP2Shell. Did You Patch Your Dev Machine?

By SolarBluSeth · October 23, 2026

If you run PHP anywhere outside a managed host — your laptop, a VPS, a Raspberry Pi, a Docker container — check it today. On October 21, 2026, PHP shipped emergency fixes for two critical flaws, CVE-2026-109618 and CVE-2026-109619, nicknamed PHP2Shell. Together they let an attacker run code on a server with no login, through any PHP page, before WordPress or your own code even loads.

The good news: most managed WordPress hosts patched their servers within about a day. My own sites were covered at the server level by the next evening.

The bad news: nobody patches your machine for you. The laptop running a local stack, the $5 VPS you set up last year, the Docker image you built and forgot — those stay vulnerable until you update them. That long tail is where the attacks will land over the next few months.

How big is this?

PHP is not a niche language. It runs most of the web, and WordPress sits on top of a huge share of it.

69.3%

of websites with a known server-side language run PHP

W3Techs, Oct 23, 2026

42.6%

of all websites run WordPress, which is built on PHP

W3Techs via Barn2, Apr 2026

22.6M

internet-facing instances flagged as potentially vulnerable

Palo Alto Networks via TechTarget, Oct 21, 2026

2.24M

servers openly advertising PHP in their headers

Shodan count via CybelAngel, Oct 20, 2026

59%

of those that show a version are on branches with no official fix coming

Shodan count via CybelAngel

34.6%

of PHP websites still run PHP 7 or PHP 5

W3Techs, Oct 23, 2026

PHP websites by major version

PHP 8

65.3%

PHP 7

26.9%

PHP 5

7.7%

Source: W3Techs, October 23, 2026. Only PHP 8.2 and newer got an official fix.

And the machines nobody counts

Those numbers only cover servers you can see from the internet. Nobody counts the PHP installs on developer laptops, office PCs, and forgotten test boxes. Here’s a rough sense of scale: about 1 in 5 developers uses PHP (18.2% in Stack Overflow’s 2024 survey), and SlashData estimated 6.3 million PHP developers back in 2021. Most of them run at least one local stack — MAMP, XAMPP, WampServer, Homebrew, Docker, or Laravel Herd — and many run several.

That’s likely millions of unmanaged PHP installs that no hosting company will ever patch. That last part is my estimate, not a measured number, but it’s why I’m writing this.

Patched for you

Managed WordPress hosting
Shared and reseller hosting (cPanel, CloudLinux)
Managed VPS and dedicated servers

Patched by YOU

Your laptop: MAMP, XAMPP, WAMP, Homebrew, Herd
Self-managed VPS and Raspberry Pi
Docker images and AI-built dev servers

Which PHP versions are safe

You need PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or newer. Anything older on those branches is vulnerable.

Your PHP branch	Fixed in	Notes
8.5	8.5.12	Current branch
8.4	8.4.27	Supported through 2028
8.3	8.3.36	Supported
8.2	8.2.35	End of life December 31, 2026
8.1, 8.0, 7.4	No official release	Minimal source patches only; cPanel and CloudLinux backported fixes into their packages
7.3 and older	None	Upgrade or retire it

🔍

Version number looks old? Some hosts patch without changing it. CloudLinux put the fix into its existing builds, so a patched server can still say 8.4.26. Check the Build Date in phpinfo: anything built on or after October 21, 2026 has the fix.

Find every PHP you’re running

Most of us have more than one PHP and don’t realize it. Check each place it could live.

On a website or local server: phpinfo

Create a file with a hard-to-guess name, like check-8x3k.php. Don’t call it info.php; bots look for that name.
Put this one line in it:
```
<?php phpinfo(); ?>
```
Upload it to the site’s root folder (usually public_html), or drop it in your local web folder.
Open it in your browser: yoursite.com/check-8x3k.php or localhost:8080/check-8x3k.php.
Read three lines near the top: PHP Version (compare it to the table), Build Date (on or after Oct 21, 2026 = fixed), and Loaded Configuration File (tells you which PHP install it is).

Only need the number? Use <?php echo phpversion(); ?> instead. It reveals less.

On the command line

php -v
which -a php

which -a lists every PHP on your path. Two or three results means multiple installs, and each one needs updating.

⚠️

Check both. The command-line PHP and your web server’s PHP can be different. I updated PHP on my Mac, php -v said 8.5.12, and phpinfo still said 8.5.5 because Apache was holding the old version in memory.

Docker, VPS, and everything else

Docker: docker exec <container> php -v. Restarting a container does not update it. You need docker pull and a rebuild.
VPS or Raspberry Pi: SSH in, run php -v, update with apt or dnf, then restart Apache or PHP-FPM.
MAMP, XAMPP, Laravel Herd: these bundle their own PHP. Check for an app update.

Delete the phpinfo file when you’re done

The moment you’ve read the version, delete the file. A forgotten phpinfo page is a gift to attackers:

What it exposes

Your exact PHP version and build
Every setting, file path and module
The cookies of whoever views it. When I loaded mine while logged into WordPress, my login cookie was right there on the page.

How to delete it

cPanel: File Manager, select it, Delete
FTP / Dreamweaver: delete it on the remote server, then confirm the URL shows a 404
Mac: rm it from your web folder

If you viewed it while logged into WordPress and shared a screenshot or copy, log out and back in. That ends the session the cookie belonged to.

Updating PHP on a Mac (Homebrew)

If you installed PHP with Homebrew, this takes about five minutes. Run each command on its own line in Terminal.

Update and upgrade PHP.
```
brew update
brew upgrade php
```
You should see something like php 8.5.5 -> 8.5.12.
See what Homebrew has running.
```
brew services list
```
Restart PHP and your web server (whatever shows as started).
```
brew services restart php
brew services restart httpd
```
Use nginx instead of httpd if that’s what you run.
Reload your phpinfo page. It should show the new version.

If phpinfo still shows the old version

This happened to me. The upgrade worked, but Apache showed error in brew services list and kept serving the old PHP from memory. Here’s the fix:

Check Apache’s config is valid. It should say Syntax OK.
```
/opt/homebrew/bin/httpd -t
```
Check which PHP Apache loads.
```
grep -n "libphp" /opt/homebrew/etc/httpd/httpd.conf
```
If the path contains a version like Cellar/php/8.5.5, Apache is pinned to the old one. Change that line to the path that always points to the current version:
```
LoadModule php_module /opt/homebrew/opt/php/lib/httpd/modules/libphp.so
```
Kill the old Apache and start fresh.
```
brew services stop httpd
sudo apachectl stop
pgrep -l httpd
```
If pgrep still lists anything, run sudo killall httpd. Then:
```
brew services start httpd
brew services list
```
Once httpd says started, reload phpinfo.

💡

Terminal tip: don’t paste commands with # comments on the end. The Mac’s Terminal passes them to brew as extra words, and you’ll get No available formula with the name "#".

Not using Homebrew?

MAMP: MAMP menu → Check for Updates. MAMP bundles its own PHP, so Homebrew won’t touch it.
Laravel Herd: open Herd, go to the PHP tab, and update.
Windows (WampServer / XAMPP): download the Thread Safe x64 build of the fixed version from windows.php.net, or update the whole stack.

Still running PHP 5 or 7 scripts? Now’s the time to move them

If you’ve been holding a server on PHP 7.x or even 5.x because an old script breaks on PHP 8, this is your wake-up call. PHP 7.3 and older got no fix at all for PHP2Shell. PHP 7.4, 8.0 and 8.1 only got minimal emergency patches. The next serious flaw may not get even that.

The good news: most old scripts break for the same handful of reasons, and they’re fixable in an afternoon.

What usually breaks

Old code	Removed in	Replace with
`mysql_connect()`, `mysql_query()` and other `mysql_*`	PHP 7.0	`mysqli` or PDO with prepared statements
`ereg()`, `eregi()`, `split()`	PHP 7.0	`preg_match()`, `preg_split()`
`each()`	PHP 8.0	`foreach`
`create_function()`	PHP 8.0	Anonymous functions: `function() { ... }`
`$string{0}` curly-brace offsets	PHP 8.0	`$string[0]`
`utf8_encode()`, `utf8_decode()`	Deprecated in 8.2	`mb_convert_encoding()`
Adding properties to objects on the fly	Deprecated in 8.2	Declare the property in the class

PHP 8 is also stricter. Undefined variables and array keys throw warnings, passing the wrong type to built-in functions throws errors instead of quietly returning null, and 0 == "abc" is now false. Code that relied on PHP being forgiving will start complaining.

How to tackle it

Scan before you change anything. PHPCompatibility checks your code against a target PHP version and lists every problem by file and line.
Let a tool do the boring fixes. Rector rewrites a lot of old syntax automatically. Review its changes before you deploy.
Swap mysql_* for prepared statements. Usually the biggest job, and it closes SQL injection holes at the same time.
Test locally on PHP 8.4 or 8.5 with error reporting turned all the way up. Click every page and submit every form.
Switch the live site in cPanel’s MultiPHP Manager only after it runs clean locally. Keep the old version handy for a day in case you need to roll back.

🤖

Let AI do the grunt work. Hand an AI coding assistant a file and ask it to modernize it for PHP 8.4 and explain each change. It’s tedious, pattern-based work they do well. Just test the result before it goes live.

Your 15-minute checklist

Ask your host if your server is patched, or check its status page
Run phpinfo on one live site; check Version and Build Date
Delete the phpinfo file
Run php -v and which -a php on your computer
Update every local PHP: Homebrew, MAMP, Herd, Docker
Restart your local web server and re-check phpinfo
Stop local servers and tunnels you aren’t using
Check any VPS or Raspberry Pi you’ve forgotten about
List scripts still on PHP 5 or 7 and schedule the upgrade
Bookmark your host’s status page for next time

Your host has your back on the server. Your own machines are on you.

Sources

Custom PHP Development

obs vertical streaming setup and updates

solarbluseth / October 20, 2026

STREAMING EXPERIMENT

Going Vertical: What Happened When I Streamed for Phones and Big Screens at the Same Time

The setup, the bugs, the numbers, and what I’m changing next. 📱🖥️

1. The Experiment: Meeting Viewers Where They Watch

People don’t all watch the same way. Some are on a desktop or a TV with a wide screen, and a huge number are on their phone, held upright, scrolling. For years I streamed in one shape — widescreen — and asked phone viewers to turn their device sideways or squint.

So I tried something different: send two versions of the same stream at once. A horizontal 16:9 version for big screens, and a vertical 9:16 version built for phones. The goal was simple: get more viewers by giving each of them their preferred screen.

There was a second reason too. Both YouTube and Twitch now show vertical live streams in their mobile, swipe-style feeds. On YouTube, a vertical stream can appear right in the Shorts feed, in front of people who have never heard of you. A widescreen-only stream isn’t eligible for that at all.

2. The Setup

Here’s what I’m running. If you stream with OBS, you can copy this almost exactly.

🔧 The tools

OBS Studio as the main broadcaster.
Aitum Vertical (free OBS plugin). It adds a second, vertical canvas with its own scenes, its own sources, and its own stream output.
Custom HTML overlays I built myself, loaded as OBS Browser sources (more on those below).

📐 The vertical layout

A phone screen isn’t just a narrow TV. TikTok and YouTube draw their own buttons and chat over the top and bottom of your stream, so the layout has to dodge them:

Top (~10–15%) — covered by your profile name and LIVE badge.
Bottom (~25–30%) — covered by scrolling comments and gifts.
Right edge — covered by the like, share, and gift buttons.

So my vertical canvas (1080×1920) puts the cam near the top (slightly inset so the profile badge doesn’t sit on my face), gameplay or the main action in the middle (the only area that’s reliably clear), and the logo at the bottom, where it’s fine if chat covers it. For karaoke streams, where I’m the content, the cam moves to the middle and gets bigger.

📶 Bitrate

The plugin suggested 6000 kbps for vertical, which sounds like a lot. It’s reasonable for 1080×1920, but remember the vertical stream runs alongside your main stream. The rule I use:

Horizontal bitrate + vertical bitrate should stay under about 75% of your upload speed. If you’re short, drop vertical to 1080×1920 at 30fps and 3500–4000 kbps, or 720×1280 at around 3000. It still looks sharp on a phone.

▶️ YouTube: two stream keys

YouTube can actually build a vertical version for you automatically — it’s on by default and center-crops your widescreen stream. You can switch it to Fit to phone width or Stacked under Live Control Room → Manage → Edit layout. But a center crop chops off anything in the corners, like a facecam. I wanted full control, so I send my own vertical feed:

In YouTube Studio → Live Control Room → Stream, change the vertical preview dropdown from Auto to Encoder.
Pick a second stream key for the vertical feed — it must be different from your horizontal key.
In the Aitum Vertical dock settings → Stream, use server rtmp://a.rtmp.youtube.com/live2 and that second key.

Viewers in the Shorts feed get the vertical version, everyone else gets horizontal, and both share the same live chat. One catch: you have to set this up before you go live — you can’t add the vertical format mid-stream.

🟣 Twitch: Dual Format

Twitch rolled out Dual Format streaming to everyone in June 2026, and it works differently from YouTube. It runs through Twitch’s Enhanced Broadcasting (OBS → Settings → Stream → Multitrack Streaming) together with the Aitum Vertical plugin, and Twitch recommends OBS 32 or newer.

3. What Broke (and How I Fixed It)

This is the part I wish someone had written down before I started.

🐞 Bug: Twitch’s vertical output wouldn’t connect. YouTube worked fine, Twitch just wouldn’t.

✅ Fix: give every output a unique name. I had two outputs both named “Twitch.” The plugin couldn’t tell them apart, so the vertical one failed. Renaming them to “Twitch Main” and “Twitch Vertical” fixed it instantly. Strange bug — easy fix once you know.

🐞 Gotcha: Twitch Dual Format and a YouTube primary. Enhanced Broadcasting is tied to OBS’s main output, and only works when that main output is going to Twitch. My main output is YouTube.

✅ Options: make Twitch the main OBS output (with Enhanced Broadcasting) and send YouTube through extra outputs, or keep YouTube as main and send Twitch horizontal-only through a multistream output.

🐞 Gotcha: “Where’s the Backtrack setting?” Older guides mention a “Backtrack Always On” checkbox. It’s gone.

✅ Fix: Backtrack (Aitum’s instant replay for the vertical canvas — it saves the last 30–60 seconds as a ready-to-post vertical clip) now has a start/stop button right on the Vertical dock. Settings live under the dock’s gear icon → General → Backtrack. It’s optional — the vertical stream works without it, and some people have had vertical streams drop with it running, so get the stream stable first.

🐞 Gotcha: TikTok LIVE Studio doesn’t have “Browser” sources.

✅ Fix: use a Link source with a real web URL (I host my overlay HTML files on my own site). LIVE Studio’s built-in browser is older, can stutter, sometimes loads a Link source at 0×0, and has no refresh button. If that happens, build the scene in OBS, start OBS Virtual Camera, and add it to LIVE Studio as a Camera source instead.

4. The Results

I ran a test SETHaoke stream with the vertical feed going to YouTube. Here’s what the analytics showed:

506views in 48 hours

97.2%from the vertical live feed

97.7%watched on mobile

22peak concurrent viewers

For context: across the previous 90 days, all of my live streams combined got 837 views. One vertical stream pulled more than half of that in two days — and nearly every one of those views came from a feed that a widescreen-only stream can’t even appear in.

Reach: huge win. But then there’s the other half of the story…

Metric	Result	What it means
Total watch time	0.3 hours	About 2 seconds per view
Average concurrent viewers	1	People saw it and swiped on
Chat messages	3	Almost nobody stopped to talk

So the vertical feed is putting me in front of far more people than ever — but they’re deciding in a second or two, and most of them are scrolling past.

5. What I Learned

The vertical feed is a discovery engine, not a living room. It’s the same thing I’ve seen on TikTok LIVE: tons of people pass through, few stay. That’s normal for swipe feeds.
The first 2 seconds are everything. In a feed full of faces, a small cam and a quiet moment get skipped. Dead air between songs is exactly when viewers leave.
Most viewers will never type. I’ve said hello a million times to silent rooms. People scrolling one-thumbed in bed are listening, not chatting — so the stream has to be entertaining with zero chat, like a radio host who assumes the room is full.
Ask for tiny actions, not conversations. “Tap the screen” or “drop a 💙” takes half a second. “Say hi” asks someone to start a conversation. And on TikTok, “send a heart” can sound like asking for a paid gift — taps are the free version.
People scroll with the sound off. If the premise isn’t written on screen, a lot of viewers never find out what the stream is.

6. Where We Go From Here

The fix for the 2-second problem is to make the vertical feed explain itself instantly and give viewers something to do. So I built a set of custom HTML overlays — each one is a single file loaded as an OBS Browser source, styled to match my channel:

Overlay	What it does
🌌 Animated background	Drifting glow, a moving grid, and floating particles to fill empty space behind the cam and gameplay.
🎤 SETHaoke “Now Singing” banner	LIVE badge, the current song and artist (editable live), and a ticker: song requests, “just swiped in? type 💙,” chat picks the next song.
👽 Sims community banner	“Join our community — we’ll create a Sim for YOU!” plus a “Newest resident” shout-out for the viewer whose Sim just moved in.
👆 TikTok tap banner	A big animated “TAP THE SCREEN” with floating hearts and free-action prompts: tap, follow, share.
⏸️ BRB screen	Full-screen “Be Right Back” with an optional countdown and rotating chat prompts, so breaks don’t empty the room. Works on both canvases.

Alongside the overlays, the plan for the next streams:

Bigger face, constant motion on the vertical canvas.
No dead air — fill song transitions with talk, a piano riff, or a sound effect.
Talk to newcomers the way a radio host would, and recap what’s happening every few minutes for people just arriving.
Clip the best moments into Shorts with Backtrack, each one linking back to the full stream.

📊 What I’ll measure in Part 2

YouTube publishes vertical-only stats about 24 hours after a stream. I’m watching two numbers:

Average concurrent viewers — moving from 1 to 3–5 would be real progress.
Watch time per view — moving from ~2 seconds to 10–15 seconds means the hook is working.

If reach stays where it is and those two numbers climb, the swipe-throughs start turning into actual viewers. I’ll post the before-and-after in Part 2.

🎤 Come Be Part of the Experiment

Catch SETHaoke and the Sims 4 series live — on your phone or your big screen, whichever you like. Drop a song request, give us a Sim name and a trait, or just tap the screen to say hi. 💙👽🎂

@SolarBluSeth on YouTube, Twitch, Kick, TikTok, and Instagram.

Custom PHP Development

Seth Is Your Superhero ;$299 One-Page Website

solarbluseth / October 19, 2026

👻 Bury Your Old Website This Halloween!

Is your website stuck in the past, hard to use on a phone, or looking just like everyone else’s? This October, Seth is swooping in to rescue your brand with a beautiful, mobile-friendly website, built to bring you more interested clients.

Reg. $450 $299

🦇 One-Page Website · October Only 🦇

Everything You Need, No Tricks

Custom one-page design built around your brand, logo, and colors
Fully mobile-friendly, so it looks great on phones, tablets, and desktops
Lead/contact form that sends inquiries straight to your inbox
Click-to-call and click-to-email buttons for on-the-go clients
Basic on-page SEO setup so search engines know who you are and where you work
SSL security (the padlock) and connection to your domain
Built on WordPress, so it can grow into a bigger site whenever you’re ready

Real Estate & Insurance Agents: Your Company Page Isn’t Enough

The page your company gave you checks a box, but it isn’t really working for you.

🕸 It looks like everyone else’s Same template, same layout, same stock photos as hundreds of other agents. Nothing shows clients why they should choose you.

🔒 You can’t control it You can’t change the design, add the pages you want, or speak to the clients you want to reach.

🔍 It’s hard to stand out in search Search engines see a pile of near-identical agent pages. Your own site, written around your name, town, and specialty, gives you a real chance to be found.

🏚 It isn’t yours to keep Change companies and that page stays behind. Your own website and domain go wherever your career goes.

Not an agent? This deal is perfect for any small business that needs a fresh, professional online presence: salons, contractors, restaurants, coaches, creators, and more.

🦸 Why Seth Is Your Website Superhero

I’ve been building websites since 1996, more than 6,000 of them. You’re not getting a cookie-cutter template from someone who’ll disappear next month. You’re getting a site built right, by someone who’ll still be here to support it.

Frightfully Frequent Questions

Is the $299 price really only for October?

Yes! The Spooktacular price is available for orders placed by October 31. After that, one-page sites return to regular pricing.

Is hosting included?

Hosting is included in the $299 build. Reliable managed hosting and maintenance plans, including updates, backups, and security, are available separately so your site stays fast and protected.

Can I add more pages later?

Absolutely. Your site is built on WordPress, so we can add pages, a blog, listings, or anything else as your business grows.

I’m a captive insurance agent. Am I allowed to have my own site?

Some companies have rules about personal websites. Check with your company first, and I’ll build your site with the disclaimers and license info your company or state requires.

How long does it take?

Most one-page sites are ready to launch within a couple of weeks once I have your content, logo, and photos.

🎃 Don’t Let This Deal Vanish!

Get your brand-new, mobile-friendly website for just $299. Offer ends October 31.

One-page website build. Offer valid for orders placed by October 31, 2026.

Custom PHP Development

Our Do Not Call Promise

solarbluseth / October 7, 2026

Our Do Not Call Promise

If your number is on the Do Not Call list, SolarBlu.net will not call you. No exceptions, no loopholes, no arguing about whether it’s a business line.

We make outbound calls to local businesses about websites, hosting and internet services. We know how it feels to get a call you didn’t ask for, so here’s exactly how we handle it.

What we do before we ever dial

Every month, as federal law requires, we download the latest National Do Not Call Registry for every area code we call and load it into our own system. That fresh list then gets passed down the line, and every calling list we use is checked against it. Nothing in our pipeline skips that step.

Any number that shows up on the registry comes off our lists that same day. It doesn’t get set aside for later. It gets deleted.

On the list? We don’t call. Period.

Plenty of small business owners list their personal cell on their Facebook page or Google listing. Lots of those cells were put on the Do Not Call list years ago.

Some companies will tell you that a business listing makes it fair game. We don’t play that game. If the number is on the list, we treat it as off-limits, whether it’s a personal line, a business line, or both.

That way, if you ever get a call from us, we can say with certainty that your number was not on the Do Not Call list when we dialed it.

Ask us to stop and we stop

You don’t have to be on any registry to stop hearing from us. Tell whoever calls “please don’t call me again,” and that’s the end of it.

We’ll take you right off the list and move on with our lives. No pushback, no “just one more minute,” and no follow-up call next month.

A tip for business owners: get a business line

If your personal cell is the number on your business listing, you’re mixing two lives on one phone. Customers call it at 9pm on a Sunday, and legitimate companies that follow the rules may never call you at all.

A separate business number fixes both. A free Google Voice number or a cheap second line that rings your cell keeps your personal number private. It also lets you set business hours, and it looks more professional on your website.

We practice what we preach. As a technology company, we answer hosting support calls around the clock, and those calls still come in on a business line, not anyone’s personal cell.

The bottom line

We’d rather lose a lead than make a call we shouldn’t. If you’re on the list, we won’t call. If you ask us to stop, we stop. Questions about how we handle calls? Reach out at solarblu.net and we’ll tell you straight.

Custom PHP Development

Header Glow-Up, Mobile Fixes & a Little Rocket

solarbluseth / October 6, 2026

Dev Log · Advanced Themer 13

Header Glow-Up, Mobile Fixes & a Little Rocket

Today was a big one for Advanced Themer 13. We rebuilt how the header is put together so it can carry a real logo, gave the phone number a proper home, got everything behaving on phones, and added a floating admin launcher for editing on the fly. Oh, and we upgraded to the newest WordPress the same afternoon. No pressure.

October 6, 2026 · WordPress 7.1.2 · Astra 4.13 · SolarBluSeth

Header logo slot

Fixed

Phone placement

3 bugs

Squashed on mobile

7 links

In the Advt Admin menu

7.1.2

WordPress, still compatible

A real logo, right before the title

Header Options now has a Logo field with a Media Library picker and a height slider, plus a live preview at the top of the settings page. Rather than squeezing an extra <img> into the markup, we feed the logo into the theme's own logo slot. That way Astra handles placement, it stays accessible, and it doesn't break on the next theme update.

The trick is that WordPress lets you filter any theme mod on the way out. Here's the general pattern (simplified):

// Point the theme's custom_logo at an image chosen in our own settings.
add_filter( 'theme_mod_custom_logo', function ( $value ) {
    $url = get_option( 'my_plugin_logo' );
    return $url ? attachment_url_to_postid( $url ) : $value;
} );

Docs: theme_mod_{$name} · attachment_url_to_postid() · get_custom_logo

Lesson of the day: "Why won't it save?!"

The first version of the logo field showed up fine but quietly refused to save. The culprit: the new option was registered in an older copy of a settings file that the plugin doesn't actually load anymore. When you post to options.php, WordPress only saves options it knows about through register_setting(). Anything else is dropped without an error. Moral: when a field won't stick, check where it's registered, not just whether it is.

The phone number found its seat

The phone number used to live in a separate row under the menu, where it ended up stranded with odd spacing. Funny thing: adding it to the menu by hand always looked right. So we did the same thing in code. The plugin now adds the phone (and the CTA button) to the end of the primary menu, so it sits in its own slot at the far right with a subtle divider.

add_filter( 'wp_nav_menu_items', function ( $items, $args ) {
    if ( 'primary' !== $args->theme_location ) return $items;
    return $items . '<li class="menu-item my-phone">…</li>';
}, 10, 2 );

Docs: wp_nav_menu_items. It still pulls from the Header Options settings, so editing the number updates desktop and mobile at once.

Mobile: three gremlins, three fixes

The invisible hamburger

CSS

The menu toggle was there the whole time, just drawn in the theme's default blue on top of a dark banner. It now uses the header text and hover colors, so it shows up on any banner.

The "every page ever" menu

MenusFallback

Astra's mobile header uses its own menu location. With nothing assigned there, WordPress fell back to listing every single page on the site, test pages included. Now, if the mobile slot is empty, it mirrors the primary menu automatically, CTA and phone included.

Client Logo

Responsive

A big logo plus a 34px title on a 375px screen meant the site name wrapped one syllable per line. On smaller screens the logo and title now scale down so they fit neatly beside the toggle.

Debugging tip: if a theme seems to ignore your wp_nav_menu_args filter, it may be skipping wp_nav_menu() entirely and calling the fallback itself when has_nav_menu() comes back false. A quick temporary log of the arguments tells you which path you're on. That's what pointed us to the fix.

Meet "Advt Admin"

New this round is a little rocket button pinned to the bottom-right corner of the front end. Tap it and a menu pops up with everything we reach for most:

Edit in place

Edit this page, with the page ID shown right in the label
Edit with Composer (Visual Composer / WPBakery)
Edit with Elementor

Create something new

Add new media
Add new page
Add new post

Polite by design

Only logged-in editors ever see it
Each link checks current_user_can()
Hides inside page-builder previews
Everything opens in a new tab, and Esc closes the menu

It hooks into wp_footer, so it works with any theme, not just Astra. It also politely moves the theme's scroll-to-top arrow out of its way.

Upgrade day: WordPress 7.1.2

We also moved the dev site to the latest WordPress today, mid-sprint, because why not. Advanced Themer 13 loaded cleanly, settings saved, and the header, menus and admin launcher all behaved. We'll keep watching it over the next few days, but so far so good.

WordPress 7.1.2Updated today · running clean

Astra 4.13Header builder · desktop + mobile

Advanced Themer 13Compatible · no errors

Keeping an eye on itReal-world testing continues

Today at a glance

Step 1

Logo field: Media Library picker, height control, live preview, wired into the theme's logo slot.

Step 2

Save bug: tracked down to an option registered in a file that isn't loaded. Moved it to the right place.

Step 3

Phone number: moved from its own row into the menu, in its own slot on the right.

Step 4

Full-width containers: the header and content can now use the whole width of the screen.

Step 5

Mobile: a visible toggle, the real menu, and a title that fits.

Step 6

Advt Admin: the rocket launcher, with Composer and Elementor shortcuts.

Step 7

WordPress 7.1.2: upgraded, tested, still compatible.

More soon. Advanced Themer keeps getting better one dev log at a time.
Built with , WordPress hooks, and stubbornness by SolarBluSeth.