@lfwdotcom

Your web agency of record. Built for governments, embassies, associations and advocacy groups. We manage, secure and modernize websites.

 Arlington, VA
lfw.com
Joined January 2025
  • Tweets33
  • Following23
  • Followers16
8Media
Week six at LFW: we're hyperfocusing on public institutions, and the new LFW website that reflects this new focus is live is live. Also: LFW Academy (free courses for people who run public websites), 11 proposals out, and 4 rejections. lfw.com/blog/this-week-at-lf…

Week six: LFW hyperfocuses on public institutions, and the new LFW.com is live · LFW

After five weeks of bidding on government contracts, LFW is hyperfocusing on public institutions. The new LFW.com and LFW Academy are live, and eleven…

lfw.com
4
52
LFW.com wasn't affected by today's PHP security issue. Node.js also shipped a fix this morning. Our server ran an affected version, so we updated the same day and found no sign of exploitation. lfw.com/blog/nodejs-brotli-c…

LFW · Your web agency of record

LFW is the web agency of record for governments, associations, and nonprofits: changes, updates, security patches, and daily checks for one monthly fee.

lfw.com
1
1
282
more replies
After updating, we checked the window it was open: what the server fetched, crashes, logins, new files, traffic. Nothing unusual. No attacks or public exploit had been reported either.
1
26
If you run Node.js: update to 22.23.4, 24.22.1 or 26.12.1. Start with anything that fetches outside content: link checkers, feed readers, webhooks. Stay vigilant out there.
40
Your sites are already protected against the recently disclosed PHP security issues. Automattic worked closely with the PHP Security team to ensure that all sites hosted on our platform were protected as soon as possible. There’s nothing our customers need to do. Really. Back to your regularly scheduled coffee. bit.ly/4hVzO82

Pressable-Powered Sites Protected Against Critical PHP Vulnerabilities

The PHP project has released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that could allow unauthenticated remote code execution. See the PHP security advisory for d…

pressablestatus.com
4
10
3
72
48,768
LFW retweeted
NCSC UK
@NCSCOct 21
The NCSC is encouraging UK organisations to prepare for immediate updating of systems using PHP. Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated. For more⬇️ ncsc.gov.uk/news/critical-se…

Critical security issue affecting PHP

Updated: The NCSC is encouraging UK organisations to take immediate action to mitigate a security issue affecting PHP (CVE-2026-109618 and CVE-2026-109619).

ncsc.gov.uk
82
903
211
3,447
1,035,873
PHP released its security fix this morning, ahead of schedule: update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Now that the fix and its details are public, attackers can work backward from it, so the next few days matter most. We've updated our post: lfw.com/blog/php-security-re…

PHP's security release today: what we checked, and what we'd do · LFW

PHP ships a security release today for two vulnerabilities rated 9.2. What we checked on our own servers, what we found, and the steps we'd take on a site that…

lfw.com
1
1
129
LFW retweeted
Laravel
@laravelOct 21
At 14:00 UTC two critical security vulnerabilities will be patched in PHP. These are extremely serious vulnerabilities affecting every PHP application on the web. Laravel Cloud customers: we will begin automatically patching your applications as soon as the patch is released. No manual action is required. Laravel Forge customers: you will need to manually update your server’s PHP version via the server’s Forge dashboard. If you are unable to update your server, it should be powered down. Laravel Vapor customers: we will begin automatically re-deploying applications running on PHP 8 as soon as the patch is released. No patch is being released for PHP 7 -- immediately update all applications to PHP 8.
38
274
40
1,315
176,088
PHP ships a security release today for two critical vulnerabilities, both rated 9.2. We checked our own setup this morning. LFW.com doesn't run PHP, but we found a containerized WordPress demo we'd stopped weeks ago and never removed. It's gone now. (1/6)
LFW graphic, October 21, 2026, on a blue background. Headline: "LFW's response to the PHP security issue." LFW.com: not affected, no PHP runs on LFW's servers. What we found: a containerized WordPress demo we stopped weeks ago and never removed, gone now. What we recommend: find every PHP site you own, including the forgotten ones; patch them today, with a firewall in front until then. Footer: CVE-2026-109618 and CVE-2026-109619, rated 9.2 by the PHP security team. lfw.com.

ALT LFW graphic, October 21, 2026, on a blue background. Headline: "LFW's response to the PHP security issue." LFW.com: not affected, no PHP runs on LFW's servers. What we found: a containerized WordPress demo we stopped weeks ago and never removed, gone now. What we recommend: find every PHP site you own, including the forgotten ones; patch them today, with a firewall in front until then. Footer: CVE-2026-109618 and CVE-2026-109619, rated 9.2 by the PHP security team. lfw.com.

1
1
4
682
more replies
Some say to take the server down until it's patched. Given the reported severity, not bad advice, even if it feels overzealous. But the server going down doesn't have to take the site with it: a read-only copy, static pages with no PHP, can stay up while you patch. (5/6)
1
1
73
If you'd like a hand with any of it, we're glad to help. (6/6)
21
LFW has submitted its first French-language proposal, for a French commune's new website. LFW's founder studied French for years, but conversational fluency is still a work in progress. That's where Google Meet's live translation comes in during training calls.
Screenshot of a deposit receipt on marches-securises.fr, a French public tender platform, logged in as LFW.com LLC. It reads "Accusé de réception de votre réponse… Votre réponse a été reçue, lundi 19 octobre 2026 - 19:48:41" (your response has been received, Monday, October 19, 2026, 7:48 PM Eastern). The buyer's details and the file name are blacked out.

ALT Screenshot of a deposit receipt on marches-securises.fr, a French public tender platform, logged in as LFW.com LLC. It reads "Accusé de réception de votre réponse… Votre réponse a été reçue, lundi 19 octobre 2026 - 19:48:41" (your response has been received, Monday, October 19, 2026, 7:48 PM Eastern). The buyer's details and the file name are blacked out.

5
78
Week five: LFW's website in Italian, one forms guide with live examples, four proposals out, and registrations in Australia, Norway and the UK. Also: a chamber RFP drew 65 proposals this year, up from 5. lfw.com/blog/this-week-at-lf…

Week five: LFW.com in Italian, a forms guide with live examples, and registrations in Australia,...

LFW.com now reads in Italian, the eight-part forms series became one guide with working examples, four proposals went out (two of them abroad), and LFW…

lfw.com
1
36
An RFP we're bidding on rules out copyleft licences. No GPL means no WordPress or Drupal. We love GPL software. WordPress and Drupal are our bread and butter. But LFW's web capability knows no bounds. We build in Astro and Laravel too, both MIT-licensed. Our site runs on Astro.
Quoted text from an RFP clarification: "The intention is to prohibit software under reciprocal/copyleft licences (e.g. GPL, AGPL, LGPL…), not permissively-licensed open-source components (e.g. MIT, Apache 2.0, BSD)."

ALT Quoted text from an RFP clarification: "The intention is to prohibit software under reciprocal/copyleft licences (e.g. GPL, AGPL, LGPL…), not permissively-licensed open-source components (e.g. MIT, Apache 2.0, BSD)."

1
1
3
502
LFW now holds a satisfactory Statement of Tax Record from the Australian Taxation Office, which Australian Government tenders over A$4M require.
53
LFW is now registered on the UK government's Central Digital Platform (PPON PNNL-8598-DTXN). That means we can bid on public sector website contracts in England, Wales and Northern Ireland.
2
49
Load more