A PHP vulnerability with a CVSS score of 9.2 that lets anyone execute code remotely without even logging in — and the official fix only covers 8.2 through 8.5. My server runs 5.6, which has no patch and no backport. This morning I only wanted to confirm how badly I was affected. But one thing led to another, and I ended up giving the site legacy — stacked up and steadily gaining entropy for over a decade — a thorough slimming down.

Not long ago I switched from LAMP to WIMP (windows2k3+iis6+mysql5.2+php5.2), and WordPress lost two important features: one is permalinks (static URLs), and the other is email sending. I’ve just perfectly solved the permalink problem, so I’ll share the method. (A so-called permalink is something like http://www.flashj.cn/wp/wimp-wordpress-permalink.html这样的格式) Because Windows doesn’t support .htaccess, to do rewrite you need to download an ISAPI_Rewrite component to implement rewriting. I tried it, and personally I didn’t find the result very ideal.