The Drupal project has announced a critical security vulnerability in the currently supported versions of the popular CMS: Drupal 7 and 8 (as well as v6). The announcement on the main Drupal site details the issues and provides a link to an FAQ with more detail about the issue.

A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being completely compromised.

[...] Drupal 8, 7, and 6 sites are affected. According to the Drupal project usage information this represents over one million sites or about 9% of sites that are running a known CMS according to Builtwith.

The issue could allow an attacker to take full control of the application and execute whatever code they'd want to on the server. They recommend upgrading immediately to safeguard your Drupal application. They also provide links to a guide on what to do if you are hacked and to the Drupal 6 patch (as well as steps you can take if you can't upgrade).

On the Cloudways blog there's a new post from author Saquib Rizwan that compares two of the most popular Laravel-based content management systems: OctoberCMS VS AsgardCMS.

Web developers and development agencies around the world love rapid application development. To keep up with the fast pace of development and fulfill client requirements within the deadline, developers often use a CMS. Popular CMS options available today include WordPress, Drupal, Joomla, and Magento. There are times when these established players are not up to the task. In such scenarios, developers often need a flexible and customizable CMS that are often created using the Laravel framework.

In this article, I will compare OctoberCMS and AsgardCMS, the top two Laravel powered CMS.

The article starts with a brief overview of each, describing some background and how their architected. It then lists some of the requirements for each, installation methods, GitHub "profile" and the basic features offered. It then gets into the comparison, sharing some of the pros and cons for each CMS. There's no "winner" in the article as it's just designed to compare.

The SitePoint PHP blog has a new tutorial posted by editor Bruno Skvorc showing you how to set up an online multi-language magazine with the help of the Sulu CMS. This article is a follow up to their previous "Getting Started" tutorial helping you get Sulu up and running.

We previously demonstrated the proper way to get started with Sulu CMS by setting up a Hello World installation on a Vagrant machine. Simple stuff, but can be tricky.

[...] This time we’ll look into basic Sulu terminology, explain how content is formed, created, stored, and cached, and look into building a simple online magazine with different locales (languages).

The tutorial then covers pages and page templates including what the Twig markup looks like, how to work with them in the UI and the end result of their sample "Hello world" page. There's a brief section about caching before he moves into the main part of the tutorial: the creation of the magazine. He covers the use of Jackalope, ElasticSearch and the ArticleBundle and how to get them up, running and playing nicely together. The article wraps up with a look at locales and how they work in the Sulu setup.

On the Symfony Finland site they've post together a post sharing some benchmark results of Symfony on PHP 7.0 versus 7.1, the most recent major release of the PHP language with some improvements of its own.

PHP 7.1 was launched on December 1st 2016. This was the first minor release after the release of 7.0 a year ago. PHP 7.0 was a revolutionary product, especially when it comes to memory usage and performance. PHP 7.1 is a more modest upgrade that brings new features and improved performance. But how much has performance improved from a year back?

The benchmarking uses the eZ Platform demo running a full CMS similar to the previous benchmarking done in 2015. The checks were run using:

• a "clean" environment (no caching, PHP-FPM just restarted and no APC cache)
• standard requests running in development mode
• more requests but this time in production mode

The post shares the results with a few graphs showing them in terms of response time for both sequential and concurrent page requests.

On the TutsPlus.com site there's a new tutorial posted walking you through the [creation of a flat file CMS] in PHP. It's a simple Slim framework based application that allows the creation of basic pages with a header, footer and sidebar (as well as handling 404s and errors).

In the past tutorials, I have shown you how to create a flat file system content management system (CMS) using Go, Node.js, and Ruby.

In this tutorial, I am going to take the same design model and build a server using PHP. Since PHP isn’t a server by itself, but is usually paired with the Apache web server, I will show you how to set up the Apache web server inside a Vagrant virtual system.

He starts by helping you get the necessary libraries installed via Composer including the parsedown, lightcandy and Slim framework packages. From there it's into the code making:

• the front controller to define routes and set up an error handler
• defining the different templates (header, footer, etc)
• definition of "shortcodes"
• handling page processing (rendering the content into output)

The tutorial finishes off with the details on getting the server up and running: creating a Vagrant instance with Apache and PHP 5 installed and working together and serving code from a shared folder.

On the SitePoint PHP blog author Bruno Skvorc continues his series about using the Grav flat-file CMS to create fast, simple sites. In his previous post he talked about the use of various "must have plugins". In this latest post he focuses more on some "tweaks" you can make to prepare your site for higher load.

We previously looked at some essential Grav plugins with which to round off the installation of a personal blog. In this post, we’ll take a look at some additional, advanced plugins, rounding it all off with an installation of Varnish for supercaching, taking performance to a whole new level.

His list of "tweaks" (and other plugins) that are recommended for a more robust site are:

• The "Related Pages" plugin
• An "assets" plugin for custom JS and CSS without extending the theme
• Simple search handling
• Comments on the content with the JsComments plugin
• Image Optimization and CDNs
• Caching with Varnish

All but the last item on the list are plugins you can drop in and configure pretty easily. Varnish requires a little extra setup, however, as it's an external service/software that needs to be running in front of your web server to do its job.

On the SitePoint.com site's "Web" category they're posted a tutorial showing off an interesting piece of software that helps make automated installs of CMS/frameworks easy: a simple bash script tool called Please.

If you’re a web developer, possibly one of your most boring and repetitive tasks is the configuration of the basic setup for every new project. Configuring your my-project.dev domain, creating the database, installing WordPress (or any other CMS/Framework) for the thousandth time: you already know how to do it. What if you could automate all of that?

Well, actually, you can. Please is a simple bash script that helps to automate the installations of many CMSs and Frameworks by configuring them automatically into your Vagrant box, adding a development domain name into your host file, and even a database if needed.

They start off by helping you get a Vagrant box up and running to use for the Please handling. You then clone the Please repository locally and can use the command line tool to set up the process for multiple CMS/framework types including WordPress, Laravel and React. There's also a section covering the creation of your own environment if you need something more custom. Please is currently in beta at the time of this post so be aware that there may still be issues that need resolving before it becomes stable.

On the Symfony Finland site there's a new article posted about the recently released v3.0 of the Bolt CMS and details about this Silex-powered, modern PHP-based system.

On Tuesday 10th of May the development team released a new major version of Bolt CMS. The Open Source content management system is a lightweight and easy to use tool for managing websites and blogs. In addition it's perfect for learning modern PHP development practises.

The third major version of Bolt continues on the path, being an evolution rather than a revolution. The CMS is built on the Silex microframework based on the Symfony PHP components.

The article talks about the "solid foundation" of Silex and good project management skills of the team behind it. They then get into the installation of the tool and some of the libraries that it uses to get the job done (including Twig and YAML handling). They also list some of the things that are new in the v3.0 of the CMS including:

• A new extensible Storage layer
• Backend UI refresh
• Improved tests / code coverage
• New documentation
• Web asset queues, and easier to keep files out of webroot

There's also mention of some of the things that were removed and didn't make the cut to be included in the release. The post ends with links to other resources where you can find out about Bolt, get its source and a few other articles about people putting it to use.

On the SitePoint PHP blog there's a post from Bruno Skvorc introducing the Pagekit CMS, a content management system that's "clean, extensible and fast" (but it does come with some caveats).

Pagekit hit version 1 recently, and as I’d been looking at personal blogging engines, I thought it’d only be fair to check it out. Granted, blogging is merely a subset of the functionality Pagekit can offer, but a good basic test-drive subset nonetheless.

He walks you through the installation and configuration of a new Pagekit-based site using their own installer script (after downloading it from their site). He then goes through some of the basic features of the CMS including native Markdown support, how the editor looks and how the results render. He includes a guide on setting up a blog too using a "blog" plugin and an extension to add in better syntax highlighting. He also looks at other features of the CMS including custom layouts and "pretty" URL support. He points out some security changes you'll want to make out of the box to protect sensitive files and briefly touches on deploying the site to production and links to their own guide for additional help.

On the Tighten.co blog they've posted their own review of Statamic, the flat-file based content management system with a Laravel backend. Statamic is a project that hopes to provide easy content management, responsive layouts and plenty of features to make an easy-to-use and robust CMS.

Among the developers I know who used to use ExpressionEngine but have since left, most work in Craft and/or Laravel. I kept hearing folks mention Statamic, but all I knew about it was that it was flat file, which wasn't particularly compelling to me.

Fast forward two years, and they've re-written the entire application to run on Laravel (now released as v2 beta). [...] Their documentation is hilarious, the community is welcoming and helpful, and the code—granted, I'm only a few weeks in—seems super easy to work with. So, what's the deal? Why have we set up Tighten's blog on Statamic?

The post then goes on to talk about the "quest" for a good Laravel-based content management system. They also talk about some of the essentials they see a CMS needing to be effective: good user interaction (UI/UX), how much and how difficult it is to customize and how it is configured. For each point they talk about how Statamic does things and their own verdict on the software and how good it does at filling these requirements.