Litewire on Luther Monson

Security and Performance Hardening of a Rust Database Proxy

Thu, 27 Aug 2026 20:30:00 -0700

litewire is the piece of ePHPm that lets PHP apps talk MySQL to a SQLite file. I wrote about how it works and about the MySQL quirks WordPress depends on. This one is the less visible half of August:

an audit pass on litewire
a multi-tenant mode that turned a database proxy into a security boundary
a performance regression I shipped and then had to go find

It’s written in Rust. Memory safety is supposed to be the part I don’t have to think about, and it mostly is. The use-after-free in this story was in a dependency. The worst bug wasn’t a memory bug at all.

Faking MySQL's Quirks Well Enough to Fool WordPress

Sun, 16 Aug 2026 15:50:00 -0700

Last month I wrote about running SQLite behind a MySQL socket with litewire. I ended on “passing an install suite is not the same thing as behaving like MySQL”. That turned out to be accurate. On August 10th a few things happened at once:

I put a real WordPress 7.0.3 site through a benchmark on ePHPm.
I A/B tested the new in-process database bridge against the wire path.
I started building ephpm/db-wordpress, a wpdb drop-in that talks to the database in-process instead of over a socket.

Between them they produced six litewire issues in about three hours. None of them broke the install. All of them made WordPress quietly do the wrong thing.

SQLite as a Production Database via Protocol Translation

Sat, 25 Jul 2026 20:40:00 -0700

Most of the PHP sites I’d put on ePHPm don’t need a MySQL server. A brochure WordPress, an internal Laravel tool, a preview environment that lives for an afternoon. What they do need is something that looks like MySQL, because mysqli and pdo_mysql are the only database drivers their code has ever been pointed at. I mentioned this in the ePHPm pragmatism post as a one-paragraph “because”. This is the longer version, now that WordPress 7.0 and Laravel 13 both install and run end to end on it.