Mysql on Luther Monson

Security and Performance Hardening of a Rust Database Proxy

Thu, 27 Aug 2026 20:30:00 -0700

litewire is the piece of ePHPm that lets PHP apps talk MySQL to a SQLite file. I wrote about how it works and about the MySQL quirks WordPress depends on. This one is the less visible half of August:

an audit pass on litewire
a multi-tenant mode that turned a database proxy into a security boundary
a performance regression I shipped and then had to go find

It’s written in Rust. Memory safety is supposed to be the part I don’t have to think about, and it mostly is. The use-after-free in this story was in a dependency. The worst bug wasn’t a memory bug at all.

Faking MySQL's Quirks Well Enough to Fool WordPress

Sun, 16 Aug 2026 15:50:00 -0700

Last month I wrote about running SQLite behind a MySQL socket with litewire. I ended on “passing an install suite is not the same thing as behaving like MySQL”. That turned out to be accurate. On August 10th a few things happened at once:

I put a real WordPress 7.0.3 site through a benchmark on ePHPm.
I A/B tested the new in-process database bridge against the wire path.
I started building ephpm/db-wordpress, a wpdb drop-in that talks to the database in-process instead of over a socket.

Between them they produced six litewire issues in about three hours. None of them broke the install. All of them made WordPress quietly do the wrong thing.

Database Connection Pooling with Smart Reset

Sun, 09 Aug 2026 16:25:00 -0700

PHP’s share-nothing model is one of its best properties. It has one expensive side effect: a request can’t keep a database connection for the next request. php-fpm gives you PDO::ATTR_PERSISTENT and mysqli’s p: hosts. But those are per-worker-process. PDO’s keep whatever session state the last request left behind. mysqli at least resets the session with COM_CHANGE_USER on reuse. And almost nobody turns them on. So in practice every PHP request does a TCP connect, a MySQL handshake and an auth exchange. Then it maybe sends some SETs, runs its queries and sends COM_QUIT. Multiply that by your request rate and MySQL spends a real share of its time authenticating clients it just said goodbye to.

SQLite as a Production Database via Protocol Translation

Sat, 25 Jul 2026 20:40:00 -0700

Most of the PHP sites I’d put on ePHPm don’t need a MySQL server. A brochure WordPress, an internal Laravel tool, a preview environment that lives for an afternoon. What they do need is something that looks like MySQL, because mysqli and pdo_mysql are the only database drivers their code has ever been pointed at. I mentioned this in the ePHPm pragmatism post as a one-paragraph “because”. This is the longer version, now that WordPress 7.0 and Laravel 13 both install and run end to end on it.