DEV Community: Arelvox

e.key vs e.code: Why Your WASD Controls Break on AZERTY (and How I Built a Keyboard Tester)

Arelvox — Wed, 04 Nov 2026 14:00:00 +0000

If you have ever built keyboard shortcuts or a game in the browser, you have probably used e.key. Then someone with a French or German keyboard tells you your WASD controls are broken. The fix is one property you may not be using: e.code. Here is the difference, and what I learned building a keyboard tester.

👉 Live demo: arelvox.com/keyboard-tester

key vs code vs keyCode

Press the key to the right of Tab on three different layouts:

Layout	`e.key`	`e.code`	`e.keyCode`
US (QWERTY)	`q`	`KeyQ`	81
French (AZERTY)	`a`	`KeyQ`	65
German (QWERTZ)	`q`	`KeyQ`	81

e.key is the character the key produces. It depends on the layout, Shift, Caps Lock and so on.
e.code is the physical position of the key, named after the US layout. It never changes with the layout.
e.keyCode is deprecated and inconsistent between browsers. Avoid it in new code.

Rule of thumb

Typing text, shortcuts that show a letter in the UI (like Ctrl+S): use e.key.
Game controls and anything about where the key is (WASD, a keyboard tester): use e.code.

document.addEventListener('keydown', function (e) {
  if (e.code === 'KeyW') moveUp();   // works on AZERTY too (it is the Z key there)
});

Building a keyboard tester

A keyboard tester is a nice exercise because it forces you to use e.code. Each key on the virtual keyboard has its code as a data attribute:

var ROWS = [
  [['Escape', 'Esc'], ['F1', 'F1'], /* ... */],
  [['Backquote', '`'], ['Digit1', '1'], /* ... */ ['Backspace', 'Backspace', 2]],
  // [code, label, width]
];

On keydown, I look up the element by code and mark it as tested:

document.addEventListener('keydown', function (e) {
  e.preventDefault();                       // stop Tab, Space, arrows from scrolling
  var el = root.querySelector('[data-c="' + e.code + '"]');
  if (el) el.className = 'key done down';
});

document.addEventListener('keyup', function (e) {
  var el = root.querySelector('[data-c="' + e.code + '"]');
  if (el) el.className = 'key done';
});

Gotchas I hit

1. Left and right modifiers are different codes. ShiftLeft and ShiftRight, ControlLeft and ControlRight, AltLeft and AltRight. Great for a tester, but remember it if you check e.code === 'ShiftLeft' and the user presses the right one.

2. Some keys never reach the page. Fn is handled inside the keyboard itself, so no website can detect it. Print Screen, media keys and some Windows key combinations are often eaten by the operating system. A tester should say so, or people think their key is broken.

3. Stuck "pressed" keys after Alt+Tab. If the window loses focus while a key is down, you never get the keyup. Clear the pressed state on blur:

window.addEventListener('blur', function () {
  root.querySelectorAll('.key.down').forEach(function (k) { k.className = 'key done'; });
});

4. Do not block F5 and F12. Calling preventDefault() on everything also blocks refresh and dev tools, which annoys people. Let those through.

5. Ghosting is a hardware limit. If you press several keys at once and some never fire, that is the keyboard's rollover limit, not a bug in your code. Cheap keyboards often fail on combinations like A+S+D+F. It is a fun thing to test.

Try it

Press every key and see which ones work: Keyboard tester →. It shows key, code and keyCode live, so it is also handy when you are debugging shortcuts.

Build a Microphone Level Meter in JavaScript with the Web Audio API

Arelvox — Mon, 02 Nov 2026 14:00:00 +0000

Every video call app has a little bar that jumps when you talk. It looks like magic, but the browser gives you everything you need in about 15 lines of JavaScript with the Web Audio API. Here is how a microphone level meter works, plus the error handling that makes it usable for real people.

👉 Live demo: arelvox.com/mic-test

1. Ask for the microphone

navigator.mediaDevices.getUserMedia({ audio: true })
  .then(start)
  .catch(showError);

The browser shows its permission prompt. Note that getUserMedia only works on HTTPS (or localhost), so test it on a secure page.

2. Connect it to an AnalyserNode

You do not need to record anything. An AnalyserNode gives you a live snapshot of the waveform on every frame:

function start(stream) {
  var ac = new (window.AudioContext || window.webkitAudioContext)();
  var src = ac.createMediaStreamSource(stream);
  var an = ac.createAnalyser();
  an.fftSize = 2048;
  src.connect(an);          // note: NOT connected to ac.destination, so no echo
  draw(an);
}

Not connecting the analyser to ac.destination matters: if you do, people hear themselves with a delay, which is horrible.

3. Turn the waveform into a volume level

getByteTimeDomainData fills an array with values from 0 to 255, where 128 is silence. The usual way to get "loudness" is the RMS (root mean square):

function level(an) {
  var buf = new Uint8Array(an.fftSize);
  an.getByteTimeDomainData(buf);
  var sum = 0;
  for (var i = 0; i < buf.length; i++) {
    var v = (buf[i] - 128) / 128;   // -1 .. 1
    sum += v * v;
  }
  return Math.sqrt(sum / buf.length);   // 0 .. ~1
}

Normal speech gives a small RMS (around 0.05 to 0.2), so I multiply by 300 and clamp to 100 to get a meter that actually moves:

var pct = Math.min(100, Math.round(level(an) * 300));
meter.style.width = pct + '%';

4. Draw the waveform

The same buffer draws a nice line on a canvas:

ctx.beginPath();
for (var x = 0; x < W; x++) {
  var s = buf[Math.floor(x / W * buf.length)];
  var y = (s / 255) * H;
  x === 0 ? ctx.moveTo(x, y) : ctx.lineTo(x, y);
}
ctx.stroke();

Call it from requestAnimationFrame and you have a live oscilloscope.

5. The part that actually helps users: errors

Most people who search "mic test" have a problem. The error name from getUserMedia tells you what to say:

`err.name`	What happened	What to tell the user
`NotAllowedError`	Permission blocked	Click the lock icon in the address bar and allow the microphone
`NotFoundError`	No input device	Plug in a mic or headset
`NotReadableError`	Device busy	Close Zoom, Teams or Discord and try again

A friendly message for each case turns a confusing failure into a fix.

6. Let people choose the microphone

Once permission is granted, enumerateDevices() returns real device labels, so you can show a dropdown:

navigator.mediaDevices.enumerateDevices().then(function (ds) {
  var mics = ds.filter(function (d) { return d.kind === 'audioinput'; });
  // build <option value="deviceId">label</option> for each
});

Then restart with { audio: { deviceId: { exact: id } } }.

7. Clean up

Always stop the tracks when the user clicks Stop or leaves, or the browser keeps showing the red "recording" dot:

stream.getTracks().forEach(function (t) { t.stop(); });
ac.close();

Try it

The full version, with the waveform, peak level and device picker, is here: Microphone test →. Nothing is recorded or uploaded; it all runs in the browser.

I also made a webcam test with the same idea, which reads the real resolution and measures FPS with requestVideoFrameCallback.

How Daily Puzzles Give Everyone the Same Answer Without a Server (Seeded RNG in JS)

Arelvox — Sat, 31 Oct 2026 14:00:00 +0000

Daily puzzles like Wordle have a neat trick: everyone in the world gets the same answer, yet there is no server deciding it. I used the same idea for Crack the Code, a daily number puzzle where you guess a secret 4-digit code in six tries. Here are the three pieces that make it work, all in plain JavaScript.

👉 Today's puzzle: arelvox.com/crack-the-code

1. Same code for everyone, no backend

The trick is a seeded random number generator. If everyone uses the same seed, everyone gets the same "random" numbers. The seed is just the day number:

var EPOCH = Date.UTC(2026, 9, 25);   // puzzle #1

function dayNum() {
  var n = new Date();
  var today = Date.UTC(n.getFullYear(), n.getMonth(), n.getDate());
  return Math.floor((today - EPOCH) / 86400000) + 1;
}

Notice that it builds the date from the local year, month and day. That way the new puzzle arrives at midnight in your own time zone, not at midnight UTC.

For the generator itself, a tiny linear congruential generator is enough. It is not secure, but a puzzle doesn't need that:

function seeded(seed) {
  return function () {
    seed = (seed * 1664525 + 1013904223) % 4294967296;
    return seed / 4294967296;
  };
}

function makeCode(rnd, len) {
  var c = '';
  for (var i = 0; i < len; i++) c += Math.floor(rnd() * 10);
  return c;
}

var code = makeCode(seeded(dayNum() * 7919 + 12345), 4);

Multiplying by a prime and adding an offset stops neighbouring days from producing similar first numbers. Math.random() could never do this, because you cannot seed it.

2. Scoring guesses when digits repeat

Codes can contain the same digit twice, like 0277. That is where a naive scorer breaks. If the code is 0277 and you guess 7777, how many yellows should you get? The answer is zero: two sevens are green, and there are no sevens left over for the other positions.

The fix is two passes. First mark the exact matches and count what is left over in the code. Then hand out yellows only from that leftover pool:

function score(guess, code) {
  var res = [], left = {}, i;

  // pass 1: greens, and count unmatched digits in the code
  for (i = 0; i < code.length; i++) {
    if (guess[i] === code[i]) res[i] = 'g';
    else left[code[i]] = (left[code[i]] || 0) + 1;
  }

  // pass 2: yellows, only while that digit is still available
  for (i = 0; i < code.length; i++) {
    if (res[i]) continue;
    if (left[guess[i]] > 0) { res[i] = 'y'; left[guess[i]]--; }
    else res[i] = 'x';
  }
  return res;
}

This is the same algorithm Wordle uses for repeated letters.

3. Share the result without spoiling it

The share button turns your guesses into colored squares, so friends see how you did but not the code:

var map = { g: '🟩', y: '🟨', x: '⬛' };
var grid = results.map(function (r) {
  return r.map(function (c) { return map[c]; }).join('');
}).join('\n');

var text = 'Crack the Code #' + day + ' ' + tries + '/6\n' + grid;
navigator.share ? navigator.share({ text: text }) : navigator.clipboard.writeText(text);

The problem: it was too easy

People finished the daily code almost every time, then left. Ten thousand possible codes sounds like a lot, but with six tries and good feedback, a sensible strategy (try 1234, then 5678) solves most days in four.

So I added a Time Attack mode for players who want more:

You start with 90 seconds. Each cracked code adds time, more if you used fewer tries.
A failed code costs 15 seconds.
Tries drop from 6 to 4 as you level up, and codes grow to 5 and then 6 digits.
Fast solves build a combo multiplier up to x5.
Every third code earns a power-up: reveal a digit, remove digits that aren't in the code, or freeze the clock.

The daily puzzle is still the hook, but the clock is what keeps people playing "just one more".

Try it

What's your best strategy for the first two guesses? Let me know in the comments, and see how many codes you can crack before the clock runs out.

Play Crack the Code →

There are more free browser games on the same site, including a one-tap stacking game: arelvox.com/games.

How to Automate Tasks on Linux with Cron Jobs: A Beginner’s Guide

Arelvox — Thu, 29 Oct 2026 08:00:00 +0000

Originally published on Arelvox.

Do you find yourself running the same commands every day? Backing up files, cleaning temporary folders, or restarting a service? With cron jobs on Linux, you can schedule all of that to run automatically, without lifting a finger. In this guide, you’ll learn what cron is, how to read its syntax, and how to create your first scheduled tasks.

What Are Cron Jobs?

Cron is a background service (a daemon) that runs commands at times you define. Each user has a file called a crontab (cron table) that lists the tasks to run and when. Once a task is in your crontab, Linux takes care of the rest, even if you’re not logged in.

Cron is available on practically every Linux distribution, including Raspberry Pi OS, Ubuntu, and Debian, which makes it perfect for home servers and small projects.

Each scheduled task in your crontab is called a cron job, and you can create as many cron jobs as you need.

Example 1: Run Nightly Backups with Cron Jobs

To edit your personal crontab, open a terminal and run:

crontab -e

The first time, you may be asked to choose a text editor. If you’re a beginner, nano is the easiest option.

To see the tasks you already have scheduled:

crontab -l

This is where all your cron jobs live, so you’ll come back to this command often.

Cron Jobs Syntax Explained

Every line in a crontab has five time fields followed by the command:

* * * * * command_to_run
│ │ │ │ │
│ │ │ │ └── Day of the week (0-7, Sunday is 0 or 7)
│ │ │ └──── Month (1-12)
│ │ └────── Day of the month (1-31)
│ └──────── Hour (0-23)
└────────── Minute (0-59)

An asterisk (*) means “every”. Here are some examples:

Schedule	Meaning
* * * * *	Every minute
0 * * * *	Every hour, on the hour
30 2 * * *	Every day at 2:30 AM
0 9 * * 1	Every Monday at 9:00 AM
0 0 1 * *	The first day of every month at midnight
/10 * * *	Every 10 minutes

Cron also supports handy shortcuts such as @reboot (run once at startup), @daily, @weekly, and @monthly.

Once you understand these five fields, you can schedule any of your cron jobs in seconds.

For the full technical reference, see the official crontab manual page.

Example 1: Run Nightly Backups with Cron Jobs

Backups are one of the most popular cron jobs, and also one of the easiest to set up. Imagine you have a script called backup.sh in your home folder. To run it every day at 3:00 AM, add this line to your crontab:

0 3 * * * /home/user/backup.sh

Don’t forget to make the script executable first:

chmod +x /home/user/backup.sh

Example 2: Save the Output to a Log File

By default, cron doesn’t show you what a command printed. To keep a record of the results (and any errors), redirect the output to a file:

0 3 * * * /home/user/backup.sh >> /home/user/backup.log 2>&1

Here, >> appends the output to the log, and 2>&1 sends error messages to the same place. This is the single most useful habit when debugging cron jobs.

Example 3: Run a Command at Startup

Want something to start every time your Raspberry Pi boots? Use @reboot:

@reboot /home/user/start_server.sh

Startup tasks like this are some of the most useful cron jobs for a home server.

Example 4: Clean Temporary Files Weekly

This job deletes files older than 7 days from a temporary folder every Sunday at 4:00 AM:

0 4 * * 0 find /home/user/tmp -type f -mtime +7 -delete

Always test a find ... -delete command without -delete first, so you can check which files it would remove.

Maintenance tasks like this are ideal cron jobs, since you set them once and forget about them.

Common Cron Jobs Mistakes to Avoid

1. Using relative paths. Cron runs with a minimal environment, so always use full paths (/home/user/script.sh, not ./script.sh). You can find the full path of a program with which python3, for example.

2. Forgetting to make the script executable. If the script lacks permissions, cron will silently fail. Use chmod +x.

3. Wrong time zone. Cron uses the system’s time zone. Check it with the date command if tasks run at unexpected hours.

4. Not checking the logs. If a job doesn’t work, look at the system log:

grep CRON /var/log/syslog

On some systems you can use journalctl -u cron instead.

5. Editing the wrong crontab. crontab -e edits your user’s crontab. System-wide tasks that need root privileges belong in sudo crontab -e.

A Helpful Tool: Crontab Guru

If the syntax feels confusing, the website crontab.guru translates any cron expression into plain English. Paste in */15 9-17 * * 1-5 and it will tell you: “Every 15 minutes, between 9:00 and 17:59, Monday through Friday.”

Cron vs. Systemd Timers

Modern Linux systems also offer systemd timers, which are more flexible and integrate with system logs. However, cron is simpler, works everywhere, and cron jobs are more than enough for most personal projects. Start with cron, and explore timers later if you need more control.

Tip: a script must be executable before cron can run it. Use our free chmod calculator to pick the right permissions, such as 755 for most scripts.

Conclusion

Cron jobs are one of the simplest ways to save time on Linux. With a basic understanding of the five time fields, full paths, and log redirection, you can automate backups, maintenance, and monitoring in just a few minutes.

Try creating your first cron job today: schedule a script that writes the date to a file every minute, check that it works, and then build from there.

Have a question or a cron job you’d like us to cover? Let us know through the Contact page.

Keep reading: build the commands your jobs run with our free Linux command generator, and if you run scheduled tasks on a Pi, see how to block ads on your whole network with Pi-hole.

Build your crontab lines faster with the free cron expression generator on Arelvox.

How to Check Your Monitor Refresh Rate (Hz) in the Browser with JavaScript

Arelvox — Tue, 27 Oct 2026 23:19:25 +0000

Is your 144 Hz monitor really running at 144 Hz? A surprising number of people find out it has been stuck at 60 Hz for months because of a cable or a Windows setting. You can check it from a web page with about 20 lines of JavaScript. Here is how, including the two details that make the number trustworthy.

👉 Try it first: arelvox.com/refresh-rate-test

The idea: count frames with requestAnimationFrame

The browser calls requestAnimationFrame once per screen refresh. If you record the time between calls, you get the frame time, and 1000 / frameTime is the refresh rate in hertz.

var samples = [], last = 0;

function loop(t) {
  if (last) samples.push(t - last);   // ms between two frames
  last = t;
  requestAnimationFrame(loop);
}
requestAnimationFrame(loop);

On a 60 Hz screen the samples hover around 16.7 ms, on 144 Hz around 6.9 ms, and on 240 Hz around 4.2 ms.

Detail 1: use the median, not the average

If you simply average the samples, you get numbers like 57 Hz on a perfectly normal 60 Hz laptop. The reason is dropped frames. When the browser is busy (garbage collection, a heavy tab, a font loading), one frame takes 33 ms instead of 16.7 ms. A few of those pull the average down a lot.

The median ignores them:

function median(a) {
  var b = a.slice().sort(function (x, y) { return x - y; });
  return b[Math.floor(b.length / 2)];
}

var hz = 1000 / median(samples.slice(10));   // skip the first frames while the page settles

I also skip the first 10 samples, because the first frames after page load are often irregular.

A bonus: once you have the median, counting dropped frames is trivial. Any frame that takes more than about 1.7× the median was dropped:

if (dt > median(samples) * 1.7) drops++;

Detail 2: snap to real refresh rates

The measured value is never perfectly round. You get 59.94 Hz (a real NTSC-style rate on many laptops), 143.8 Hz, and so on. People expect to see "144 Hz", so I snap to the nearest common rate if it is within 6%:

var COMMON = [30, 50, 60, 72, 75, 90, 100, 120, 144, 165, 170, 180, 200, 240, 280, 300, 360];

function nearest(hz) {
  var best = COMMON[0];
  COMMON.forEach(function (c) {
    if (Math.abs(c - hz) < Math.abs(best - hz)) best = c;
  });
  return Math.abs(best - hz) / hz < 0.06 ? best : Math.round(hz);
}

I still show the raw measurement next to it ("about 60 Hz, measured 59.9 Hz"), so nothing is hidden.

Gotcha: background tabs

Browsers throttle requestAnimationFrame in background tabs, sometimes down to 1 frame per second or none at all. My first deploy showed "NaN Hz" to anyone who opened the page in a new background tab: after 2.5 seconds there were not enough samples, and the median of an empty array is undefined.

The fix is to wait until there are enough samples, and to restart the measurement when the tab becomes visible:

if (t - start > 2500 ? samples.length >= 60 : false) finish();

document.addEventListener('visibilitychange', function () {
  if (!document.hidden) { last = 0; restart(); }
});

(The ternary instead of && is because the code runs inside a WordPress block, and WordPress mangles && in inline scripts.)

Making the difference visible

A number is nice, but people want to see smoothness. The page has three squares moving at the same speed: one updates every frame, one at 30 FPS and one at 15 FPS. On a 144 Hz screen the difference between the first two is obvious, and it is a good way to convince yourself that the monitor setting actually changed.

If your screen shows 60 Hz but should not

Windows: Settings → System → Display → Advanced display → Choose a refresh rate.
macOS: System Settings → Displays → Refresh rate.
Cable: old HDMI cables often cap you at 60 Hz. DisplayPort is the safe choice.
Laptops on battery may drop to 60 Hz to save power.

Try it

What does your screen report? I'd love to hear about odd results, especially on variable refresh rate displays or phones, where the browser may run at a lower rate than the panel.

Run the refresh rate test →

There are a few more small browser tests on the same site if you are setting up new hardware: a keyboard tester, a dead pixel test, a mic test and a webcam test.

I Built 2048 in Vanilla JS: Fixing the Double-Merge Bug, Smooth Slides and Undo

Arelvox — Tue, 27 Oct 2026 10:07:47 +0000

2048 is the classic "build it in a weekend" game. The rules fit in one sentence, yet there are a few traps that almost every 2048 clone falls into. Here is how I handled them in plain JavaScript, with no framework and no canvas, just DOM tiles and CSS transforms.

👉 Play the result: arelvox.com/2048-game

1. The double-merge bug

Take the row [2, 2, 4, _] and swipe left. The correct result is [4, 4, _, _]. A naive loop gives [8, _, _, _], because the new 4 merges again with the existing 4 in the same move.

The rule is simple: a tile can only merge once per move. I give every tile an id and remember which ids already merged during this move:

var mergedIds = {};

if (o.v === t.v ? !mergedIds[o.id] : false) {
  grid[r][c] = null;
  o.v *= 2;
  mergedIds[o.id] = 1;     // this tile is done for this move
  return;
}

(Yes, that is a ternary instead of &&. The game runs inside a WordPress block, and WordPress mangles && in inline scripts.)

2. Process tiles from the far side

The second bug is about order. If you swipe right but loop over columns from left to right, tiles bump into neighbours that have not moved yet. The fix is to iterate starting from the edge you are moving towards:

var vec = { 0: [-1, 0], 1: [0, 1], 2: [1, 0], 3: [0, -1] }[dir];  // up, right, down, left
var rows = [0, 1, 2, 3], cols = [0, 1, 2, 3];
if (vec[0] === 1) rows.reverse();   // moving down: start at the bottom
if (vec[1] === 1) cols.reverse();   // moving right: start at the right

Each tile then slides cell by cell until it hits the wall, a different tile, or a tile it can merge with.

3. Smooth animations with stable ids

If you rebuild the board on every move, tiles teleport instead of sliding. The fix is to never recreate a tile element. Each tile keeps its id, the DOM node keeps a data-id, and moving a tile only changes its CSS transform:

el.style.transform =
  'translate(calc(' + (c * 100) + '% + ' + (c * 10) + 'px), calc(' + (r * 100) + '% + ' + (r * 10) + 'px))';

With transition: transform .11s in the CSS, the browser animates the slide for free. For merges, the tile that disappears slides into its target first and is removed 120 ms later, so you actually see the two tiles meet:

el.style.transform = /* target position */;
setTimeout(function () { el.remove(); }, 120);

New tiles get a small "pop" keyframe animation and merged tiles a quick scale bounce.

4. Undo is just a stack of snapshots

Undo sounds hard, but the state is tiny: a 4x4 grid and a score. Before each move I push a deep copy, and undo pops it:

function clone(g) {
  return g.map(function (row) {
    return row.map(function (t) { return t ? { id: t.id, v: t.v } : null; });
  });
}

history.push({ g: clone(grid), s: score });
if (history.length > 20) history.shift();

function undo() {
  if (!history.length || undos < 1) return;
  var p = history.pop();
  grid = p.g; score = p.s; undos--;
  render(); save();
}

Unlimited undo makes the game pointless, so you get three per game. That turned out to be a nice design choice: players save them for real mistakes, and it adds a small layer of strategy.

5. Autosave with localStorage

People play 2048 in short breaks, then close the tab. Losing a 1024 tile to a closed tab is painful, so the game saves after every move:

function save() {
  try {
    localStorage.setItem('avx-2048-state', JSON.stringify({ g: clone(grid), s: score, u: undos }));
  } catch (e) {}
}

The try/catch matters: Safari private mode and some embedded browsers throw on localStorage access.

6. Checking for game over

The board is only lost when it is full and no two neighbours match. You only need to check right and down for each cell:

function canMove() {
  if (empty().length) return true;
  for (var r = 0; r < 4; r++) for (var c = 0; c < 4; c++) {
    var v = grid[r][c].v;
    if (r < 3 ? grid[r + 1][c].v === v : false) return true;
    if (c < 3 ? grid[r][c + 1].v === v : false) return true;
  }
  return false;
}

Try it

What is your highest tile? Anything above 2048 is already very good. If you are stuck around 512, I also wrote a short guide on the corner strategy, which is how most people get past it.

Play 2048 →

How to Set Up Pi-hole on a Raspberry Pi to Block Ads

Arelvox — Tue, 27 Oct 2026 08:00:00 +0000

Originally published on Arelvox.

Ads and trackers slow down your browsing, waste your data, and follow you from site to site. Pi-hole is a free tool that blocks them for every device on your home network at once, including phones, smart TVs, and laptops. In this guide, you’ll learn how to install it on a Raspberry Pi, connect your network, and keep everything working well.

What Is Pi-hole?

Pi-hole is a network-wide ad blocker that works as a DNS sinkhole. Whenever a device asks for a website address, it checks the request against a list of known advertising and tracking domains. If the domain is on the list, the request is refused, so the ad never loads. Otherwise, it passes the request along to a normal DNS server.

If you want a refresher on how DNS works, read our guide to understanding your home network first.

What You Need Before You Start

A Raspberry Pi. Almost any model works, even a Raspberry Pi Zero 2 W, because the software uses very few resources.
A microSD card (8 GB or more) and a power supply.
An Ethernet cable. Wi-Fi works, but a cable is more reliable for a device that your whole network depends on.
Access to your router’s settings.

Step 1: Prepare Your Raspberry Pi

First, install Raspberry Pi OS Lite with Raspberry Pi Imager. In the advanced settings, enable SSH and set your username and password. Then boot the Pi, connect to it over SSH, and update the system:

sudo apt update && sudo apt full-upgrade -y

Next, give the Pi a fixed IP address. Since your devices will send all their DNS requests to this address, it must never change. The easiest way is to create a DHCP reservation in your router, which always assigns the same IP to your Pi’s MAC address.

Step 2: Install Pi-hole

The project provides an official installer. Run it with:

curl -sSL https://install.pi-hole.net | bash

The installer walks you through a few screens. In most cases, you can keep the defaults, but pay attention to these choices:

Upstream DNS provider: Choose one you trust, such as Cloudflare or Quad9.
Blocklists: Keep the default list to start with.
Web admin interface: Leave it enabled, because it makes managing Pi-hole much easier.

If you prefer to read a script before running it, download it first and review it. This is a good habit with any installer.

Step 3: Set Your Admin Password

When the installation finishes, set a password for the web dashboard:

sudo pihole setpassword

On older versions, the command is pihole -a -p instead. Afterward, open http://pi.hole/admin in your browser, or use the Pi’s IP address followed by /admin, and log in.

Step 4: Connect Your Network to Pi-hole

Now it’s running, but your devices don’t use it yet. You have two options:

Change the DNS server in your router. Set the router’s DNS (or DHCP DNS) to your Pi’s IP address. As a result, every device on the network uses Pi-hole automatically. This is the best option.
Change the DNS on individual devices. This works if your router doesn’t let you change DNS, but you have to repeat it on every device.

After saving, reconnect a device to the network or restart it, so it picks up the new settings.

Step 5: Check That Everything Works

Open any website and look at the dashboard. You should see queries appear in real time, along with the percentage of blocked requests. For a quick test, visit a page with many ads and compare it with your usual experience.

You can also test from a terminal:

nslookup doubleclick.net

If it’s blocking the domain, the answer comes back as 0.0.0.0 or similar.

Keeping Pi-hole Up to Date

Every so often, update the software and the blocklists:

pihole -up
pihole -g

The first command updates Pi-hole itself, and the second refreshes the blocklists (this process is called gravity). Moreover, you can add more blocklists from the web interface under Adlists if you want stronger blocking.

What Pi-hole Cannot Do

However, Pi-hole is not magic. Keep these limits in mind:

It cannot block ads that come from the same domain as the content, such as most YouTube ads.
Some websites break if you block too much, so you may need to allowlist certain domains.
If your Pi goes offline, devices that depend only on it lose DNS and appear to have no internet. Therefore, many people set a secondary DNS server in the router as a fallback, although this lets some ads through.

Security Tips

Use a strong password for the dashboard and for the Pi itself.
Never expose the Pi-hole admin page to the internet.
Keep Raspberry Pi OS updated. Our guide to securing your home network explains more habits like this.

Conclusion: Enjoy a Cleaner Network with Pi-hole

Pi-hole is one of the best first projects for a Raspberry Pi. It costs almost nothing, takes less than an hour to set up, and makes every device on your network a little faster and more private. Now that you have it running, try adding extra blocklists and watch the dashboard to see how many requests it blocks every day.

For the official documentation, visit the Pi-hole website and its docs.

Do you have a question about Pi-hole? Let us know through the Contact page.

Keep reading: new to the Pi? Start with how to turn a Raspberry Pi into a home server, and use our free subnet calculator to check your network range before you give Pi-hole a fixed address.

Planning your home network? Try the free IP subnet calculator on Arelvox.

PHP2Shell (CVE-2026-109618): How to Check if Your PHP Server Is Vulnerable and Patch It

Arelvox — Mon, 26 Oct 2026 23:45:48 +0000

PHP2Shell in short: if your server runs PHP 8.2–8.5, update to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 (or newer) and restart PHP. If you run PHP 8.1 or older, you need a patched package from your distro or host, or an upgrade. No setting fully protects you. Last updated: October 27, 2026.

PHP2Shell is the name given to two critical vulnerabilities in PHP itself, CVE-2026-109618 and CVE-2026-109619, which PHP fixed on October 21, 2026. They let an attacker run code on a web server with a single unauthenticated HTTP request, before your application code even starts. Because PHP powers WordPress and a large share of the web, this is one of the most serious PHP bugs in years. Here is what it is, how to check if you are affected and exactly how to patch.

What Is PHP2Shell?

PHP2Shell covers two separate bugs in the PHP interpreter. Both score 9.2 on CVSS v4.0 and both can lead to remote code execution with the privileges of the web server user, such as www-data.

CVE-2026-109618 (memory corruption): when a request makes PHP run out of memory while it is still setting up, part of an internal hash table stays half-built. The cleanup code then treats it as valid, which an attacker can abuse to call a function of their choice.
CVE-2026-109619 (use-after-free): some worker-wide state can survive the request that created it. A later request handled by the same PHP worker can then use a stale pointer.

The dangerous part is where it happens. The failure occurs while PHP parses the incoming request, so login pages, firewalls in your app, plugins and frameworks never get a chance to stop it. In other words, keeping WordPress and your plugins up to date does not fix PHP2Shell. Only updating PHP does.

PHP2Shell Timeline

October 17, 2026: AWS reported exploitation attempts four days before the public disclosure, according to Datadog.
October 20: details leaked on social media ahead of the planned October 22 disclosure.
October 21: PHP released emergency fixes and published its advisories. watchTowr reported exploitation in its honeypots the same day.
October 22–23: public proof-of-concept exploits appeared. Security vendors added scanner checks and detections.

Update (October 27): attacks have grown fast. Cloudflare reported PHP2Shell attempts rising from tens of thousands within 45 minutes of the disclosure to millions by early October 22, and Sophos and Arctic Wolf saw attempts to install a Mirai botnet variant. Sophos said there was no evidence of a successful compromise. Some researchers have also claimed the emergency patch is incomplete, which PHP disputes, so keep watching for the next PHP release.

Not every vendor sees the same PHP2Shell picture. Rapid7 says the public exploits only work against specific combinations of operating system, PHP version and web server, and that it had not confirmed in-the-wild exploitation itself. That difficulty buys you a little time, but every vendor agrees on the advice: patch now.

Which PHP Versions Are Affected by PHP2Shell?

PHP branch	Affected	Fixed in
8.5	before 8.5.12	8.5.12
8.4	before 8.4.27	8.4.27
8.3	before 8.3.36	8.3.36
8.2	before 8.2.35	8.2.35
8.1, 8.0, 7.4	all versions	no official release; source backports, distro/LTS packages, or upgrade
7.3 and older (incl. PHP 5)	all versions	no fix, upgrade to a supported branch

Every way of running PHP for the web falls in scope: Apache mod_php, PHP-FPM, php-cgi, LiteSpeed and FrankenPHP. The PHP team rates mod_php as the highest risk. One important detail: Linux distributions often backport security fixes without changing the version number, so an “old” version on Debian, Ubuntu or RHEL may already include the fix. Always check your vendor advisory, not just the number.

The scale is huge. According to CybelAngel, citing Shodan data from October 20, about 2.24 million internet-facing hosts advertise PHP, and 59% of those that show a version run a branch with no official fix. For WordPress, 35.1% of sites run an unsupported PHP version, according to WordPress.org statistics they cite.

How to Check Your PHP Version for PHP2Shell

On a server with SSH

php -v

To find out whether PHP2Shell affects you, check the PHP that serves your website. Careful: the command-line PHP is not always the same binary your website uses. To see what the web server actually runs, check PHP-FPM and installed packages too:

# PHP-FPM version (Debian/Ubuntu)
php-fpm8.3 -v

# Installed PHP packages
dpkg -l | grep php        # Debian/Ubuntu
rpm -qa | grep php        # RHEL/AlmaLinux/Rocky

# Docker image
docker exec <container> php -v

On WordPress

In the WordPress dashboard go to Tools → Site Health → Info → Server. The PHP version row shows exactly what your site uses.

On shared hosting

Open your hosting panel and look for the PHP version or PHP configuration section (for example in cPanel’s MultiPHP Manager or Select PHP Version, or the PHP Configuration page in Hostinger’s hPanel). On shared hosting, though, the host controls the actual PHP build, so the most reliable check is to ask support whether the PHP2Shell fixes are applied.

How to Patch PHP2Shell

Debian and Ubuntu

sudo apt update
sudo apt install --only-upgrade 'php*'

# restart PHP so the fix takes effect
sudo systemctl restart php8.3-fpm     # match your version
sudo systemctl restart apache2        # if you use mod_php

RHEL, AlmaLinux, Rocky, Fedora

sudo dnf upgrade 'php*'
sudo systemctl restart php-fpm httpd

If you use the Remi repository, note that Rapid7 reported Remi RPMs were not expected to receive the update on release day, and PHP advised switching to distribution packages or building from source.

Docker

Pull the latest official image for your branch, for example php:8.3-fpm, rebuild your own images on top of it and redeploy. An old image keeps the old PHP no matter what you install inside your app.

Shared and managed WordPress hosting

Here the host patches PHP2Shell, not you. Some, such as SiteGround, say they applied mitigations in advance and the official fixes on October 21. If you are on PHP 7.4 or 8.0/8.1, switch to PHP 8.3 or newer in your panel (after testing your site), and ask your host to confirm in writing that the fix is in place. Take a fresh backup first.

Do not forget to restart. PHP-FPM and Apache keep the old code in memory until their workers restart. Updating the package without a restart leaves you vulnerable.

Temporary PHP2Shell Mitigations If You Cannot Patch Yet

PHP and the security vendors are clear that no setting fully fixes PHP2Shell. These steps only reduce the risk until you can update:

Set session.upload_progress.enabled = 0 in php.ini or the FPM pool. If you set it with ini_set() or .user.ini, it comes too late.
On PHP 8.5, also set fatal_error_backtraces = 0.
For CVE-2026-109618, PHP’s guidance is memory_limit = -1 set by the administrator, combined with strict request-size limits at the proxy and container memory limits. Do not use RLIMIT_AS or RLIMIT_DATA, which can trigger the bug.
Lower post_max_size (for example 8M, or 32M if you need uploads) and limit body size, number of fields and nesting depth at your reverse proxy or WAF. Block multipart requests on apps that do not use uploads.
Restrict internet access to any PHP system you cannot patch right away.
Restart all PHP workers after every change.

Hiding errors with display_errors or @ will not help, and an empty error log does not prove you are safe.

Signs of a PHP2Shell Attack on Your Server

Bursts of fatal errors like “Allowed memory size of … bytes exhausted … in Unknown on line 0”. “Unknown on line 0” means the failure happened before any script ran.
Apache log lines such as AH00052: child pid … exit signal Segmentation fault (11).
Multipart POST requests with PHPSESSID or PHP_SESSION_UPLOAD_PROGRESS fields, deeply nested field names, or upload filenames containing <?php.
Very large form bodies, or uploads that declare a huge size and never finish.
The strongest sign: your web server process (for example apache2 or php-fpm as www-data) starting a shell such as sh -c, followed by an outbound connection.

Note that a successful attack does not have to crash anything. In Datadog’s lab the exploit returned a normal HTTP 200. If you see these signs, treat the server as compromised: isolate it, patch, rotate credentials and look for web shells and new cron jobs.

A Third PHP Bug: CVE-2026-115560

On October 23 the PHP Foundation published another advisory, CVE-2026-115560. It only affects apps that switch the session serializer at runtime, and there is no patch yet; the fix comes with the next regular PHP release. The mitigation is the same session.upload_progress.enabled = 0 setting listed above. Read our full guide: CVE-2026-115560 explained and how to mitigate it.

Frequently Asked Questions

Does updating WordPress protect me from PHP2Shell?

No. PHP2Shell is a bug in PHP itself, so WordPress, theme and plugin updates do not fix it. You need a patched PHP version from your host or your server packages.

Is the PHP CLI affected?

The attacks target PHP while it handles web requests, through mod_php, PHP-FPM, CGI, LiteSpeed or FrankenPHP. Command-line scripts are not the main risk, but update the whole PHP installation anyway.

I run PHP 7.4. What should I do?

PHP 7.4 has no official release with the fix. Use a patched package from your Linux distribution or LTS vendor if one exists, or upgrade to PHP 8.3 or newer, which is the better long-term choice.

Does a WAF protect me?

It can block known attack patterns, but a WAF must see the request exactly as PHP parses it, and chunked or truncated bodies can slip through. Treat a WAF as an extra layer, not a fix.

How do I know if my host has patched?

Check the exact PHP version in WordPress Site Health or your panel and compare it with the table above, then ask support to confirm. Remember that distro builds can include the fix without a new version number.

Sources and Further Reading

Keep your server safe: read our guide on securing your network, brush up on essential Linux commands, and set up automatic tasks with our cron expression generator.

Originally published on Arelvox, where the guide is kept up to date as new patches and attack data come out. You can also get free security alerts by email.

I Built a One-Tap Stacking Game in Vanilla JS: The Tiny Details That Make It Addictive

Arelvox — Sun, 25 Oct 2026 02:21:52 +0000

One-tap games look trivial. You tap, a block drops, done. But when I built Sky Stack, a small stacking game in plain JavaScript and canvas, the fun turned out to depend on a few tiny decisions. Here is how it works and what made it feel good to play.

👉 Play it first (30 seconds): arelvox.com/sky-stack

The whole game in one idea

The tower is an array of blocks, and each block is only an x position and a width:

s.stack = [{ x: 90, w: 300 }];     // the base
s.cur   = { x: -300, w: 300 };     // the block sliding across the screen

Every frame the current block moves left or right and bounces at the edges. When you tap, you compare it with the top of the tower.

The core: intersecting two ranges

Dropping a block is just the overlap of two 1D ranges:

function drop() {
  var t = topBlock(), c = s.cur;
  var left = Math.max(t.x, c.x);
  var right = Math.min(t.x + t.w, c.x + c.w);
  var overlap = right - left;

  if (overlap <= 0) return gameOver();   // missed the tower completely

  // the part that hangs over the edge becomes a falling piece
  var cutX = c.x < t.x ? c.x : right;
  s.falls.push({ x: cutX, w: c.w - overlap, y: yOf(s.stack.length), vy: 0 });

  s.stack.push({ x: left, w: overlap });
  nextBlock();
}

That is the entire game logic. Everything else is about feel.

1. A "perfect" zone that forgives you

Pixel-perfect drops are almost impossible on a phone, so anything within 5 pixels counts as perfect. A perfect drop cuts nothing off:

if (Math.abs(c.x - t.x) <= 5) {
  s.combo++;
  var grow = s.combo >= 3 ? Math.min(12, 300 - t.w) : 0;   // reward streaks
  s.stack.push({ x: t.x - grow / 2, w: t.w + grow });
}

The grow line matters most. In most stacking games your tower only shrinks, so every run feels like a slow loss. Here, from the third perfect drop in a row, the block grows back a little. Suddenly a bad drop is something you can recover from, and that is what makes people tap "play again".

2. Sound that climbs with your combo

No audio files, just the Web Audio API. Each perfect drop plays a note one step higher than the last:

function tone(freq, dur) {
  var o = ac.createOscillator(), g = ac.createGain();
  o.type = 'triangle';
  o.frequency.value = freq;
  g.gain.setValueAtTime(0.22, ac.currentTime);
  g.gain.exponentialRampToValueAtTime(0.0001, ac.currentTime + dur);
  o.connect(g); g.connect(ac.destination);
  o.start(); o.stop(ac.currentTime + dur);
}

tone(440 * Math.pow(1.122, Math.min(combo, 14)), 0.18);   // roughly one whole tone per step

You hear your streak building before you look at the score. On a miss, a dull low note plays and the pitch resets. It costs about ten lines and changes the game a lot.

3. Juice: falling pieces, particles, a little shake

The piece you cut off keeps falling and rotating instead of disappearing.
A perfect drop throws white particles from the edges.
navigator.vibrate(15) gives a tiny buzz on phones that support it.
The camera eases upward as the tower grows, so you never see a hard jump.

None of this changes the rules, but without it the game felt dead in testing.

4. A restart bug I almost shipped

The first version had a nasty bug: the tap that ended the game also counted as a tap on the "play again" overlay, so a new run started instantly and players never saw their score. The fix was to keep the two states strictly apart:

function onTap() {
  if (!playing) { start(); return; }
  if (s.over) return;          // ignore taps while the game-over screen is up
  drop();
}

The overlay has its own handler that only restarts once the game is really over. Keyboard Space and Enter only restart when the overlay is visible.

5. It has to fit anywhere

The game is a single self-contained block of HTML, CSS and JS. No framework, no build step, no external requests. It runs inside a WordPress "Custom HTML" block. One tip if you ever do the same: WordPress can mangle && inside inline scripts, so the code uses ternaries instead. Annoying, but it works.

Try it and beat my score

Drop your best score in the comments. Anything over 50 is already good, and 100+ means your timing is seriously sharp.

Play Sky Stack →

If you like small browser games, there are a few more on the same site: a daily number puzzle with a Time Attack mode and a typing game with boss bugs.

How to Calculate Subnets by Hand: A Step-by-Step Guide

Arelvox — Sat, 24 Oct 2026 19:40:57 +0000

Originally published on Arelvox.

Knowing how to calculate subnets is one of the most useful networking skills you can learn. It comes up in certification exams, in home labs and whenever you plan a network for an office. The good news is that you do not need complex binary math. With one simple trick, you can find the network address, broadcast address and host range of any IPv4 address in under a minute.

In this guide you will learn how to calculate subnets by hand, step by step, with real examples. When you finish, you can check every answer with our free subnet calculator.

What You Need to Know First

Before you learn how to calculate subnets, you only need a few basic ideas. Every IPv4 address has 32 bits, split into four groups of 8 bits called octets. A subnet mask, or a prefix like /24, tells you how many of those bits belong to the network. The remaining bits identify individual devices, called hosts.

For example, in 192.168.1.10/24 the first 24 bits are the network part and the last 8 bits are the host part. If these ideas are new to you, first read our guide to IP addresses, routers and DNS, and then come back here.

Prefix	Subnet mask	Block size	Usable hosts
/24	255.255.255.0	256	254
/25	255.255.255.128	128	126
/26	255.255.255.192	64	62
/27	255.255.255.224	32	30
/28	255.255.255.240	16	14
/29	255.255.255.248	8	6
/30	255.255.255.252	4	2

The Magic Number Method

The fastest way to calculate subnets by hand is the magic number, also called the block size. Subnets always start at multiples of this number, so once you know it, everything else falls into place.

Find the interesting octet: the first octet of the mask that is not 255.
Calculate the magic number: 256 minus the mask value in that octet.
List the multiples of the magic number. The network address is the multiple that is equal to or just below your IP.
The broadcast address is the next multiple minus one.
The usable hosts are everything between the network and broadcast addresses.

Example 1: 192.168.10.75/26

Let us see how to calculate subnets with a common exam question. First, convert /26 into a mask: 255.255.255.192. The interesting octet is the fourth one, because it is the first that is not 255.

Magic number: 256 − 192 = 64.
Multiples of 64: 0, 64, 128, 192. Our IP ends in 75, so it sits between 64 and 128.
Network address: 192.168.10.64.
Broadcast address: 128 − 1 = 192.168.10.127.
Usable host range: 192.168.10.65 to 192.168.10.126, which is 62 hosts.

That is the whole calculation. As a result, you can solve most subnetting questions without writing a single binary number.

Example 2: 172.16.45.200/20

This second example shows how to calculate subnets when the interesting octet is not the last one. A /20 prefix gives the mask 255.255.240.0, so this time the interesting octet is the third.

Magic number: 256 − 240 = 16, applied to the third octet.
Multiples of 16: 0, 16, 32, 48. The third octet is 45, so it falls between 32 and 48.
Network address: 172.16.32.0.
Broadcast address: 172.16.47.255, because the fourth octet is all ones.
Usable hosts: 172.16.32.1 to 172.16.47.254, or 4,094 addresses.

Notice that the fourth octet is 0 for the network and 255 for the broadcast. This happens whenever the interesting octet is not the last one.

How to Split a Network into Subnets

Knowing how to calculate subnets also lets you do the opposite: take one network and divide it into smaller ones. To do that, you borrow host bits. Each borrowed bit doubles the number of subnets and halves their size.

For example, to split 192.168.1.0/24 into four subnets, you borrow 2 bits, because 2² = 4. The new prefix is /26, with a magic number of 64:

192.168.1.0/26     hosts .1   to .62
192.168.1.64/26    hosts .65  to .126
192.168.1.128/26   hosts .129 to .190
192.168.1.192/26   hosts .193 to .254

Similarly, if you start from the number of hosts you need, choose the smallest subnet that fits. Remember that you lose two addresses in every subnet, one for the network and one for the broadcast. For 50 devices you need a /26 (62 usable hosts), and for 500 devices you need a /23 (510 usable hosts).

Common Mistakes When You Calculate Subnets

Forgetting the two reserved addresses. A /26 has 64 addresses but only 62 usable hosts.
Using the wrong octet. Always apply the magic number to the first octet of the mask that is not 255.
Mixing up the broadcast address. It is the next network address minus one, not the next network itself.
Ignoring the special cases. A /31 is used for point-to-point links and has two usable addresses, as described in RFC 3021, while a /32 is a single host.

The best way to avoid these mistakes is practice. Pick random addresses, calculate the subnets by hand and then confirm your results with the subnet calculator. After ten or twenty examples, the method becomes automatic.

Practice Questions

Try these on your own before checking the answers with the calculator:

10.0.5.130/25: what is the network address?
192.168.50.17/28: what is the broadcast address?
172.20.100.9/22: how many usable hosts are there?

Answers: 10.0.5.128, 192.168.50.31 and 1,022 hosts. If you got all three right, you now know how to calculate subnets by hand. For the full background on CIDR prefixes, the Wikipedia article on subnetworks is a good next read.

FAQ: How to Calculate Subnets

What is the easiest way to calculate subnets?

The easiest way is the magic number method: subtract the interesting mask octet from 256 and list its multiples. The network address is the multiple at or below your IP, and the broadcast is the next multiple minus one.

How many hosts are in a /26 subnet?

A /26 subnet has 64 addresses and 62 usable hosts, because the network address and the broadcast address cannot be assigned to devices.

Do I need to know binary to calculate subnets?

No. Binary helps you understand why the method works, but for day-to-day subnetting and most exam questions the magic number method is faster and less error-prone.

Want to check your answers? Try the free IP subnet calculator on Arelvox.