Currently there is a relatively easy to trigger DoS in the try_login handling. Something like 160 parallel bad login requests will overload the server and block it. Mitigation: // if user not found, password wrong, account disabled: xcache_inc("loginfail:{$ip}", 300); // 5 minute window if ($val >= 5) { xcache_set("lockout:{$ip}"), true); "please wait $x minutes". }