PHP2Shell and Your Website: Build More, Patch Less

This week, a critical security flaw in PHP put a huge share of the internet on alert, including nearly every WordPress website. If your site runs on WordPress, it was probably affected.

The good news: the fix arrived quickly, and well-managed hosts applied it within about a day. But the episode raises a question every business with a website should ask: How much of your time and budget goes into keeping your site safe, instead of making it work harder for you?

Here's what happened, what it means, and how to think about your website's long-term foundation.

What happened, in plain terms

Think of a website like a car. WordPress is the body and dashboard you see and use. PHP is the engine underneath that makes it all run.

On October 21, the team behind PHP announced two serious flaws in that engine, nicknamed "PHP2Shell," and released a fix the same day. It drew so much attention for a few reasons:

• It was rated critical, about as severe as website security issues get.
• It could have let an attacker take over a website without needing a password.
• It affected nearly every WordPress site, no matter how well built or maintained.
• The U.S. government's cybersecurity agency urged everyone to update immediately.
• It reached well beyond WordPress. PHP also runs online stores, customer portals and internal business tools, which is why some organizations, including Dutch government services, took their sites offline as a precaution until the fix arrived.

Because the problem was in the engine and not the site itself, updating plugins or WordPress couldn't fix it. The fix had to come from each site's hosting provider.

Fortunately, security services like Cloudflare acted quickly to block known attacks, PHP released a fix, and hosts like WP Engine rolled it out to every site on their platforms.

Credit where it's due: why WordPress powers so much of the web

WordPress runs over 40% of all websites, according to W3Techs data, and it earned that position. We've built and supported WordPress sites for years, and its strengths are real:

• Flexibility: Thousands of themes and plugins can add almost any feature, from event calendars to membership portals.
• Ownership: As open-source software, it isn't controlled by a single vendor. You can move your site to a different host whenever you want.
• A massive community: Developers, documentation and support are easy to find, and fixes like this week's arrive quickly.
• Content power: For organizations publishing large volumes of content with complex editorial workflows, WordPress remains a strong choice.

All of that is still true. What this week highlighted is the cost of that flexibility.

A WordPress site is assembled from separately maintained pieces: the hosting server, PHP, WordPress itself, a theme and often a dozen or more plugins from different developers. A serious flaw in any one of them puts the whole site at risk. This was the second major WordPress security emergency this year, after a flaw in WordPress itself called "wp2shell" in July.

AI is speeding everything up, including security threats

AI tools are now finding software flaws faster than ever. The researchers at Wiz who uncovered PHP2Shell used a mix of AI models to identify the vulnerabilities and help fix them.

That's good news for defenders, but the same tools are available to attackers. As AI makes it quicker to find weaknesses and to build attacks around them, we expect emergencies like this one to happen more often, with less time between discovery and exploitation.

For a website with many independently maintained parts, that means more alerts, more patches and more urgent updates. Each one has to be caught and applied independently and quickly.

A different model: let the platform handle it

Fully managed platforms like Webflow take a different approach. Design, content editing, hosting and security all come from one provider, which keeps the whole system up to date. Webflow's own pitch to WordPress users sums it up: "No more plugin, core, or PHP updates."

For marketing and communications teams, that changes the day-to-day:

• Your team can make changes themselves. Marketers can edit pages, publish content and launch campaigns directly on the page, without waiting on a developer.
• Fewer add-ons to manage. Features that usually take WordPress plugins, like SEO tools, forms, analytics and animations, are built into the platform.
• Security and hosting are included. Webflow handles updates, protection against attacks and independently audited security (SOC 2 Type II) for you.
• Built-in safety nets. Webflow reports 99.99% uptime and saves automatic backups every 10 minutes, so a mistake can be undone in a click.

No platform is immune to security issues. The difference is who deals with them. On a managed platform, the provider fixes problems across every site at once. Nobody on your team has to send an emergency email or find a developer on short notice.

Is it time to switch?

Not necessarily. The right platform depends on what your website needs to do.

A managed platform like Webflow is often a great fit if:

• Your site is mainly about telling your story, showcasing work and generating leads
• You want a polished, custom design your team can update without a developer
• You'd rather not manage plugins, patches and hosting
• You're planning a redesign anyway

WordPress may still be the better choice if:

• Your site depends on complex features like memberships, custom portals or advanced integrations
• You publish very large volumes of content with multi-step editorial workflows
• You rely on specific plugins with no equivalent elsewhere
• Your current site is recent, well maintained and meeting your goals

If your site sounds more like the first list, a rebuild could pay for itself in less maintenance and fewer emergencies.

Build more, patch less: how TPG can help

We believe your time and budget should go toward building, launching and marketing, not maintenance and security fixes. That's how we approach every web project at The Pollack Group.

Our web development team builds on Wordpress, Webflow, Squarespace, and Shopify, so our recommendation follows what your site needs, not what we prefer to build on. We can help with:

• Platform assessments: An honest review of your current site, how much it costs to maintain and whether a rebuild makes sense.
• Design and development: Custom, high-performance sites on Webflow and other managed platforms that your team can update easily, with security and hosting handled for you.
• Seamless migrations: Moving content, redirects and search rankings from one platform to another without losing the visibility you've earned.
• Search and AI visibility: SEO and AI search optimization built in from day one, so your new site shows up on Google and in AI tools like ChatGPT.
• Ongoing WordPress support: For sites that should stay on WordPress, we'll make sure they're maintained and monitored.

Curious whether your website is working as hard as it should? Let’s Talk.

Frequently asked questions

What is PHP2Shell?

PHP2Shell is the nickname for two critical security flaws in PHP, the behind-the-scenes software that powers WordPress. They were announced and fixed on October 21, 2026, and could have let attackers take over websites that weren't updated.

Was my WordPress site affected?

Nearly every WordPress site was in scope. If your site is on a managed host like WP Engine, the host applied the fix for you. If you're not sure how your site is hosted, ask your web team or agency to confirm.

Can I fix it by updating my plugins?

No. The flaw was in the software underneath WordPress, so it had to be fixed by the hosting provider.

Do Webflow site owners have to install security updates?

No. Webflow maintains and secures the platform itself, so site owners never install software updates or patches.

Is Webflow more secure than WordPress?

No platform is immune, but Webflow has fewer moving parts and handles security for you. WordPress can be very secure with strong hosting and consistent maintenance, but keeping it that way takes ongoing work.