PHP2Shell: does your business website need all that machinery?

If you run a small business, checking your website’s PHP version probably wasn’t on this week’s to-do list. PHP2Shell has given you a reason to add it.

On 21 October, PHP released emergency fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. They can allow attackers to run code on affected servers without logging in. The official PHP advisory explains the risks and updates required.

Updating WordPress alone won’t fix this

The bugs sit underneath WordPress, in PHP itself. Researchers at Wiz demonstrated attacks against WordPress, Drupal and Joomla deployments. Their technical write-up explains how even secure application code can be exposed by the software running beneath it.

If your site uses PHP, ask your hosting provider to confirm that the relevant security fixes are installed. PHP also published follow-up guidance on 23 October covering an additional risk under an unusual session configuration.

How much website do you actually need?

WordPress makes sense for plenty of projects. But a five-page business website can end up carrying quite a maintenance bill: hosting, plugins, themes, backups and the software underneath them.

That’s part of why we’re building Stitchable. You assemble pages from ready-made sections, edit the content directly and publish static pages. For a straightforward business site, portfolio or event page, we think that’s a better fit than maintaining a full WordPress installation.

Static pages remove the need to execute PHP to serve that content. There are still accounts, infrastructure and connected services to secure, but fewer moving parts on the public website.

Patch your existing site first. Then, when the urgency has passed, ask whether the system you’re maintaining still matches the website you need.