On October 21, my inbox filled up with security alerts.
The headlines were worse. Reuters reported “emergency shutdowns of banking, airline, rail, tax and government services from Tokyo to Helsinki.” The cause was PHP2Shell, a flaw in PHP, the software that runs WordPress on the server. And it was found with help from AI.
If your firm’s website runs on WordPress, you probably saw one of those headlines (or an email from your hosting provider) and wondered whether you should be worried.
Here’s what I noticed that day. The WordPress sites I help look after meant a lot of checking with hosts and waiting on fixes. The sites I’ve moved to Astro needed nothing. Not one update, and not one email to or from a host.
If you are a little nervous about WordPress right now, I don’t blame you.
Here’s the short answer. WordPress can be safe, but a static site is far safer, because there’s much less for an attacker to get into.
In this article
- What happened with PHP2Shell?
- Will this keep happening?
- Astro vs WordPress: which is safer?
- Who controls your website?
- Should every WordPress site move?
- What to do now if your site runs on WordPress
- FAQ
What Happened With PHP2Shell?
Basically, PHP2Shell let a stranger take over your website’s server without ever logging in. CISA, the U.S. government’s cybersecurity agency, told organizations to patch immediately, and to take sites offline if they couldn’t.
Hackers (and their AI’s) started attacking fast after the news broke. Cloudflare’s CEO said they saw thousands of attempts in the 10 hours before the flaw was announced, then “tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now,” as Reuters reported. Amazon logged an attempt four days before the announcement. Amazon says it’s unclear whether any of the attempts it saw would have worked. Five days after the fix came out, CISA added the flaws to its list of ones known to be used in real attacks.
Here’s the frustrating part for owners. There was nothing you could do from your own WordPress admin panel. Cloudflare explained that “updating website code or a plugin(s) alone does not fix these vulnerabilities.” Your WordPress dashboard could say everything was up to date while the server underneath was still open. The fix had to come from whoever runs your server, usually your hosting company, on their schedule.
Will This Keep Happening?
Yes, and more often. Here’s what’s crazy. In one week this October, Wordfence logged more than 650 new vulnerabilities in WordPress plugins and themes. For all of 2025, Patchstack counted 11,334, up 42% from the year before, and almost half had no fix ready when they went public.
WordPress itself has had a busy fall. In September it patched a critical flaw in WordPress core. A week after PHP2Shell, it shipped another security release and recommended that you “update your sites immediately.” Two of those fixes were reported by Anthropic, the AI company.
AI is a big part of why this is happening. The team behind PHP wrote that “Tools now find bugs faster than ever, for defenders and attackers alike, and the number of reports will keep growing.”
Every new flaw means another fix someone has to install, and as PHP2Shell showed, attacks can start within hours. On a WordPress site, that someone is your host, your plugin developers and whoever runs your updates.
So why did my client’s Astro sites need nothing?
Astro vs WordPress: Which Is Safer?
Think of your website as a store. Customers come in, look around, ask questions and get what they came for. That part works the same on WordPress and on a static site.
The difference is the back room. On a WordPress site, the back room is where every page gets put together, and it’s busy all day. Every add-on, or plugin, is another contractor with a key to it. There’s a staff door around the side that anyone walking by can try.
Then PHP2Shell came along. It was like finding out that the lock on millions of those back doors could be opened by a stranger. Owners had to wait for their landlord, usually their hosting company, to come change it.
A static site is the same store with the same service, but there’s no back room. Everything is prepared before the store opens and arrives ready for the shelf. That’s how we build with Astro. Customers get everything they came for. There’s just no back door to try, no pile of contractor keys and no lock for a flaw like PHP2Shell to open.
Is any store 100% theft-proof? No. But out of the box, a WordPress site has a login page anyone can find, and it has plugins, which is where Patchstack found 91% of last year’s WordPress flaws. A static site has neither.
Who Controls Your Website?
If you run your own firm, you probably like calling your own shots. With WordPress, your site’s safety depends on a lot of other people. If your host manages the server, they decide when it gets patched. Every plugin developer decides when, or whether, to fix their code. And you’re stuck choosing between skipping an update and staying exposed, or installing it and hoping nothing breaks.
A static site cuts most of those people out.
- You own your site’s files outright, and you can take them to any host.
- There are no plugin developers to wait on.
- No plugin update can change your pages without you.
One thing doesn’t change. Big design changes still take a pro, on WordPress or anything else. A new page layout, or a homepage section that has to look right on a phone, usually goes to a designer either way. What goes away is the WordPress plugin and PHP upkeep underneath.
Should Every WordPress Site Move?
No. WordPress is still a good fit for plenty of sites. Automattic said every site on its hosting, including WordPress.com and Pressable, was protected on October 21. And if your site runs an online store, member logins or a booking system, a platform like WordPress often makes sense.
A static site is worth a look if:
- Your site is mostly pages: services, team, articles and a contact form.
- You don’t know who hosts your site, or you weren’t sure on October 21 whether it was safe.
- Updates are switched off because they break something.
- You’re tired of maintenance that never ends.
Moving is a rebuild, and Google says to expect some ranking changes during a move while it catches up. When every old page address points to its new one, your search traffic has the best chance of carrying over. That’s how we plan every WordPress rebuild.
What to Do Now if Your Site Runs on WordPress
- Ask your host whether PHP is patched, not scheduled, and get the answer in writing.
- Check your PHP version yourself. In WordPress, go to Tools, then Site Health, then Info, then Server. You want 8.2.35, 8.3.36, 8.4.27, 8.5.12 or newer, which fix PHP2Shell. If it’s 8.1 or older, CISA’s advice is to take the site offline until it’s updated.
- Delete plugins you don’t use. Each one is another developer you’re waiting on.
And if you’re curious whether your site could run without any of this, I’m happy to take a look. I’ll tell you honestly whether it’s fine where it is or worth moving. Book a free strategy session with me.
FAQ
How do I protect my WordPress site from hackers?
Make sure your host runs a patched version of PHP, keep WordPress and its plugins updated, delete plugins you don’t use, and use strong passwords with two-factor sign-in. Even then, your site’s safety still depends on how fast your host and your plugin developers ship fixes.
Does updating WordPress protect against PHP2Shell?
No. The flaw is in PHP, which your host runs underneath WordPress. Updating WordPress or its plugins, security plugins included, doesn’t change it. Only a patched PHP does.
Can a static website be hacked?
Yes, but there’s far less to go after. The weak points are logins, forms and outside scripts, not software that runs on the server for every visitor.
Is Astro better than WordPress for a small business website?
For a site that’s mostly pages, we think so. For an online store or a member area, WordPress or another server platform is often the better fit.
What are the disadvantages of WordPress?
For security, the biggest one is plugins. Patchstack found that 91% of WordPress flaws in 2025 were in plugins, and almost half had no fix ready when they went public. WordPress also needs constant updates to WordPress itself, its plugins and the PHP software underneath, and any one of those updates can break something.
Sources
- Reuters: Hacking attempts surge as companies, governments rush to patch PHP flaws, October 22, 2026
- CISA: Critical Vulnerabilities in PHP Require Immediate Patching, revised October 26, 2026
- Amazon Threat Intelligence: PHP2Shell exploitation prior to public disclosure, October 21, 2026
- Cloudflare: Cloudflare deploys protections against php2shell vulnerability, October 21, 2026
- Wordfence: Weekly WordPress Vulnerability Report, October 5 to 11, 2026
- Patchstack: State of WordPress Security in 2026
- WordPress.org: WordPress 7.1.4, October 28, 2026
- The PHP Foundation: Today’s PHP Security Release, October 21, 2026
- WordPress.com: Your Site Is Protected Against PHP2Shell, October 21, 2026
- Google Search Central: Site moves with URL changes
