If Your Website Got Hacked Tomorrow, Who Would Fix It?

Last week a serious security flaw went public in PHP, the software that runs underneath WordPress and most small business websites. Security researchers named it PHP2Shell. Within a day, attackers were trying it on millions of sites.

If your website runs on WordPress, this one was about you.

What happened, in plain terms

The flaw let an attacker take over the computer your website runs on, without a password. Once in, they can deface the site, steal what customers type into your forms, or quietly use your site to send spam and host scams under your name.

• October 20: word of the flaw leaked online before the fix was ready.
• October 21: the fix came out.
• October 22: Cloudflare saw attack attempts climb into the millions.

Palo Alto Networks counted more than 22 million sites and servers that could be at risk.

Why the WordPress update button won't fix it

The flaw sits underneath WordPress, so the update button in your dashboard can't reach it. Whoever runs your hosting has to fix it, and that's where small businesses get stuck.

• Your host decides when. On cheap shared hosting, you wait. Some hosts fixed every site on day one. Others took days.
• Older sites can't get the fix at all. Only recent versions got an official fix. By one estimate, about a third of WordPress sites run versions too old for it.
• Nobody owns it. The person who built the site moved on, and nobody wants to touch the plugins because the last update broke the contact form.

That last one is the real risk. A fix nobody applies doesn't protect you.

Newer websites get flaws too

The same day, the software behind many newer websites had its own serious flaw. No website is immune, and I fixed my own systems that week.

The difference is how much work the fix takes. On a modern setup:

• The hosting company applies security fixes for you. Vercel, for example, rolls them out without anyone asking.
• You preview every change before customers see it, so an update isn't a gamble.
• Undoing a bad change takes one click. Fear of breaking the site is why old sites never get updated.
• There's less to break into. No plugins and no public login page means fewer doors to try.

The question that matters isn't which software you use. It's this: when the next flaw goes public on a Tuesday, who fixes your site, and by when?

What to do this week if you're on WordPress

You don't need to rebuild anything yet. Start here:

1. Ask your host in writing: "Has the server my site runs on been updated for the October 21 PHP security fix?"
2. Ask which version of PHP your site runs. If it's below 8.2, ask to be moved to a newer one, or find a new host.
3. Delete plugins and themes you aren't using.
4. Make sure you have a backup, and that someone has actually restored it once.
5. Decide who handles this next time, and write their name down.

If you don't like the answers, have that conversation now, before the next one.

---

Not sure who's keeping your website safe, or whether it's time to move off WordPress? Let's talk.