On 21 October 2026, the PHP project told every website owner running PHP to update immediately. Two critical flaws, nicknamed PHP2Shell, can let an attacker run their own code on a web server without logging in. PHP sits underneath every WordPress site on the planet. If you run a small five-page business website on WordPress, here is the uncomfortable question: why is your brochure running a programming language on a server at all?
We have already written about how Astro and WordPress compare and what a migration actually involves. This article is about timing. For small, simple business websites, the last few months have made the case for moving off WordPress about as clear as it gets.
The Short Version
- October 2026: PHP shipped emergency fixes for two critical remote code execution flaws affecting every supported version.
- September 2026: WordPress itself shipped an emergency security release for a core flaw that was exploited in the wild.
- July 2026: the “wp2shell” flaws became the first critical unauthenticated remote code execution in WordPress core in nearly a decade.
- October 2026 again: a popular page builder add-on was attacked within days of disclosure.
- 31 December 2026: PHP 8.2 stops receiving security fixes.
A small site built with Astro is published as plain HTML files. There is no PHP running, no database to break into, and no plugins to patch. Most of the security notices below simply have nothing to attack.
Three Months of Security Notices
PHP2Shell: the big one (21 October)
The PHP project’s security advisory describes two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. In plain English: a stranger on the internet may be able to take control of the server your website runs on, without a password. PHP says every installation serving web requests is at risk, and it rates the danger highest on servers using Apache’s mod_php.
The fixes are in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older are no longer supported, so they get no official release at all, only source code patches for people who build PHP themselves. Tenable noted reports of early attacks on the same day. Researchers at Wiz also said frontier AI models helped turn a long-standing flaw into a working exploit, which tells you where the pace of attacks is heading.
WordPress 7.1.2: an emergency core release (22 September)
A month earlier, WordPress shipped version 7.1.2, a security-only release fixing CVE-2026-87902, a flaw in how page templates are resolved that could lead to remote code execution under certain conditions. Canada’s Cyber Centre noted reports of exploitation in the wild, and the US cyber agency CISA added it to its Known Exploited Vulnerabilities list on 25 September.
wp2shell: WordPress core, no plugins required (July)
In July, two chained flaws in WordPress core (CVE-2026-63030 and CVE-2026-60137) let attackers run code on a vanilla WordPress site with no login, no plugins and no special settings. Wordfence called it the first critical unauthenticated WordPress core remote code execution in nearly a decade. Fixes shipped in 6.8.6, 6.9.5 and 7.0.2, and public exploit code appeared within days.
Plugins: the usual suspects (October)
Core flaws make headlines, but plugins are where most WordPress vulnerabilities live. In October, attackers began exploiting CVE-2026-85097 in Bricksforge, an add-on for the Bricks page builder, which let unauthenticated visitors run PHP code on affected sites. SecurityWeek reported exploitation from 7 October. Versions up to 3.1.8.9 were affected.
And the deadline: PHP 8.2 ends on 31 December
PHP’s supported versions page lists 31 December 2026 as the end of security support for PHP 8.2. After that, the next PHP2Shell-style flaw will not be fixed on 8.2 at all. If your host still runs your site on 8.2 (or worse, 8.1 or 7.4), your website has a deadline whether anyone has told you or not.
Why Small Business Sites Carry the Most Risk
Big WordPress sites usually have a developer, a managed host and a maintenance budget. When PHP2Shell dropped, someone patched them that afternoon. The sites that worry us are the small ones:
- The five-page tradie site built in 2019 that nobody has logged into since.
- The clinic site on a cheap shared host still running PHP 7.4 because “it works”.
- The site with 23 plugins installed, 11 of them deactivated but still sitting on the server.
- The site whose original developer has moved on, so nobody knows the login.
None of these businesses need WordPress for what their website actually does: show who they are, what they offer, where they are, and how to get in touch. Yet every one of them is running a full PHP application and a database, and inherits every PHP, WordPress and plugin security notice for as long as the site is online. That is a lot of risk to carry for a digital business card.
Is Your Site Exposed Right Now?
We’ll check your PHP version, WordPress core, plugins and hosting, and tell you plainly whether to patch, plan a move, or both.
Book a Free Website Security Check →What Astro Changes
Astro builds your site once, ahead of time, and publishes the result as plain HTML, CSS and images. When a visitor arrives, the server simply hands over a file. There is no PHP interpreting requests, no database answering queries, and no admin login page for bots to hammer.
- No PHP on the server: PHP2Shell targets PHP installations serving web requests. A static Astro site does not have one.
- No database: nothing for SQL injection to reach, like the wp2shell chain did.
- No plugin sprawl: features are built into the site, not bolted on by third-party code that can go unpatched.
- No wp-admin: no login page for automated password attacks.
- Faster and cheaper to host: static files load quickly from a global network, which also helps your Google rankings.
This website is built the same way. So are client sites like Bayswater Dental, which we built with Astro. When the PHP advisory landed on 21 October, there was nothing on our pages to patch.
What a static site still needs
Static does not mean zero maintenance, and we would be overselling it if we said otherwise. Contact forms still need to send email somewhere, usually through a small serverless function with spam protection. Your domain, DNS and hosting accounts still need strong passwords and two-factor authentication. Any third-party scripts you add, like chat widgets or tracking tags, still need to come from vendors you trust. The difference is the size of the target: a handful of well-understood pieces instead of a full application stack.
Is Your Site a Good Candidate?
Moving to Astro makes the most sense when your website is:
- A brochure or service site of roughly 5 to 50 pages.
- Updated a few times a month or less, by one or two people.
- Built mainly to be found on Google and generate enquiries.
- Using a contact form, maybe a blog, and not much else.
WordPress is still the right home for some businesses: large online stores on WooCommerce, membership sites, or teams that publish daily with many editors. For those, the answer is disciplined maintenance, not a rebuild. Our migration guide covers the honest cases where staying put is the better call.
If You Are Staying on WordPress This Year
Moving takes a few weeks. Patching takes today. If your site runs on WordPress, do this now, whatever you decide next:
- Check your PHP version in your hosting control panel or under Tools > Site Health in WordPress. You want 8.2.35, 8.3.36, 8.4.27 or 8.5.12 or newer.
- If you are on PHP 8.1 or older, move up now. Those versions no longer receive official fixes.
- Update WordPress core to the latest release, and make sure automatic security updates are switched on.
- Delete plugins you do not use, including deactivated ones, and update the rest.
- Ask your host when they patched PHP2Shell and what their plan is for PHP 8.2 reaching end of life on 31 December.
If your host cannot answer the last question clearly, that is your answer about the host. Our managed hosting team can take this off your plate.
The Final Word
Every few years the web gives small businesses a clear signal. Mobile-friendly sites. HTTPS. This is the next one. Three months of critical PHP and WordPress notices, with another PHP end of life on the way, is the market telling you that a simple website no longer needs to carry a complex, high-maintenance engine underneath it.
If your website is a shopfront, not a software platform, now is the time to make it plain, fast HTML. Keep the content, keep the rankings, and lose the attack surface.
Ready to Swap PHP Worries for Plain, Fast HTML?
We move small WordPress sites to Astro with every page, URL and ranking accounted for, typically in two to four weeks for a small business site.
Explore Astro Websites →
