What the PHP Vulnerability Reveals About the Security of Your Website
Two critical security vulnerabilities have been discovered in PHP, the programming language behind millions of websites worldwide. Known collectively as PHP2Shell, these flaws could allow attackers to gain control of affected servers without needing to log in.
This discovery has prompted urgent security updates, with some organisations, including government services across Europe, taking their websites offline while fixes are implemented.
For businesses running older versions of PHP, fixing a critical vulnerability isn't always as simple as installing an update. It could mean upgrading core systems, addressing compatibility issues or rebuilding substantial parts of the website.
But this isn't just a story about PHP. It raises wider questions about the security of ageing website infrastructure, the growing capabilities of AI and whether businesses are doing enough to protect their websites against emerging threats.
Why are older PHP websites particularly at risk?
Older PHP websites are particularly vulnerable because they may be running software that no longer receives official security updates.
When new vulnerabilities are discovered, businesses using these versions can't always access the patches needed to protect their systems.
The PHP development team released security fixes on 21 October 2026 for supported versions. Businesses should check they're running PHP 8.2.35, 8.3.36, 8.4.27 or 8.5.12, or a later security-patched release.
However, PHP 8.1 and earlier are no longer officially supported, leaving businesses running these versions with fewer options for addressing newly discovered threats.
Upgrading PHP can affect your CMS, plugins, integrations and bespoke functionality. If your website hasn't been regularly maintained, what should be a straightforward security update could turn into a much larger development project.
Fixing the immediate vulnerability is one thing. Making sure your website can continue to be maintained securely and cost-effectively is another.
Not sure whether your website uses PHP?
WordPress, Joomla and Drupal are all built using PHP, although that doesn't automatically mean your website is vulnerable. You can usually check your PHP version through your hosting control panel or ask your website developer or hosting provider to confirm which version you're running and whether any action is required.
Why website security goes beyond the platform you choose
Web security involves more than choosing the right platform. On popular open-source CMSs such as WordPress, every third-party plugin and extension introduces another dependency that needs maintaining, updating and monitoring for security issues.
Open-source technology isn't inherently insecure - many open source platform providers govern and control how code is vetted and introduced onto their CMS. What matters is how your website is built, which components it relies on and how those components are managed.
For businesses with more complex requirements, bespoke development offers greater control over website architecture, functionality and third-party dependencies.
At I-Finity, we use platforms such as Umbraco as they govern security, PEN test their core platform, and it enables us to securely build bespoke functionality around each business's requirements, whilst reducing reliance on third-party plugins.
How is AI changing website security?
AI is exposing security weaknesses that have gone undetected for years. In the case of PHP2Shell, researchers used advanced AI tools to help uncover how vulnerabilities that had existed in PHP for over a decade could be exploited.
AI is also making these weaknesses easier for cybercriminals to exploit. Vulnerabilities that were previously too complex or time-consuming to exploit may now be easier to identify and weaponise using AI.
A website might have operated without a security incident for years, but that doesn't mean it's prepared for these emerging threats.
Businesses need to be more proactive about identifying weaknesses in their own systems, rather than waiting until a vulnerability becomes a serious problem.
That means building security into the development process, testing regularly and making sure websites can be updated quickly when new vulnerabilities emerge.
When should you consider upgrading or rebuilding your website?
Not every security vulnerability requires a website rebuild. In many cases, applying a patch or upgrading to a supported software version will resolve the immediate issue.
But maintaining an outdated website can become increasingly difficult. Upgrading one component might create compatibility issues elsewhere, while unsupported frameworks and integrations can make essential security fixes harder to implement.
Over time, repeatedly patching an ageing website can become more expensive and disruptive than investing in a longer-term solution.
A website rebuild or platform migration gives you the opportunity to address these underlying issues, review your technology choices and build a more secure, maintainable website.
The question is whether your current website can continue to meet your security and business requirements without unnecessary cost, complexity or risk.
Secure web development with I-Finity
At I-Finity, we take a security-by-design approach to developing, testing, hosting and supporting bespoke websites. As a Cyber Essentials Plus-certified business, we combine proven security practices with technologies selected around each customer’s requirements.
Whether you're working with an ageing platform, considering a website rebuild or planning a migration, our development team can assess your existing technology and recommend the right approach for your business.
Concerned about the security or long-term suitability of your website? Get in touch with I-Finity to discuss your requirements.
