We're just about a week away from Halloween, and the internet has served up a major scare. Unfortunately, this one's no trick, and there's definitely no treat either.
I'm talking about the newly discovered PHP security vulnerabilities that have been making headlines and leaving a lot of business owners wondering if they should be worried about their website.
Short answer? Yes. Longer answer: deal with it now, but take this as a nudge to look to the future.
I've spent over 25 years building websites and helping businesses maintain them on all of the major website platforms now in the headlines. So I wanted to share a few thoughts about what's happening, what you should actually be concerned about, and why this whole situation reinforces something I've been saying about website technology for a while now.
First, let's talk about what happened.
What is PHP and Why is Everyone Talking About It?
On October 21, two critical security vulnerabilities were publicly disclosed in PHP, a programming language that powers millions of websites built on WordPress, Drupal, and Joomla.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, can potentially allow hackers to execute malicious code on vulnerable servers without even needing to log in.
That's a pretty big deal.
The vulnerabilities were discovered through AI-assisted security research, and the response involved coordination between PHP's maintainers, OpenAI, Wiz, Google, and other security organizations. If you're curious about the technical details, OpenAI published a fascinating explanation of how the vulnerabilities were discovered and addressed. The New York Times also covered the story, and Google Cloud has a detailed breakdown of the vulnerabilities and recommended fixes.
Here's what I want you to understand: Just because your website uses PHP doesn't mean it's been hacked. But if you're running a vulnerable version, you need to take this seriously.
The PHP team has already released security patches. The immediate question is whether those fixes have actually been applied to your website's hosting environment.
So, Should You Be Worried About Your Website?
If you're using WordPress, Drupal, Joomla, or another PHP-based website platform, I'd recommend checking in with whoever manages your website. Now.
Ask them:
- Is our website running an affected version of PHP?
- Has our hosting provider or development team applied the appropriate security updates?
- Who's responsible for monitoring and maintaining our website's security?
You can find the latest patched versions and technical guidance on PHP's official website.
If we built your site on WordPress and you can’t get a hold of your current website management team, you can reach out to us. While we may not actively host your site, we can certainly point you in the right direction of how to check your site’s health.
One thing I want to clarify: This isn't a WordPress-specific problem. The vulnerability exists in PHP itself, which means updating your WordPress plugins or themes won't necessarily fix it. Your underlying PHP environment needs attention.
If your website is built on HubSpot, Shopify, or Squarespace, you do not need to take action. It’s still a good idea just to check in with your IT department or developer if you’re concerned, but because none of these CMS tools use PHP as a base, this vulnerability doesn’t apply.
Which brings me to something I've been talking about for years.
This Is One Reason I Moved From WordPress to HubSpot
I've written before about why I prefer HubSpot over WordPress for many business websites.
And no, I'm not going to tell you that everyone needs to abandon WordPress tomorrow and rebuild their website on HubSpot. We still work with WordPress, and there are plenty of situations where it's the right option.
But this security issue highlights why I prefer HubSpot’s approach to website development. Content Hub doesn’t use PHP to power its core platform. Instead, it uses a proprietary, cloud-based system, where the underlying infrastructure, platform updates, and hosting are all managed by HubSpot.
Now, I know what the typical argument for WordPress is: it’s open source, which means everything is open to everyone. Which is both a pro and a con. There are situations where that level of hands-on customization is a real advantage, like if you’re building out a completely custom tool from the ground up that needs to be powered by your site. But as we can see from this situation, that openness can create vulnerabilities.
But here's the thing: HubSpot is highly customizable, too. We build custom websites, templates, modules, interactive tools, and integrations in HubSpot all the time. You can create just about any experience a typical business website needs without having to manage the technology running behind the scenes.
And for most businesses, that's the sweet spot. You get the flexibility to build a website that works for your business, while HubSpot takes responsibility for maintaining the core platform, hosting infrastructure, and security updates.
Does that mean HubSpot is immune to security problems? Of course not. No platform is. But when something like this PHP vulnerability reveal comes along, it's one less thing HubSpot website owners typically have to worry about.
My Advice? Don’t Panic. But Don’t Ignore This.
If your website uses PHP, you definitely need to make sure the proper security patches have been applied. If everything is updated and secure now, great! That’s what you need. But I would also encourage you to take this as an opportunity to think about your website more broadly.
How much money, time, and effort are you spending maintaining the technology behind your site? This isn’t just the foundational code itself, it’s also all of your plugins, media, and tools that can leave a virtual door cracked. Which begs the question: is your current platform still the right fit for your business?
Maybe you've been thinking about making a change for a while. Maybe you've never given it much thought because, well, your website works just fine. Either way, I think this is a good reminder that what's happening behind the scenes matters just as much as what your customers see.
And if all of this has you asking questions about your own website, let's talk. I've shared my two cents, but Will and TJ on our team are the guys to talk to about your specific situation. Whether you're concerned about the PHP vulnerabilities, wondering if a different platform might make sense, or just want a second opinion, they're happy to walk through your options with you.
Let’s leave the scary stuff to the haunted houses and trick-or-treaters, not your website’s backend.
BizzyWeb is a Minneapolis-based digital marketing and web design agency that helps companies get the high-quality leads they need to grow and thrive. Our tactics include inbound marketing, SEO, advertising, web design, content creation and sales automation. We are an accredited HubSpot Platinum Partner and we offer full-service HubSpot onboarding, enablement and strategy for new and current users.
