If your website is on WordPress, it runs on PHP, whether you've heard of PHP or not. PHP just shipped emergency patches for two flaws that researchers showed working against the latest version of WordPress.
What happened with PHP this week?
On October 21, 2026, the PHP project released fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which researchers named PHP2Shell. Both are rated 9.2 out of 10. They let someone take over a server that runs PHP without logging in, and in the setup most at risk a single web request was enough. The flaws go back more than a decade, to PHP 5.4. Fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and older no longer get official updates. Wiz Research, which found the flaws, showed a working attack against the latest WordPress, Drupal and Joomla. Details leaked online on October 20, a day before the fix, which is why PHP moved its release up. As of October 21, security firms had reported attempts to exploit it but no confirmed break-in of a specific server. (Sources: The Hacker News, Help Net Security.)
How do I know if my website runs on WordPress?
Go to your website address with /wp-admin on the end, like yourbusiness.com/wp-admin. If you get a WordPress login page, your site runs on WordPress, and so on PHP. If you get a "page not found," it probably doesn't. You can also ask whoever built the site, or look at your hosting bill: plans called "WordPress hosting," "cPanel" or "shared hosting" usually mean PHP.
What if my site is on Wix, Squarespace or Shopify?
Then there is nothing for you to patch. Those companies run the servers and the software on them, and you never had access to the PHP version in the first place. If you're worried, check their status page or support site, but keeping it patched is on them.
Is my WordPress site in danger?
That's mostly up to your hosting company. The flaw is in PHP itself, which sits underneath WordPress, so even a site with every plugin up to date can be exposed. Your hosting company controls the PHP version. SiteGround, for one, said it put protections on all its servers before the fix came out. Cheap shared hosting, an old plan nobody has touched in years, or a server your old web person set up and walked away from are the cases to worry about.
What should I do today if my site runs on WordPress?
Send your host one question: "Has PHP been patched for CVE-2026-109618 and CVE-2026-109619 on my site?" Get a yes or no in writing. While you wait, a few other things are worth doing:
- Check the PHP version in your hosting dashboard. Anything on 8.1 or older is out of support and should be upgraded anyway.
- Update WordPress, your theme and your plugins. That doesn't fix PHP2Shell, but out-of-date plugins are one of the most common ways small business sites get hacked.
- Make sure you have a recent backup you can actually download.
- If your site already runs through Cloudflare, it has added firewall rules for known attacks, including on free plans. That helps, but it doesn't replace the patch.
- Change the password on your WordPress admin and hosting account if it's one you reuse anywhere else, and turn on two-factor login.
Why doesn't a static HTML site have this problem?
Because nothing runs when someone visits. A WordPress page is assembled by PHP and a database every time it loads, which means there's software on the server answering requests from anyone on the internet. A static site is a set of finished pages, served the same way a photo is. There's no PHP, database or login page on the server, so a PHP flaw has nothing to attack. Static sites can still be hurt in other ways: your domain account, your email and your hosting login still need strong passwords and two-factor. What goes away is server software that someone has to keep patched, which is the problem in the news this week.
What do you give up by leaving WordPress?
Mainly the ability to log in and edit pages yourself, and plugins that need a server. For most contractors and local service businesses that's a fair trade: the site is service pages, town pages, photos, reviews and a contact form, and the form works fine on a static site. Booking widgets like Calendly, Jobber or FareHarbor embed as normal. Where static is the wrong fit: a real online store with a cart, a members-only area, or a site you personally edit every day.
What is the Atlas one-time switch?
We rebuild your WordPress site as static HTML for $499, one time. Same pages, same content, same web addresses where possible, with redirects where they change so you keep the search rankings you've earned. Your contact form gets wired to send leads straight to you. We put the finished site on a free hosting account in your name, so you own it and there's no monthly bill from us. Your domain stays yours. You see it on a preview link before your domain is pointed at it, and nothing changes until you approve.
Can Atlas keep running the site after the switch?
Yes, and if you go that route the $499 is waived. Every Atlas site is built free and runs $99 a month, month to month: we host it, add or update content every two weeks to help you show up on Google and in AI assistants, handle changes when you ask, and send every lead straight to you. Same price for everyone, posted on our pricing page. And because SEO takes time to kick in, the first two months are on us for a few new clients each month.
Who should not switch?
If your host confirms PHP is patched and your site is bringing in work, you don't need to move this week. Online stores with real checkout, membership sites, and sites with hundreds of pages need a different conversation, so ask before you pay anything. And if you like editing WordPress yourself and keep it updated, that's a reasonable choice too. The switch is for owners who never touch their site and aren't sure who, if anyone, is keeping it updated.
Is buildatlas.ai on PHP?
No. Every site Atlas builds, including our own, is static HTML. Our contact forms and phone answering run on small pieces of code we maintain ourselves, none of it PHP, so this week's patches didn't require anything from us or our clients.
