Highlights
- Two bugs in PHP let an attacker run code on a server without logging in. PHP fixed them on October 21, 2026, and attacks started six hours before the fix.
- PHP is the language behind 69.3% of the web, and WordPress alone runs 39.6% of all websites. Updating WordPress does nothing here; only your host can apply the fix, and about half of PHP sites run a version that will not get one.
- A site built on Bolt.new runs no PHP and carries no plugin stack. The front end, the back end, and the hosting are built to your description and kept current for you.
- Moving a site off WordPress or other PHP-based providers like Drupal or Joomla is an export, a description, and an afternoon.
On Tuesday, October 21, the Netherlands turned off DigiD, the login system its citizens use for taxes, healthcare, and benefits. The Dutch parliament took its website down too, along with RTL News, the tech site Tweakers, and three professional football clubs (NOS, October 2026). None of them had been hacked. They were waiting for a patch to PHP, and they decided dark was safer than exposed.
There is a good chance your site runs on the same thing. The difference is that your host decides whether it stays up. If you've been putting off a new website for a year or three, this is the week the old one made the argument for you.
What is the PHP vulnerability hitting websites?
Php2shell is the name given to two critical bugs in PHP, the programming language that WordPress is written in. Tracked as CVE-2026-109618 and CVE-2026-109619, both let an attacker run their own code on a web server without logging in. PHP's security team released fixes on October 21, 2026 in versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 (PHP, 2026).
Both bugs come from the same kind of mistake. When PHP runs out of memory in the middle of handling a request, it leaves the cleanup half done, and the next request on that server can pick up the mess and treat it as real data. One of the two also leaks memory, the way Heartbleed did in 2014, so an attacker can read what the server was holding at the time.
The flaw has existed since PHP 5.4, released in 2012. It took 14 years for anyone to turn it into a working attack, because the chain of steps was too complex for a person to assemble. The security firm Wiz, working with OpenAI, found it on August 19, 2026 using AI models to assemble the exploit, and called the result "among the most severe vulnerabilities discovered in PHP, and arguably in software history" (Wiz, 2026). Details leaked on October 20, a day early. Cloudflare saw the first attacks at 07:43 UTC on the 21st, six hours before the patch shipped (Patchstack, 2026).
How much damage can php2shell do to a website?
An attacker who lands this exploit owns the server. They can install a web shell, a hidden back door that keeps working after the patch. They can read the passwords, API keys, and session tokens the server had in memory, redirect your visitors, or use your site to attack someone else. Wiz confirmed working attacks against the latest versions of WordPress, Drupal, and Joomla before publishing.
The reach is the whole web. PHP is the server language on 69.3% of websites where the language is known (W3Techs, October 2026), which is where every "70% of the internet" headline this week came from. WordPress alone runs 39.6% of all websites (W3Techs, October 2026), and because WordPress, its plugins, and its themes are all PHP, the bug sits underneath all of them. Patchstack, a WordPress security company, put it this way: the vulnerabilities exist in the PHP interpreter, not in any one application, so a site is exposed no matter how current its plugins are (Patchstack, 2026).
The part that should worry a site owner is who holds the fix. PHP runs on the server, and on shared or managed hosting the host owns the server. Updating your site in the WordPress, Laravel, or Craft CMS dashboard reaches your host, your plugins, and your themes. It does not reach the PHP. Some hosts patched within hours: GoDaddy published instructions the day before the patch (GoDaddy, 2026). Others only patch current versions. And PHP itself only patched four branches. Everything at 8.1 or older is end of life, and PHP's security team will not release an official fix for it (Tenable, 2026).
That matters more than it sounds. By W3Techs' count on the day of the patch, version 7 still runs 27% of PHP sites and version 5 runs 7.7%, and inside version 8, a fifth of sites sit on 8.0 or 8.1 (W3Techs, October 2026). Add it up and about half of PHP sites are on a version PHP will not patch. Some hosts hide version numbers or backport a fix without changing them, so treat that as the exposed ceiling rather than a count of hacked sites. It is still half. CERT-EU, the security team for the European Union's institutions, told organizations that could not patch to consider isolating internet-facing resources from public networks until the fix was in (CERT-EU, 2026). That is the polite way of saying what the Dutch did.
If you're keeping the PHP-based site for now, three things today. Open Tools, then Site Health, then Info, then Server, and read your PHP version: 8.5.12, 8.4.27, 8.3.36, or 8.2.35 means you're patched. If it's anything else, ask your host when PHP will be updated for CVE-2026-109618 and CVE-2026-109619, and if you're on 8.1 or older, whether they've backported a fix. Once patched, change the passwords and keys stored on the server, because one of the two bugs can read them.
Why is an AI builder like Bolt.new the upgrade?
Because a site built on Bolt.new, an AI app builder, has nothing in it for this week's bug to grab, and nothing in it you have to maintain by hand. A Bolt site is a JavaScript front end with a Node.js back end and a built-in database, and Bolt's own documentation says PHP and Python aren't compatible (Bolt.new, 2026). Bolt hosts the published site, so the runtime underneath is Bolt's to keep current. On Tuesday a Bolt owner had nothing to do. A WordPress or Drupal owner had a phone call to make and no way to know whether their host would pick up.
The bigger difference is the shape of the site. WordPress shipped in 2003 and still works the 2003 way: a core, a theme, and a stack of plugins, each a separate codebase you owe updates to whether you use it or not.
A Bolt site is the front end and the back end you described, and nothing else ships. You change it by asking, which means you don't hire someone to change it for you. Node has had critical bugs of its own. The lesson is who holds the patch, and how much code you're carrying that someone else chose. A companion post on what a WordPress alternative looks like without the plugin stack makes the full case, tradeoffs included.
How hard is it to move a PHP-based site to Bolt.new?
For a brochure or service site, it's an afternoon, and most of that is copying text. Four steps.
- Export your content. In WordPress, Tools, then Export, gives you every page and post in one file. Download your images from your host's file manager or a backup. Craft CMS and Drupal have similar export tools.
- Describe the site to Bolt. The business, the pages, the forms, the look. Paste the content in, upload the images, and ask for changes until it's right. There's no theme to pick and no plugins to install; the agent builds what you describe.
- Connect your domain and set redirects. On Bolt's Pro plan you connect the domain you already own. Point every old WordPress URL at its new page so your visitors and your Google rankings follow you.
- Run both for 30 days, then close the previous hosting instance. Google recrawls, your redirects prove themselves, and the maintenance bill stops.
The move will be the easy part. The hard part was waiting for a reason.
By W3Techs' count on the day of the patch, about half of all PHP sites run a version that will not get an official fix. They aren't waiting for an update. They're waiting for someone to notice.
Try Bolt.new now and see what your site could be.
