Every WordPress Site Needed an Emergency Fix. Here's Why My Sites Didn't.

I was coding a website when I saw the notification from Wordfence, an email that PHP was hacked. And I thought to myself, good thing our sites are all JSX React. No PHP to crack. Another huge flaw with WordPress.

Bob didn't get to think that. He was on a job all day. Somebody set his site up on WordPress years ago, and it's been sitting there taking calls ever since. He's never heard the word PHP in his life.

But PHP is the thing his whole site sits on. And on October 21, every WordPress site out there needed an emergency fix for it. Here's what happened, in plain words, and why mine didn't need one.

TL;DR

PHP2Shell is two holes in PHP itself, the software every WordPress site runs on. One request, no login, no password, and a stranger could run code on the computer behind the website (Help Net Security, 2026). The fix came out October 21, 2026, so every WordPress site needed it. My 281 AI-JSX sites have no PHP under them, so there was nothing to fix. If you're on WordPress, ask your host this week whether the October 21 fix is on your site.

3 Things to Remember

The Hole Wasn't in a Plugin. It Was in PHP.

Here's PHP in plain words. Every time somebody opens a page on a WordPress site, a computer somewhere builds that page on the spot. PHP is what does the building. Every page, every plugin and every theme sits on top of it. About 69% of websites use it (Wikipedia, 2026).

On October 21, the people who make PHP rushed out a fix for two holes in PHP itself. Folks started calling it PHP2Shell. PHP rated it 9.2 out of 10, and one security company gave it a full 10 (Help Net Security, 2026). That's about as bad as the scale goes.

Here's the part that should land. A stranger sends one request to the computer that runs the website. No login. No password. Nothing for the owner to click. Then they can run whatever they want on it (Help Net Security, 2026).

It worked on the newest version of WordPress too (Patchstack, 2026). So you could update every plugin you own and still be wide open. The plugins weren't the door this time. The floor was.

And don't let anybody tell you WordPress core is fine and it's only the plugins. Core had a no password hole of its own back in July. Now it's the layer under core. Every layer is a door.

Mistake: you think keeping your plugins updated covers you.

Fix: know there's a layer under the plugins, and ask your host if the October 21 fix is on it.

Payoff: you know this week if you're open. Not next month.

Governments Pulled the Plug. Hosts Scrambled.

This wasn't a quiet patch on a slow Tuesday. Governments shut off their own websites on purpose rather than leave them open.

Finland pulled its public government websites. The Netherlands pulled its main government portal and the login its people use for government services. France took down every Interior Ministry website. Denmark shut down its national school platform (Wikipedia, 2026).

The people who run Wikipedia shut down a bunch of their behind the scenes services. Drupal.org, the home of one of the big website platforms, went offline to put the fix on (Patchstack, 2026).

The NSA told sites that couldn't update right away to go offline. The UK said the same thing (Help Net Security, 2026). And the attacks didn't wait around. They started the morning of October 21, the same day the fix came out (Patchstack, 2026).

Sit with that. Those governments have security teams and people whose whole job is watching for this. They still pulled the plug. Every host with WordPress sites on it had the same job that day, get the fix on. You've got a crew to run and a phone to answer.

I wrote up who pulled the plug and why in its own post. Short version: when governments unplug their own sites, your little WordPress site isn't the exception.

Mistake: you figure your host handled it.

Fix: ask, and get a yes on the October 21 fix in writing.

Payoff: you stop guessing, and you've got a name to call if it isn't done.

If You're on PHP 8.1 or Older, You're Still Open.

This is the one spot where a version number matters, so here it is for you to hand your host. You don't have to understand it. You just have to ask.

The fix came out October 21, 2026. The newer versions of PHP got a normal update. The old ones, 8.1 and older, didn't (Wordify, 2026). They're past their expiration date. If your site is on one of those, there's nothing to switch on. Your host has to move you up to a newer version.

That's a lot of websites sitting on a version with no normal fix coming. For them it's not a patch. It's a move.

So here's the email. Three questions, and send it this week:

• Which PHP version is my site on?
• Is the October 21 fix on it?
• If I'm on 8.1 or older, when are you moving me up?

If your site sits behind Cloudflare, they put up a shield for this one, free accounts included (Help Net Security, 2026). Good. That buys you time. It doesn't replace the fix.

Now watch what that list looks like next to a site with no PHP on it.

My Sites Don't Run PHP. That's the Whole Trick.

Everything I build now is an AI-JSX site. 281 of them so far. They're written in React, and there's no PHP under them. So when this one hit, it had nothing to hit.

No version to check. No ticket to open with a host. No patch night. That's why I read that Wordfence email and thought, good thing our sites are all JSX React.

Not because I'm any sharper than you. Because there's nothing there for it to be about. It isn't a better security plugin either. The layer just isn't there.

If you want the plain version of what that kind of site is, here's what an AI site actually is. And if you want to see exactly how I build one, I wrote the whole process down.

I've built more than 10,000 sites in 25 years. I build AI-JSX now for exactly this reason.

Mistake: you think being safe means patching faster than the bad guys.

Fix: take the layer out, so the next PHP hole has nothing to land on.

Payoff: the next emergency is somebody else's emergency.

I run a [TYPE OF BUSINESS] in [YOUR CITY]. My website is
[YOUR WEBSITE ADDRESS] and it runs on [WORDPRESS, OTHER, OR I
DON'T KNOW].

A security hole in PHP called PHP2Shell was fixed on October 21, 2026.

Do four things.

1. Write me three short questions to ask my web host today about
   which PHP version my site is on and whether the October 21 fix
   is on it.
2. Tell me what each possible answer means for me, in one line each.
3. List every page and feature a site like mine usually has, so I
   can check it against my own site. Forms, booking, galleries,
   reviews, anything.
4. Tell me in plain words what it would take to rebuild that same
   site so there is no PHP under it at all.

Rules: write at a 5th grade reading level. Short sentences. No jargon.
Do not make up version numbers or facts about my site. If you are
not sure about something, say you are not sure.

I Moved 1,387 of My Own Posts Off WordPress.

I didn't write this from the cheap seats. I ran my own business on WordPress for years, which means PHP was under my site too. I got tired of reading about holes in my own site, so I moved 1,387 of my own posts off it.

Mine. Not a client's. The page you're reading right now has no PHP under it. So October 21 wasn't a patch night here.

Here's how that move went, rankings and all. It wasn't as bad as I'd built it up to be.

When PHP Isn't Your Problem.

I'll give credit where it's due, and you should weigh it before you take my side. PHP runs most of the web and it has for decades. When this came out, its makers shipped a fix fast. Cloudflare put up a shield for everybody, free accounts included. That's people doing their jobs, and doing them quick.

If your host put the October 21 fix on your site and told you so in writing, you're covered for this one. Good. If you're on Wix, Squarespace or Shopify, this one isn't yours either, because those companies fix their own computers. Close the tab and go run your business.

And if somebody real watches your site, reads the alerts and calls the host the same day, that person is worth every dollar you pay them.

Fair is fair on my side too. My sites didn't need this fix, but that doesn't make them unbreakable. They still need somebody keeping them current. That's my job, and I do it. The difference is there's no PHP under them for this kind of hole to hit.

Now the turn. Most shops don't have that person watching. They've got a host they've never emailed and a WordPress login nobody has opened in a year. And PHP is just one layer. The plugins and the theme sit on top of it, all updating on their own schedule, forever. The next hole will find those sites the same way this one did.

No PHP. No Patch Night.

I'm not telling you your site got broken into. I'm telling you every WordPress site was open to this until the fix went on, and you should check yours this week.

You didn't get into business to learn what PHP is. You got into it to do the work and get paid. A website should be the quiet part of your week. So I'd fix the part that made this your problem in the first place. Not the version number. The layer.

That's what the 100K Site is. An AI-JSX site with no PHP under it, and you're not the one on patch duty. If you want to see your own business on one, take a test drive. I'll put your site on my code, and you look at it before you spend a dime.

Take a Test Drive →

FAQ

Read These In This Order

1. WTF Is PHP? Your Website Runs on It. Are You Safe? Hackers Just Cracked It.
2. Governments Shut Down Their Own Websites. PHP Is Hacked. Is Your Site Safe?
3. No Password Needed. Your WordPress Site Is an Open Door.
4. We Know WordPress Sucks. Now PHP Sucks Too? Don't Let Them Destroy Your Business.
5. How to Build a Website With AI (The Exact Way I Do It)