WTF Is PHP? Your Website Runs on It. Are You Safe? Hackers Just Cracked It.

Bob didn't touch his website this week. He was on a job every day. Somebody set the site up on WordPress years ago, and it's been sitting there taking calls ever since. He's never heard the word PHP in his life.

Then on October 21, the people who make PHP rushed out an emergency fix. Two holes, rated about as bad as these things get. A stranger could get onto the computer that runs Bob's website without a password. No login. Nothing for Bob to click.

Bob didn't do anything wrong. He didn't install a bad plugin. He didn't pick a weak password. He didn't open a sketchy email. The hole was in the thing his whole site sits on.

Most people have never heard of PHP. That's fine. You don't have to know what it is to be running it. If your site is on WordPress, you are, right now.

TL;DR

PHP is the behind the scenes software that runs about 69% of websites, every WordPress site included (Wikipedia, 2026). On October 21, 2026, its makers fixed two holes that let a stranger take over the computer running a website without any password (Help Net Security, 2026). Governments in Finland, the Netherlands and France took their own websites offline over it. If your site is on WordPress, ask your host one question this week: is the October 21 PHP fix on my site? If you're on Wix, Squarespace or Shopify, there's nothing for you to do.

3 Things to Remember

Your WordPress Site Runs on PHP.

Here's PHP in plain words. Your website isn't a picture sitting on a shelf. Every time somebody opens a page, a computer somewhere builds that page on the spot and sends it to their phone. On a WordPress site, PHP is what does the building.

It's old and it's everywhere. About 69% of websites use it (Wikipedia, 2026). WordPress is built on it. So are a couple of other big ones you may have heard of, Drupal and Joomla.

You never see it. You see your homepage, your phone number, your photos of finished jobs. PHP is underneath all of that, doing the work every single time somebody visits.

And WordPress already had its own problems before this one. In July a hole in WordPress itself let strangers in with no password. PHP is the layer under that. So now it's both.

Mistake: you think your website is just a page that sits there.

Fix: know there's software running under it every time somebody visits.

Payoff: you know who to ask when something like this hits.

Not sure what yours runs on? Tap it below. It tells you straight whether PHP is under your site and who's supposed to fix it.

Nobody Needed Your Password.

The makers of PHP rated these holes 9.2 out of 10. One security company gave it a full 10 (Help Net Security, 2026). That's about as bad as the scale goes.

Here's why. A stranger sends one request to the computer that runs your website. That's it. No login. No password. Nothing for you to click. Then they can run whatever they want on it.

Almost everything you've been told about website security is about your password. Make it long. Don't use the same one twice. All good advice. None of it mattered here, because this one never went near the front door.

It worked on the newest version of WordPress too (Patchstack, 2026). So staying current didn't save anybody. The hole was underneath it.

And here's the part that should make you sit up. These holes sat in PHP for years. AI is what made them easy to use (Wikipedia, 2026). The same tools that found them make it easier to break in with them. That's the world your website lives in now.

Mistake: you think a strong password keeps your site safe.

Fix: know some holes never touch your login at all.

Payoff: you stop guarding the wrong door.

They Pulled Their Own Websites.

This wasn't some small story buried on a tech site. Governments shut off their own websites on purpose rather than leave them open.

Finland pulled its public government websites. The Netherlands pulled its main government portal and the login its people use for government services. France took down every Interior Ministry website. Denmark shut down its national school platform (Wikipedia, 2026).

The people who run Wikipedia shut down a bunch of their behind the scenes services. Drupal.org, the home of one of the big website platforms, went offline to put the fix on.

The NSA told sites that couldn't update right away to go offline. The UK said the same thing (Help Net Security, 2026).

Here's the part that should land. Those governments have security teams and people whose whole job is watching for this. They still pulled the plug. You've got a crew to run and a phone to answer.

I wrote up who pulled the plug and why if you want the whole story.

Mistake: you figure that's a government problem, not yours.

Fix: the same PHP runs under your WordPress site. Deal with it the same week they did.

Payoff: one email now instead of a bad surprise later.

One Email Tells You.

Here's the good news. The fix is out, and it's not on you to install it. It's on whoever runs the computer your site lives on. For most people that's the web host, the company you pay every month or every year to keep the site up.

So send them one email. Ask which PHP version your site is on, and whether the October 21 fix is on it. You want a straight answer back, in writing. Not a maybe.

If they tell you you're on 8.1 or older, that's the one to push on. Those old versions are past their expiration date and didn't get a normal fix (Wordify, 2026). Your host has to move you up to a newer one.

If your site sits behind Cloudflare, they already put up a shield for this one, free accounts included (Help Net Security, 2026). Good. That buys you time. It doesn't replace the fix.

Mistake: you assume your host already handled it.

Fix: ask, in writing, and get the answer back.

Payoff: you know instead of hoping.

I own a [TYPE OF BUSINESS] in [YOUR CITY]. My website is
[YOUR WEBSITE ADDRESS].

Here is what I know about it:
Platform: [WORDPRESS, WIX, SQUARESPACE, SHOPIFY, OTHER, OR NOT SURE]
Who hosts it: [YOUR HOST, OR NOT SURE]
Who built it: [NAME, OR NOT SURE]

A security hole in PHP was fixed on October 21, 2026.

Do three things.

1. Tell me in plain words what my website most likely runs on, and
   whether PHP is part of it. If you can't tell, say so and tell me
   how to find out.
2. Tell me who is most likely in charge of fixing it: me, my host,
   my builder, or the platform company.
3. Write a short, friendly email I can send that person today asking
   which PHP version my site is on and whether the October 21 fix is
   on it.

Rules: write at a 5th grade reading level. Short sentences. No jargon.
If you are not sure about something, say you are not sure.

I Ran PHP for Years. Now I Run None.

I didn't write this from the cheap seats. I ran my own business on WordPress for years, which means PHP was under my site too. I got tired of reading about holes in my own site, so I moved 1,387 of my own posts off it.

Everything I build now is an AI-JSX site. 281 of them so far. None of them run PHP. So when this news hit, there was nothing on them to fix. Not because I'm any sharper than you. Because there's nothing there for it to be about.

Here's how that move went, rankings and all. It wasn't as bad as I'd built it up to be.

Where PHP Got This Right.

I'll give credit where it's due, and you should weigh it before you take my side. PHP runs most of the web and it has for decades. When this came out, its makers shipped a fix fast. Cloudflare put up a shield for everybody, free accounts included. That's people doing their jobs, and doing them quick.

If you're on Wix, Squarespace or Shopify, this one isn't yours. Those companies fix their own computers. Close the tab and go run your business.

And fair is fair on my side too. My sites still need somebody keeping them current. That's my job, and I do it. The difference is there's no PHP under them for this kind of hole to hit.

Now the turn. It took an emergency fix, governments going dark, and the NSA telling people to unplug, all to close one hole. And PHP is just one layer under a WordPress site. The plugins and the theme sit on top of it, all updating on their own schedule, forever, on your site.

Your Website Shouldn't Need an Emergency.

You didn't get into business to learn what PHP is. You got into it to do the work and get paid. A website should be the quiet part of your week.

That's the whole idea behind the 100K Site. Fewer moving parts. Fewer doors. And you're not the one on patch duty. If you want the plain version first, here's what an AI site actually is.

Want to see what a site with no PHP under it feels like, built for your own business? Take a test drive. I'll put your site on my code, and you look at it before you spend a dime.

Take a Test Drive →

FAQ

Read These In This Order

1. Governments Shut Down Their Own Websites. PHP Is Hacked. Is Your Site Safe?
2. WordPress Left Your Site Wide Open. The Feds Noticed.