Scared to touch your WordPress site?Start fresh before the next PHP exploit

PHP security problems keep coming. This might be the final straw.

Every few months there's another one: a serious hole in PHP, the language WordPress runs on, or in a plugin or theme. Each time, someone has to notice, update, and check that nothing broke. If you run a small business, that someone is usually you, or whoever you pay.

You can keep doing that. Or you can move your site over before it becomes a problem.

WebZum sites are static pages served from AWS. No PHP, no WordPress. You never install plugins or run updates.

Free to see, pay to publish. Sign up, and WebZum builds your new site in minutes. Look it over free for 30 days. Publish for $19/mo, with a 30-day money-back guarantee.

Signup required. 30-day money-back guarantee. No contract.

Why WordPress means PHP, and PHP means upkeep

WordPress is written in PHP. WordPress.org's own requirements page recommends that your host run PHP 8.3 or newer, and it warns that older versions have reached end of life and "may expose your site to security vulnerabilities" (WordPress requirements).

PHP versions don't last forever either. The PHP project gives each version a set window of security fixes, then stops (PHP supported versions). PHP 8.2, for example, gets security fixes only until Dec 31, 2026.

And serious PHP flaws aren't rare. A few examples, all rated 9.8 out of 10 ("Critical") by the U.S. National Vulnerability Database:

• 2024: CVE-2024-4577, a PHP flaw affecting some Windows setups running PHP-CGI (NVD).
• 2018: CVE-2018-7600, "Drupalgeddon 2," in another PHP-based CMS (NVD).
• Oct 2026: php2shell. See below.

None of this means your site will be attacked. It means a PHP site is a machine that needs regular maintenance, forever.

The latest example (Oct 2026)

On Oct 21, 2026, the PHP team released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical flaws, CVE-2026-109618 and CVE-2026-109619 (php.net advisory). CISA, the federal cybersecurity agency, calls them "php2shell."

What it is, in plain English: in the worst case, someone on the internet could send your server a request and run their own code on it, without logging in. That's what "unauthenticated remote code execution" means. The bug is in PHP itself, not in WordPress, so it matters for any site running PHP to serve web pages. The PHP team says the risk is highest on Apache with mod_php.

The proof:

• PHP team: "All PHP users are strongly encouraged to update immediately." Only an update is a complete fix (php.net).
• CISA (Oct 21, 2026): "CISA strongly urges organizations to immediately patch" both flaws and update to the fixed versions (CISA alert).
• NVD: both rated 9.8 Critical (CVE-2026-109618, CVE-2026-109619).
• NSA Cybersecurity posted on X the same morning advising organizations that use PHP to be ready for an update fixing two critical vulnerabilities (NSA post).

Staying on WordPress? Do this

If you're not ready to move, keep your current site maintained. Do it even if you plan to move.

1. Ask your host or developer which PHP version your site runs and whether it's on a version that still gets security fixes. Get the answer in writing.
2. Check it yourself: in WordPress, go to Tools > Site Health > Info > Server.
3. Update PHP to a supported version (PHP supported versions).
4. Update WordPress, plugins and themes. Remove plugins you don't use. Old plugins can break on newer PHP, so test after.
5. Back up your site somewhere off your server, before and after updates.
6. Watch for warning signs: admin users you don't recognize, pages you didn't make, warnings from your host. Call your host first.

How moving to WebZum works

Paste your current website and get a fresh new one in minutes, built from your info and photos.

1. Paste your current site's address into the WebZum chat. WebZum reads up to 5 pages of your site (home, then pages like About, Services and Contact), uses it as the source for your business name, services, story and team, reuses up to 12 of your real photos, and writes all-new pages.
2. Answer a few questions, then click Build. Your new site is ready in minutes.
3. Change anything by chat: text, photos, pages, hours, colors.
4. Publish when you're happy. $19/mo. Your old site stays up until you point your domain to the new one.

Good to know: WebZum rebuilds your site; it doesn't copy it. It doesn't carry over your logo, your old wording, your blog posts, your page addresses or redirects, or your search rankings. You upload your logo or get a new one. Some sites can't be read, such as ones that only load with JavaScript or sit behind bot blockers. If that happens, just describe your business instead.

Is WebZum right for you? It's a good fit for a local business site: services, about, contact, hours, photos, a blog. If your WordPress site is a big online store or depends on special plugins, check that WebZum covers what you need before you switch. You can add outside booking or payment widgets, and those run on their own companies' servers.