This week, the web had one of its biggest security scares in years. If you run a website, there’s a good chance your IT team, your hosting company, or a nervous colleague has already been in touch about it.
Here’s what happened, what it means for you, how our clients’ websites were protected, and why it confirms something we already believed: the future of secure websites is headless.
What is PHP2Shell?
PHP is the programming language that sits behind a huge share of the web. It powers WordPress, which runs around 40% of all websites, along with Drupal, Joomla, Magento and many others.
On 21 October 2026, the PHP team released urgent fixes for two critical vulnerabilities, known together as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Both were rated 9.2 out of 10 for severity. They affect PHP versions going back over a decade.
In plain terms, the flaws could let an attacker run their own code on a website’s server without needing to log in. From there, they could deface a site, steal data, or use it as a way into a wider network.
Two things made this one different:
- It was found with AI. Security researchers used AI tools to uncover weaknesses that had been sitting unnoticed in PHP for years.
- Updating WordPress doesn’t fix it. The problem is in PHP itself, the engine underneath. Updating WordPress, your theme or your plugins won’t close it. Only patching PHP on the server will.
Some organisations took their websites offline as a precaution while they waited for patches.
How our clients’ websites were protected
Our WordPress websites are hosted with WP Engine, one of the world’s largest specialist WordPress hosting platforms. This is exactly the kind of moment that managed hosting is for.
WP Engine moved quickly and in two stages:
- Protection before the patch. Before the official fix was released, WP Engine put mitigations in place across its network and server layers. Think of it as a security guard on the front door, blocking attempts to exploit the flaw before they reach a website.
- The permanent fix. Once PHP released the patch, WP Engine applied it to the sites on its platform automatically. Our clients didn’t need to do anything.
Alongside that, our technical team monitored the situation throughout and stayed in touch with clients and their IT teams. Every WordPress site we look after stayed online and protected.
If your site isn’t with us: ask your hosting provider to confirm, in writing, that PHP has been patched for both CVEs. If you manage your own server, update PHP to the latest patched release now. Updating WordPress alone isn’t enough.
Why we build headless
Good hosting kept our clients safe this week. But PHP2Shell is a reminder that any website where the public pages and the content management system (CMS) run on the same server has a bigger target painted on it.
That’s why headless is now our default approach for new websites. It’s the same setup we’ve used for the new Adigi website.
What does headless mean?
A traditional WordPress website does two jobs on one server: it stores and manages your content, and it builds every page a visitor sees. Every visitor, and every attacker, talks directly to WordPress and PHP.
A headless website splits those jobs in two:
- The front end – the website people actually visit – is built with modern tools (we use Astro) and served from a fast global network (we use Vercel). There’s no PHP on it at all.
- The back end – WordPress – is still where your team edits content, using the same familiar editor. But it sits privately behind the scenes, locked away from the public internet.
Why it matters for security
- Attackers can’t reach PHP through your website. The public site doesn’t run PHP, so a flaw like PHP2Shell can’t be exploited through it.
- The CMS is locked down. We restrict access to WordPress so only your team and ours can reach it, and its content feed needs a secure key.
- Your site stays up. Most pages are built in advance. If the CMS ever needs to come offline for maintenance or a security fix, your live website keeps running as normal.
- It’s still patched. We keep the CMS on managed hosting, so security updates are applied for us. Headless reduces the risk; it doesn’t replace good housekeeping.
The other benefits
Security is the headline, but it’s far from the only reason we build this way:
- Speed. Pages are served from a global network close to your visitors, so they load fast. That’s good for users, conversions and Google.
- Reliability. Traffic spikes from a campaign or press coverage don’t slow the site down.
- Flexibility. The same content can feed your website, an app or other channels.
- No retraining. Your team keeps editing in WordPress, just as they do now.
Is headless right for every website?
Not always, and we’ll be straight with you about that. Sites that rely heavily on WordPress plugins, or large WooCommerce shops, can be harder and more costly to run headless. For those, a well-built traditional WordPress site on strong managed hosting like WP Engine remains a secure, sensible choice. We’ll always recommend the setup that fits your business, not the one that’s fashionable.
The bottom line
PHP2Shell won’t be the last vulnerability of its kind. AI is helping researchers find flaws faster, and it’s helping attackers too. The best protection is to be on a platform that responds within hours, and on an architecture that gives attackers less to aim at.
For our clients, that means managed WordPress hosting today, and headless builds going forward.
Worried about your website?
If you’re not sure whether your website is protected, or you’d like to talk about moving to a faster, more secure headless setup, get in touch. We’re happy to take a look.