On 20 October, the PHP Foundation announced two critical security vulnerabilities, both scoring 9.2 out of 10 for severity.
PHP powers a huge portion of the internet, including WordPress, so this is a pretty big deal.
If your website runs on PHP, the immediate priority is to check your setup and apply the latest security updates. But I think it's also a good opportunity to ask a bigger question.
Does your website actually need to run on PHP anymore?
For years, WordPress has been the default choice for business websites. And for good reason. It's flexible, familiar and has an enormous ecosystem.
But for many businesses, particularly those running relatively straightforward marketing websites, it's often more complicated than it needs to be.
Plugins, server maintenance, security updates and ongoing dependencies all add overhead.
There's a better way to build
Modern frameworks like Astro and Next.js allow us to build incredibly fast websites, often serving pre-generated pages without needing a traditional PHP server or database running behind every request.
That means fewer moving parts, a smaller attack surface and potentially lower hosting and maintenance costs.
It doesn't make your website immune to security vulnerabilities, but it can remove a lot of unnecessary complexity.
And with modern content management systems, you don't have to sacrifice the ability to edit and manage your content.
Thinking about migrating?
I've been moving towards building more websites using modern frameworks, with a focus on performance, simplicity and long-term maintainability.
If you're running a WordPress or PHP-based website and wondering whether there's a better way to build it, I can help you figure that out and handle the migration.
Not every website needs rebuilding. But if yours does, this might be a good time to start the conversation.
Further reading: Cloudflare's PHP security update and UK National Cyber Security Centre guidance.