Your company’s website carries your reputation, explains your services, and helps customers decide whether to trust you. The technology behind it deserves the same attention as its design.
Fireship’s October 23 video, The most vulnerable week in internet history, puts PHP2Shell among a series of major security incidents. For businesses running WordPress, it highlights a dependency that is easy to overlook: the software underneath the website.
What the PHP2Shell vulnerabilities mean for your website
On October 21, 2026, PHP released emergency fixes for two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. These flaws can allow attackers to execute code remotely without logging in. PHP’s security team identified installations serving web requests as at risk, with the highest risk in Apache deployments using mod_php, where a demonstrated attack can trigger before application code runs. PHP security advisory
That does not mean every PHP website was breached. It means affected, unpatched systems face a serious vulnerability. Sophos even corrected an initial report of successful exploitation, stating that its customer telemetry showed scanning and failed attempts, with no evidence of successful compromise at that update. Sophos investigation
For business owners, the practical lesson is clear: a website can look healthy while an underlying component needs an urgent security update.
How many websites use WordPress?
WordPress’s scale makes this especially relevant. As checked on October 26, 2026:
| Measurement | Reported figure |
|---|---|
| Websites using WordPress in W3Techs’ survey | 39.6% |
| WordPress share among websites with an identifiable CMS | 58.3% |
| Live WordPress websites detected by BuiltWith | 37,259,080 |
Sources: W3Techs and BuiltWith. These services use different measurement methods; the detected website count is separate from the market-share estimate.
What sits behind a WordPress site?
Behind a typical WordPress site sits a collection of separately maintained components: PHP, a MySQL or MariaDB database, hosting software, WordPress itself, themes, and plugins. WordPress’s own requirements warn that older, end-of-life PHP and database versions may expose websites to security vulnerabilities. WordPress requirements
Keeping the WordPress dashboard updated therefore covers only part of the responsibility. PHP2Shell affects the PHP runtime itself, so updating a theme or plugin alone cannot fix it. The underlying PHP software must be updated. Cloudflare technical analysis
AI already decides how your brand shows up.
Every prompt, citation, and recommendation is a signal. igeo.ai turns that behavior into clear answers and the next action, whether that’s a page to rewrite, a schema to add, or a story to publish.
The ongoing security responsibility of WordPress plugins
Plugins create another maintenance challenge. Patchstack’s 2026 security report recorded 11,334 newly disclosed vulnerabilities across the WordPress ecosystem during 2025, a 42% increase over 2024. Approximately 91% were in plugins, while only six low-priority issues were reported in WordPress core. The report also found that 46% lacked a developer fix when publicly disclosed. These figures count vulnerabilities, not breached websites. Patchstack security report
For a company website assembled from numerous plugins, security depends partly on how quickly multiple independent developers identify problems and deliver fixes. That is an ongoing operational commitment.
A static website foundation with igeo.ai
This is where moving to igeo.ai becomes a practical option for content websites.
Its published website foundation includes static HTML, page metadata, sitemaps, structured content, and Google Cloud hosting. In a static publishing architecture, pages are generated before visitors request them. Serving those pages without a public WordPress/PHP runtime removes those specific runtime and plugin attack paths from the published content. That is a concrete architectural benefit; overall security still depends on accounts, deployment systems, scripts, and integrations. igeo.ai website foundation
Prepare your company website for AI search
The opportunity extends beyond security maintenance. Your website also needs to present information clearly to search engines and AI systems.
igeo.ai’s website service brings together crawlable HTML, meaningful navigation, descriptive URLs, metadata, and structured content. It connects the website with AI visibility monitoring and AI Search Console, giving teams a way to observe discovery after publication. These foundations support AI readiness, while indexing, rankings, and citations remain decisions made by external search systems. igeo.ai websites
Plan your WordPress migration with igeo.ai
Migration can begin with the content you already own. igeo.ai offers guided migration from WordPress, including a review of existing pages, images, structure, important URLs, and redirects. Teams can request ongoing website changes through Joe in WhatsApp or Slack. Stores, memberships, and custom application features require separate assessment. Migration and ongoing updates
For companies whose websites primarily explain their business and publish useful content, this is a timely opportunity to simplify the publishing architecture and improve AI readiness together. Existing PHP vulnerabilities should be patched immediately while that migration is planned.
Bring your content forward. Give your company a modern website foundation built for people and AI search. Plan your migration with igeo.ai.
