there are already 74 billion reasons and counting to break up with (or stay away from) WordPress (which around 40% of all websites run on), but you can officially add PHP2Shell to the list.

PHP enables nearly 70% of all websites on the internet with an identifiable server-side programming language. WordPress relies on it, but PHP's massive footprint extends also to other giants (think Drupal + Joomla + Magento + Laravel, etc)

22 years ago in 2004, security pioneer Stefan Esser identified a critical PHP memory-limit vulnerability. now, two newly disclosed vulnerabilities show how dangerous PHP’s memory-handling flaws remain. these affect unpatched PHP releases dating back to 5.4 (released March 2012), including the current 8.5 series (released Nov 2025): an unauthenticated attacker can execute code remotely on a vulnerable PHP server, potentially taking over the site 😱 (Nick Rogers does a detailed, albeit highly technical, roundup of the issue.)

portfolio sites, blogs, and business websites that don't require user login systems, complex shopping carts, real-time databases, or personalised user dashboards can avoid this whole category of PHP risk by using a static site generator (SSG). a purely static deployment needs no live application database / server-side page generation. so, with no PHP handling web requests, a vulnerability like PHP2Shell has nothing to hijack.

want a sense of how serious this is? Even Japanese PM Sanae Takaichi tweeted out urging PHP website owners to apply the patch ASAP or take their websites down temporarily if they couldn't. (governments around the world have been doing just that; even parts of Wikimedia went offline while they patched up!)