This is why I use static sites

This week PHP shipped emergency fixes for “PHP2Shell”, two critical bugs (CVE-2026-109618 and CVE-2026-109619) in the PHP engine itself. These fix a bug that has existed for over a decade, and they’re the worst kind - Remote Code Execution (RCE). Plugins and app code don’t matter; if your PHP version is affected, so are you. And PHP runs a huge share of the web, WordPress included. Updating WordPress or plugins won’t fix it, only updating PHP does.

So this morning I asked my bots to quickly evaluate my setup for vulnerabilities, and found none.

Why?

My sites are static: plain files served from a CDN, with no PHP or elaborate application server + database etc. running when a page loads. No impact. No concern. Nothing to patch.

Static sites aren’t a magic shield, and managed WordPress hosts have already patched for their customers. But a smaller attack surface means fewer mornings like this impact me, or the sites I’ve built for my customers.

If you run PHP anywhere, including on a NAS or another appliance, update it today (8.5.12, 8.4.27, 8.3.36 or 8.2.35): https://www.php.net/

#WebDev #Security #StaticSites