Yesterday's PHP vulnerability was a reminder: website security is about ownership, not platforms

21 October 2026 saw the release of critical PHP security updates. For businesses, it was another reminder that keeping a website secure requires more than choosing the right technology. It requires someone taking responsibility for it.

Yesterday, two critical vulnerabilities in PHP were addressed through emergency security releases. Both were rated 9.2 on the CVSS severity scale and could potentially allow attackers to execute code remotely on vulnerable servers. For anyone responsible for websites running PHP, this was something that needed immediate attention. At Ainley Digital, I was able to identify the affected infrastructure and apply the necessary updates with minimal fuss.

Not because the vulnerabilities weren't serious. They absolutely were, but because I already knew what I was looking after.

Knowing what you've got is half the battle

Every website I manage has a known home. I know which server it runs on, which version of PHP it's using and what needs to be considered before making changes. When yesterday's security announcement arrived, I wasn't starting from scratch. I didn't need to work out where websites were hosted, dig through old documentation or establish which versions of PHP were running.

That information was already available. It meant I could focus on applying the appropriate patches, checking that everything continued to work and getting on with the day. The important work wasn't just what happened yesterday. It was the work that had already been done to make yesterday straightforward.

That's what taking ownership of a website looks like.

Your website shouldn't become your problem every time something goes wrong

Most businesses don't particularly care what version of PHP their website is running. Nor should they have to. They care that their website is available, their customers can use it and their business isn't being put at unnecessary risk. If you're paying someone to look after your website, you should have confidence that they understand the technology behind it and are keeping it maintained.

That doesn't mean vulnerabilities will never happen. No developer, agency or platform can make that promise. It means that when something does happen, somebody knows what needs doing and takes responsibility for doing it. Good website maintenance often goes unnoticed. And, in many ways, that's exactly how it should be.

Is moving to a hosted platfrom the answer?

During yesterday's announcements, I saw another agency suggest that vulnerabilities like this were precisely why they were recommending platforms such as Webflow and Shopify to their clients. I understand the argument. Both platforms manage significant parts of their underlying infrastructure. Security updates to those systems are handled centrally, rather than requiring an individual developer or agency to maintain the servers themselves.

For plenty of businesses, that's a genuine advantage. There are also very good commercial reasons to choose either platform but suggesting that moving to a managed platform solves the problem of website security misses an important distinction.

You're changing who's responsible for certain parts of your website's security. You're not eliminating the responsibility altogether.

Shopify, for example, has an enormous ecosystem of third-party apps, themes and integrations. Those additions can introduce their own risks, whether through vulnerabilities in custom code, inappropriate permissions, insecure integrations or poor configuration. Webflow has similar considerations around third-party applications, custom scripts and integrations.

Both platforms have security processes in place, but neither can remove every risk introduced by the wider ecosystem around a website. A secure core doesn't automatically mean every piece of software connected to it is secure.

This isn't an argument against hosted platfroms (if they are the correct tool for the project we are totally onboard, infact we are due to launch a webflow site shortly). It's an argument against treating the choice of platform as a substitute for ongoing technical responsibility.

Choose the right platform. Then look after it properly.

I've never believed that every business needs a bespoke website, or that a particular content management system is automatically the best choice. A small business might be perfectly suited to Webflow. An online retailer could be better served by Shopify. Another business might need the flexibility of WordPress or a bespoke PHP application.

The right answer depends on the business, its requirements, its budget and what it needs the website to achieve. Whatever platform you choose, somebody needs to understand what's running, what depends on what, where the risks are and who's responsible when something needs attention.

Yesterday wasn't an argument for abandoning PHP, WordPress or any other technology. It was a reminder of why proper ownership matters.

Security isn't a one-off job

You don't make a website secure on launch day and consider the job finished. Technologies evolve. Vulnerabilities are discovered. Software needs updating. Dependencies change.

Yesterday, I patched the servers I manage without unnecessary drama because I had the information and access needed to act. That's not particularly exciting. It doesn't make for a dramatic case study. It's exactly the sort of thing I believe businesses should expect from the people responsible for their websites.

The real question isn't whether your website runs on PHP, Shopify or Webflow. It's whether you know who's looking after it when something goes wrong.

At Ainley Digital, that responsibility is something I take seriously.

If you're unsure who's responsible for maintaining your website, what technology it's running or whether it's being kept up to date, it's worth finding out before the next security vulnerability makes the headlines.