Critical PHP Security Vulnerabilities: Why Our Static Websites Are Not Affected

On October 21, 2026, the PHP development team released emergency security patches for two critical vulnerabilities that can allow hackers to execute code on a web server without logging in. They are identified as CVE-2026-109618 and CVE-2026-109619, and the official warning covers PHP installations handling web requests, including the technology commonly used to run WordPress websites. Source: PHP's official security announcements.

Our websites at Oak Harbor Web Designs are not affected by these PHP vulnerabilities. We don't use PHP or WordPress to render our static business websites. We build the pages ourselves and deploy finished HTML, CSS, and JavaScript files instead. There is no PHP interpreter processing visitor requests, so these PHP exploits have nothing to execute against on our sites.

That's one of the biggest reasons we build websites this way. And this latest security issue is a pretty good example of why the technology behind your website matters just as much as what it looks like.

What Happened With the October 2026 PHP Security Vulnerabilities?

The PHP security team announced fixes for two critical flaws on October 21. According to its official release notices, the vulnerabilities can allow unauthenticated remote code execution. That is a technical way of saying someone may be able to make a vulnerable server run commands without first getting a username or password.

Think about what that means for a small business website. If a server is vulnerable and an attacker successfully exploits it, the problem can go far beyond someone changing a paragraph on your homepage. Depending on the server's permissions and configuration, an attacker might be able to access files, interfere with the website, or gain access to information available to the compromised service.

PHP released fixes in versions 8.2.35, 8.3.36, 8.4.27, and 8.5.12. Its guidance was to update immediately, because there are no complete mitigations that can take the place of the patches. Source: PHP release archive.

There are a lot of dramatic stories circulating about this incident. We are sticking to what the PHP maintainers themselves have confirmed rather than repeating claims about outages, how long the bugs existed, or who discovered them without independently verified evidence.

Why Does This Affect WordPress Websites?

WordPress runs on PHP. When someone visits a traditional WordPress website, the server runs PHP code to assemble the page, communicate with the database, and send the result back to the visitor.

That can be a useful setup. WordPress is flexible and lets people manage large amounts of content without touching code. But it also means the website depends on PHP, the WordPress software itself, and often a collection of themes and plugins that all need to be maintained.

In this particular incident, the problem is in PHP itself rather than a WordPress plugin. That matters because removing an outdated plugin wouldn't fix the underlying PHP vulnerability. The hosting environment still needs to run a patched version.

We've written before about how WordPress's conflict with WP Engine affected website owners. That was a different kind of problem, but it illustrated something we've talked about for years: when your website depends on another software ecosystem, decisions and problems inside that ecosystem can end up becoming your problem too.

Why Our Static Websites Don't Have This PHP Problem

We do things a little differently at Oak Harbor Web Designs. Instead of installing WordPress and relying on PHP to build the page each time someone visits it, we write the code ourselves. Our build process produces static files, which our hosting provider sends directly to visitors.

For a typical small business website, most of what needs to be displayed is already known. Your services, photos, contact information, location, and page content don't need a database query or PHP script every time someone loads the page.

So why introduce that extra software if we don't need it?

Our websites don't have a public WordPress admin login to attack. There are no WordPress plugins installed on the production website that need constant updates. And there is no PHP application on the site waiting to process a request from an unknown visitor.

That eliminates several entire categories of attacks against traditional PHP-powered websites. Not just these two CVEs, but vulnerabilities that specifically require PHP execution, a WordPress admin interface, or vulnerable WordPress plugins on the live site.

It doesn't mean our sites are impossible to hack. Every website is still delivered by infrastructure, and things like compromised accounts, insecure third-party scripts, DNS attacks, or hosting misconfigurations can still cause problems. But avoiding software we don't need gives attackers fewer places to start.

Can a Static Website Stay Online for Years Without Security Updates?

Yes, a static website can continue serving the same HTML and CSS for years without needing a new PHP release, WordPress core update, or plugin patch, because those components aren't part of the deployed website.

There is an important difference between a website that can keep running and one that never needs maintenance. We still need to keep an eye on hosting accounts, build dependencies, any JavaScript libraries we use, outside services, and other security requirements. Content changes and accessibility improvements matter too.

But we're not waking up to this week's emergency WordPress or PHP patch and wondering whether hundreds of business websites will break when we apply it. A PHP vulnerability doesn't suddenly turn our static HTML files into an exploitable PHP application.

And if you've ever updated a WordPress plugin only to find that it broke another part of your site, you can probably understand why we prefer keeping the live website as simple as possible.

AI Is Making Website Security More Complicated

Artificial intelligence is making it easier for researchers to inspect large amounts of code and investigate possible security weaknesses. Those same capabilities can also help attackers look for weaknesses faster or automate parts of their work.

That doesn't mean every claim about AI finding a new exploit is accurate. We haven't verified the stories attributing the discovery of these specific PHP flaws to named AI models, so we won't present that as a confirmed part of this incident.

What we can say is that code running on an internet-facing server introduces something that needs to be secured. The more software involved, the more software versions and potential vulnerabilities somebody has to keep track of.

For many business websites, we can avoid a large part of that responsibility by publishing prebuilt pages instead of running a full content management system on every request.

Is a Static Website Better Than WordPress for a Small Business?

For the kinds of small business websites we build, we think it usually is. If you need a website to explain your services, show your work, answer questions, and help customers contact you, you probably don't need an application server assembling those pages on every visit.

There are situations where WordPress makes sense. A site with specialized publishing workflows or plugins that provide functionality the business genuinely needs may benefit from a managed WordPress installation. The tradeoff is accepting responsibility for its software and infrastructure.

We prefer a setup where we control the design and code, keep the production site lightweight, and avoid server-side software that adds little benefit to the business. We also pay close attention to speed. If you want to see some of our thinking on that, we wrote a detailed guide on optimizing website page speed and Core Web Vitals and another on building responsive websites from scratch.

That's how we approach web design for small businesses in Oak Harbor and for clients we work with across the country. Build only what the website needs, and don't make the owner responsible for maintaining an entire software stack if it isn't necessary.

Frequently Asked Questions About PHP and Static Website Security

Are static websites vulnerable to PHP exploits?

A static website that doesn't execute PHP is not vulnerable to an exploit that requires PHP code to run on its server. It can still be affected by other problems involving hosting, credentials, browser scripts, or third-party services.

Does every WordPress website need to update PHP after these vulnerabilities?

PHP has urged users of affected PHP installations to update immediately to a fixed version. WordPress website owners should check their hosting provider's PHP version and confirm that the relevant security update has been applied. Updating WordPress alone does not necessarily patch the PHP runtime.

Can a static website be hacked?

Yes. Static websites generally have a smaller application attack surface, but they're not immune to account takeovers, compromised deployment pipelines, unsafe third-party scripts, or infrastructure attacks. Good security practices still matter.

Do static websites need updates?

They do, but they typically don't need the same PHP, WordPress core, theme, and plugin updates as a conventional WordPress installation. Hosting configuration, dependencies, external integrations, and site content still need appropriate maintenance.

Is it worth switching from WordPress to a static website?

It depends on what your website does. For a typical service business that mainly needs informational pages and a way for customers to get in touch, a custom static website can remove a lot of software overhead. A business with complex dynamic features needs to assess those features before switching.

Why We Continue to Build Websites Without WordPress

We started building custom websites because we wanted more control over how they looked, how fast they loaded, and how they worked. Security is another reason we've stayed with that approach.

The PHP vulnerabilities announced this week are serious, and businesses using PHP should follow the official patch guidance. Our static websites don't require those PHP patches because PHP isn't part of the live website in the first place.

If you're running a WordPress website and tired of dealing with software updates, broken plugins, and security warnings, take a look at how we build custom websites at Oak Harbor Web Designs. We'd be happy to explain whether a static website is a good fit for your business.