The PHP security scare is a wake-up call for businesses relying on outdated CMS platforms

By Charlie Hartley, Founder of Show + Tell

The recent security vulnerabilities discovered in PHP have sent shockwaves through the digital world, with government services, major organisations and businesses temporarily taking websites offline to protect themselves against potential cyberattacks.

On 21 October 2026, emergency security updates were released to address two critical vulnerabilities affecting PHP, the programming language behind a significant proportion of the world's websites, including those built using WordPress. The UK's National Cyber Security Centre (NCSC) urged organisations to apply the updates immediately, advising those unable to secure affected systems to consider taking them offline until the risks could be addressed.

For businesses, it's an uncomfortable reminder of just how dependent they are on the technology sitting behind their websites. But while the headlines have focused on PHP, I think there's a much bigger conversation to be had about the technology choices businesses make, how their websites are maintained and whether the content management systems (CMS) they rely on are still fit for purpose.

The real problem isn't necessarily PHP. It's outdated technology.

First, it's important to make a distinction. The discovery of a vulnerability doesn't automatically mean that a website has been hacked. And this isn't a reason to suggest that PHP, or every website built using WordPress, is suddenly unsafe. PHP remains a widely used and actively maintained programming language. WordPress, meanwhile, continues to be a perfectly viable platform for many businesses when developed, hosted and maintained correctly.

The concern is what happens when businesses are operating websites built on ageing technology, unsupported software or increasingly complicated combinations of plugins and integrations. It's something we regularly encounter in the agency world.A website might have been built five or ten years ago, with additional features introduced as the business has evolved. Over time, new plugins are added, bespoke functionality is developed and different suppliers become involved. Eventually, what started as a relatively straightforward website becomes a complicated technical ecosystem that nobody fully understands or wants to touch.

The website might look perfectly fine to customers, but underneath it can be carrying considerable technical debt.

When a serious vulnerability is discovered, that complexity becomes a problem. Can the business identify which systems are affected? Does it know who is responsible for installing updates? Can changes be implemented without breaking important functionality? A website that cannot be updated quickly and confidently is a business risk, regardless of how good it looks.

Why your choice of CMS matters more than ever

For a long time, businesses have selected their CMS based largely on familiarity, upfront development costs or the features available at launch. But the conversation needs to go further. A website is no longer simply a digital brochure. It's a critical part of a business's infrastructure, supporting everything from marketing and lead generation to customer experience, recruitment and sales. That means decisions about the underlying technology should consider long-term maintainability, security, performance and the ability to adapt.

 At Show + Tell, we've been increasingly focused on helping businesses make more informed technology decisions, rather than automatically defaulting to the platforms they've always used. For some organisations, that means continuing with WordPress and investing in better technical management. For others, it means exploring modern CMS platforms such as Webflow and Payload, which can offer a very different approach to website development and ongoing management.

Webflow: reducing the burden of website maintenance

One of Webflow's biggest advantages is its managed infrastructure. Unlike a traditional self-hosted WordPress website, businesses using Webflow's managed hosting don't have to take responsibility for maintaining the underlying PHP installation or managing a large ecosystem of WordPress plugins. That responsibility is largely handled at platform level.

For marketing-led websites, this can significantly reduce the amount of technical maintenance required while giving internal teams greater control over content, landing pages and everyday website updates. It doesn't eliminate security risks entirely. User access, integrations and custom code still need appropriate management. But for businesses that don't need the complexity of a traditional self-hosted CMS, it can remove a considerable amount of unnecessary technical overhead.

Payload CMS: modern architecture with greater flexibility

For businesses with more complex digital requirements, Payload CMS offers another compelling alternative. Built using TypeScript and designed around modern web development practices, Payload provides a flexible, API-first approach to content management.

It allows developers to create more tailored digital experiences without relying on an extensive collection of third-party plugins to deliver essential functionality. Paired with technologies such as Next.js, Payload can provide businesses with a highly adaptable foundation for websites and digital platforms that need to evolve over time.

We've already seen the benefits of this approach through projects such as our migration of Arterius from WordPress to Payload, where the move supported greater flexibility, simpler content management and long-term scalability. Of course, modern architecture doesn't automatically mean better security.

Payload applications still require secure development, dependency updates, appropriate hosting and ongoing maintenance. The difference is the opportunity to build a cleaner, more controlled technology environment around a business's actual requirements. And that's where I see the real value.

What we're advising our clients following the PHP security issue

The immediate priority for any organisation potentially affected by the latest vulnerabilities is to establish its exposure and make sure the appropriate security updates have been applied. That shouldn't wait for a broader conversation about replacing a CMS.

Beyond the immediate response, however, I'd encourage businesses to review the foundations of their website and ask some important questions:

• Understand what your website runs on. Identify the CMS, server technologies, plugins, integrations and dependencies supporting your website. Make sure you know who is responsible for maintaining them.
• Check your maintenance and security arrangements. Confirm that critical updates can be applied promptly, supported by suitable monitoring, backups, access controls and a tested recovery process.
• Review technical debt. If your website relies on outdated plugins, unsupported software or bespoke functionality that's difficult to maintain, understand the risks and the cost of addressing them.
• Reassess whether your CMS is still the right fit. If everyday changes are difficult, maintenance is becoming expensive or your technology is holding back the business, it may be time to explore alternatives.

Crucially, this isn't about encouraging every business to rebuild its website overnight. Moving platforms introduces its own costs, risks and considerations. Any migration should be based on a proper assessment of business requirements and the long-term benefits. But continuing to invest in technology that's becoming increasingly difficult to maintain isn't necessarily the safer or more cost-effective option either.

Is it time to rethink your website technology?

For me, the biggest lesson from this latest security issue is that businesses need to take a more proactive approach to their digital infrastructure. Cybersecurity is often discussed as something that happens after a website has been built. In reality, the decisions made at the very beginning of a project can have a significant influence on how manageable and resilient that website becomes. 

The right CMS should support the way your business operates today, while giving you the flexibility to respond to tomorrow's challenges. That might mean a well-maintained WordPress website. It might mean moving to a more streamlined managed platform like Webflow. Or it might involve a more tailored digital architecture built around Payload.

There's no universal answer. What matters is choosing technology deliberately, understanding the responsibilities that come with it and ensuring that your website remains an asset rather than a growing liability. The PHP vulnerabilities might be making headlines today, but the need for better technology decisions isn't going away.

At Show + Tell, we help businesses assess, design and develop websites using technologies that align with their ambitions. Whether you're reviewing an existing CMS, exploring a migration or planning an entirely new digital platform, our team can help you understand the options.

Talk to Show + Tell about your website technology.