We warned about the silent crisis on October 2. Nineteen days later, the NSA told PHP sites to patch or go offline.

Check Your Website First

Run the free PHP2Shell Exposure Checker to inspect whether your server publicly reports an end-of-life or unpatched PHP version.

From the October 2 Warning to the October 21 NSA Advisory

On October 2, 2026, Jason Falls and I published The Silent Crisis on the Web on Falls Partners (alongside the open letter here). We warned that most business websites run on aging, plugin-heavy stacks that quietly cost them speed, security, and visibility in AI search.

Nineteen days later, on October 21, 2026, the PHP Group released emergency updates (8.5.12, 8.4.27, 8.3.36, and 8.2.35; PHP 8 ChangeLog) for two critical CVSS 9.2 vulnerabilities known as PHP2Shell: CVE-2026-109618 and CVE-2026-109619 (plus a lower-risk issue, CVE-2026-115560, scheduled for PHP’s next regular release). The U.S. National Security Agency urged operators to patch immediately or take vulnerable servers offline (Hoodline, TechCrunch). In the United Kingdom, 32 government services were taken offline as a precaution according to a minister in the House of Lords, alongside preventive shutdowns in Australia and six European countries (Wikipedia, CNBC). PHP 8.1 and older versions (5.4–8.1) are end-of-life and received no official upstream fix.

Video Briefing: The Silent Crisis on the Web (5 min 35 sec)

Read the companion post and full transcript: Three Weeks After “The Silent Crisis,” the NSA Told PHP Sites to Patch or Go Offline.

Three Rebuild Rungs (Live Pricing from /website-rebuild/)

• Rung 1 · Theme-Level Hybrid Rebuild ($5,000 – $15,000, Typically 2–6 weeks): A new front end built as a custom WordPress theme. Your editors, URLs, and content stay; the page builder, the bloat, and most of the plugins go. Live example: Marketing Podcast Network.
• Rung 2 · Decoupled Hybrid Build ($12,000 – $35,000, Typically 4–10 weeks): WordPress becomes the back office and a React application becomes the storefront, with a server-rendered fallback so AI crawlers still read every route. Live example: ChrisSlater.ai.
• Rung 3 · Full-Stack Application Build ($25,000 – $75,000+, Typically 6–16 weeks): No WordPress and no PHP. A purpose-built application with its own database (Postgres or Firestore), accounts, admin screens, APIs, and background jobs. Live examples: OneFront, ClipMaster, Florida Man AI, Lakewood Ranch AI.
• Build & Operate Retainer ($2,500 – $7,500/mo, Ongoing): Staged migration between rungs, monthly releases, performance budgets, security/backup ownership, and AI-search visibility monitoring.

Start a rebuild conversation → or compare full details on /website-rebuild/.

Sources & Advisories

• Falls Partners (Oct 2, 2026) — The Silent Crisis on the Web (Jason Falls with Chris Slater)
• Chris Slater (Oct 23, 2026) — Three Weeks After “The Silent Crisis,” the NSA Told PHP Sites to Patch or Go Offline
• NVD — CVE-2026-109618 & CVE-2026-109619 & CVE-2026-115560
• PHP.net Official PHP 8 ChangeLog
• Hoodline (Oct 22, 2026) · TechCrunch (Oct 21, 2026) · CNBC (Oct 22, 2026) · Wikipedia — PHP2Shell