WordPress requires constant maintenance. For any marketer, it almost becomes a second job. There are always plugins to manage, and somebody runs an update, a plugin stops working, and things start breaking.
When I had to rebuild my own site, I found Webflow. It runs on Cloudflare and the hosting is already set up, so I didn’t have to build any of that from scratch. You don’t manage plugins the way you do with WordPress.
I’ve been building on Webflow for over two years. This week showed why.
On Wednesday, October 21, the PHP project shipped emergency fixes for two flaws in PHP itself. The researchers who found them call the pair PHP2Shell. Both are rated 9.2 out of 10, and both let an attacker run code on a server without logging in.
Within hours, governments started turning their own websites off.
Germany, France, Belgium, the Netherlands, Finland and Czechia pulled government sites offline, most of them explicitly as a precaution. None has reported a breach. In the US, CISA told anyone who couldn't update right away, or who was still running PHP 8.1 or older, to "take PHP-based systems offline until they can be patched or updated." The FBI posted the same advice on X, to "take the system offline until it can be fully mitigated," and the NSA told every organization running PHP to be ready to update.
Cloudflare's CEO, Matthew Prince, said on X that his network saw thousands of exploit attempts in the ten hours before the bug was even public, and millions by the next day. Amazon's threat intelligence team says it caught a first attempt on October 17, four days before disclosure.
Those are attempts, not confirmed break-ins. CISA said it hadn't seen exploitation when it published its alert, and officials in Germany, the Netherlands and Japan said they hadn't seen an attack succeed.
If you run marketing for a B2B company, this sounds like an IT story. It isn't. It's a website story, and for a lot of companies the website belongs to marketing.
Why this hits WordPress so hard
By Wiz's count, PHP runs roughly 70% of all websites. WordPress is built on it. Every self-hosted WordPress site sits on top of a PHP install that someone has to keep current.
The researchers at Wiz who found PHP2Shell showed it working, without a login, against WordPress, Drupal and Joomla. They were also clear that you don't need a CMS at all to be exposed. A plain page on a vulnerable PHP version is enough.
Here's the part most marketing teams miss: updating WordPress does nothing here. Updating your theme does nothing. Updating your plugins does nothing. The fix lives in PHP, one layer below everything you can see in wp-admin. Your host has to patch it, or whoever manages your server does.
And the official fixes only exist for PHP 8.2 and newer. According to WordPress.org's own statistics, as of October 22, about 36% of WordPress sites run PHP 8.1 or older. The PHP project no longer ships releases for those versions. Because this one is so bad, its security team did publish bare source patches for 7.4, 8.0 and 8.1, but someone still has to build and install them. Some Linux vendors and hosts have shipped fixed builds. Many sites on cheaper hosting are on their own. Those are exactly the sites CISA told to go offline.
The question Black October forces
Forget "WordPress vs. Webflow" for a minute. The real question is simpler:
When the next PHP2Shell drops, who on your side has to do something, and how fast?
Run through it honestly:
Do you know which PHP version your site runs on right now?
Do you know whether your host has patched it, or is still rolling it out?
If the answer is "our agency handles it," is that in writing, with a response time?
If your site had to go dark for two days, what would that cost in demo requests and paid traffic?
If you can't answer those in five minutes, your website is a risk your team owns without knowing it.
What hosted platforms change
Webflow's trust center says its core services "are not built on PHP and are not affected," and that "no action is required from customers." Webflow customers didn't have to patch, check versions, or call anyone this week.
That's the real difference with a hosted platform. It doesn't make you immune to every risk. Hosted platforms have their own outages, and you give up some control. But you're paying someone else to own the server layer, and they patch it on their schedule, not yours. For a marketing site, where the job is pipeline and not server administration, that's usually the right trade.
WordPress is still the right call for some teams: heavy custom functionality, a strong in-house dev team, or content operations at a scale that needs its plugin ecosystem. If that's you, the lesson from Black October isn't "leave." It's "know exactly who owns your patching, and make sure they're on managed hosting that moved fast this week."
What to do this week
Check your PHP version. In WordPress, it's under Tools, then Site Health, then Info, then Server. You want 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or newer. On anything older, the number won't tell you: a patched vendor build can keep the same version number, so ask your host.
Ask your host one question: "Are we patched for CVE-2026-109618 and CVE-2026-109619, and when?" Get the answer in writing.
If you're on PHP 8.1 or older, treat it as urgent. Upgrade, or confirm your host has a backported fix.
Remember that patching doesn't remove anything an attacker already planted. If you were exposed before the fix, ask for a scan.
Put a number on the risk. What does a day offline cost your pipeline? That number decides whether a platform change is worth it.
Where GTMnext comes in
Anyone I know who needs to move off WordPress, I'll gladly help them move their site into Webflow. We port your existing site as-is, same look, no redesign, and hand you the keys. After that, patching PHP is somebody else's problem for good.
If Black October made you realize you don't know who patches your site, that's where to start.
Talk to us about moving to Webflow
How we work with partners: some tools we recommend are from partners. GTMnext is a Webflow partner.
Researched and drafted by Appleton, edited by David Marsh.
