Is Wordpres dead? The PHP panic and the hustlebros who cashed in

A week or so ago a bug in PHP took websites offline all over the world. Within about ten minutes, some LinkedIn wanker was telling you to bin your WordPress site.

I wrote a LinkedIn post about it in a fit of rage, then recorded a whole podcast episode because LinkedIn wouldn’t let me say everything I wanted to. This is the written version. It covers what actually broke, why it had sod all to do with WordPress, and why the people shouting loudest (including me) on social media are so often the last people you should be listening to.

What actually happened with PHP

The facts seem to have gone missing somewhere between the news and your LinkedIn feed, so here’s a quick recap.

PHP released emergency security fixes for some seriously nasty flaws. The researchers who found them called it PHP2Shell. In plain English, the bugs could let an attacker run their own code on a web server without logging in.

That’s bad. I’m not going to pretend it wasn’t. Websites around the world went offline for a while as people patched, including government sites in France, Denmark, Finland and the Netherlands. Wikipedia took systems down as a precaution. In Japan, an airline, a railway company and one of the country’s biggest banks suspended some services.

Then the patches went out, the hosting companies applied them on their servers, and for most small businesses on decent hosting, that was it. Sorted. A lot of you didn’t have to lift a finger, because this was fixed at host level, not inside your website.

A PHP problem, not a WordPress problem

PHP is a programming language, and an awful lot of the web is built with it. The figure being quoted is that it runs around 70 per cent of websites. WordPress uses it. So do Drupal, Joomla and Magento, which runs a huge number of online shops.

The researchers showed the attack working on WordPress, Drupal and Joomla. They said outright that any PHP site on an unpatched version could be exposed, right down to a basic one-page “hello world” site.

PHP lives on the server. Your CMS, whether that’s WordPress, Drupal, Joomla or anything else, sits on top of it. So this was a server problem, not a CMS problem. Moving your site to a different CMS on the same unpatched server would have fixed precisely fuck all.

Then the hustle bros turned up

Within about ten minutes of it hitting the news, my feed looked like this:

“WordPress is dead.”

“You need to move your website off WordPress NOW.”

“This is exactly why we built our AI website platform. Comment WEBSITE and I’ll send you the link.”

For fuck’s sake…

Did any of those posts mention Drupal? Joomla? Magento? Government websites? A Japanese bank? Did they bollocks. Did any of them mention that your host was fixing it on the server while you slept? Course not. “PHP had a bug, the hosts patched it, life goes on” doesn’t sell anything. “WordPress is dead and I’ve got the answer” does.

To the people who don’t know any better and are sharing this stuff: you’re causing panic for no reason. Stop it. It’s embarrassing.

To the people who do know better and posted it anyway: you look like a dick. I think you know you look like a dick, and you’ve decided the engagement is worth it.

Who’s on the receiving end

WordPress is a sideshow here. If it vanished tomorrow, these same people would find something else to scare you with. This is really about where small businesses get their advice, and who’s handing it out.

You’re running a business. You’re doing your own marketing, or paying for it out of money that’s already stretched. You’re chasing clients and invoices, and trying to work out what AI means for you this week, because it changed again since last week. A lot of you are doing it on your own.

Then you open LinkedIn on your phone at ten o’clock at night, and some bloke in a gilet tells you your website is a security disaster and you need to rip it out. Of course that grabs your attention. Of course you think “shit, should I be worried?”

It’s the same pattern every time. Sack your SEO, hire a GEO team. Stop blogging, blogging’s dead. Google’s finished, it’s all ChatGPT now. Comment AI and I’ll DM you the guide.

And you know what? It terrifies me. I see those posts with 250 comments where every single one just says “AI”. That’s 250 business owners putting their hand up and saying “yes please, tell me what to do”. Plenty will read the guide, think “hang on, this is nonsense” and move on. There are loads of smart people on LinkedIn who see straight through this crap. Some won’t. They’ll move a perfectly good website to some shiny new platform, lose their redirects, lose their rankings, and spend a year wondering why the phone stopped ringing. I’ve cleaned up after that more times than I can count. If you want the gory details on migrations going wrong, have a listen to episode 11 of the podcast.

Some of these people don’t know any better, fair enough. Most simply don’t care. They’ll never find out if their advice wrecks your business, and if they did, they wouldn’t lose a minute’s sleep over it. Your comment is their metric. Your panic is their sales funnel.

None of this is new, either. Those of you who’ve been around a while might remember Ecademy, the business networking site, years before LinkedIn got big. Same shite, different decade. Hustle merchants scaring the hell out of small business owners and selling them the cure for a problem they’d just made up. The platform changes. The playbook doesn’t.

What to do when the next panic hits

There will be a next one. Probably by Thursday. When your feed fills up with people screaming that something’s dead, broken or about to end your business, this is how I’d handle it.

Find out what actually broke

Before you touch anything, find one boring, factual source. Not a LinkedIn post. The software’s own announcement, your hosting company’s status page, or a proper tech news site.

With PHP, the official line was clear within hours: update PHP. Not “change your CMS”. And for most people, the host did that for them. If the fix being sold to you is bigger than the actual problem, someone’s selling you something.

Ask the person who looks after your site one question

Message your host or developer and ask: “Are we affected, and are we patched?” A decent host will already have done it and can tell you so in one line.

If you’re on WordPress and want to see for yourself, go to Tools –> Site Health –> Info –> Server, and it’ll show your PHP version. If it’s 8.1 or older, you’re on a version that doesn’t get proper support any more, and that’s worth a chat regardless of last week.

If you can’t work out who you’d even ask, that’s your real problem, not WordPress. Episode 2 of the podcast is all about who owns your website stuff.

Run the “who benefits” test

Look at the bottom of the post. Is there a “comment X for the link”? A product? A free call that turns into a sales pitch? Ask yourself what they get if you panic. If the answer is “your money”, treat the whole post as an advert, because that’s what it is.

Check whether they named everything that was hit

This one catches loads of them out. If someone tells you a problem only affects the thing they happen to compete with, and leaves out everything else that got hit, they’re not informing you, they’re positioning. The PHP posts that only mentioned WordPress failed this test in about four seconds.

Take advice from people who know your business

Your web person, your SEO, your accountant, a business owner you trust who’s been through it. People who’ll still be around if the advice turns out to be wrong, and who’d have to look you in the eye if what they say turns out to be bollocks. Not someone whose only connection to you is that the algorithm shoved them in your feed.

Remember that not everything needs action

Sometimes the right response to a scary post is “noted, checked, we’re fine”, and you get on with your day. Checking and moving on is part of running a business too.

Your jobs for this week

• Ask your host, or whoever looks after your site, to confirm you’re patched. Check your PHP version while you’re at it, and get the answer in writing, even if it’s a one-line email.
• Write down who you’d call if something properly broke on your website tomorrow. Name and number. If that piece of paper is blank, sort it before you do anything else.
• Mute one panic merchant. You know who I mean. The person whose posts make your stomach drop every time you open LinkedIn, and who has never once made your business better. Mute, unfollow, done. Your blood pressure will thank you.

I’m not selling you anything with this one. No link, no course, no “comment PHP for my free guide”. If you run a small business, be careful who you listen to, especially anyone whose advice comes with a panic attached and a product at the bottom. You’re doing a hard job, and you’re doing better than the doom merchants want you to think.

And if you’re one of the hustle bros who spent the last couple of weeks scaring the shit out of small business owners so you could sell them something: I hope you step on Lego. Barefoot. In the dark. Every night. I hope every charger you ever own is two inches too short, your socks are permanently damp, and your Wi-Fi drops every time you try to post. And I hope one day you need proper, honest advice about something that really matters to you, and the only person you can find is someone exactly like you.

You absolute arseholes.

And the next time LinkedIn tells you something’s dead, check for yourself.

Listen to the full rant on episode 48 of SEO Fucking What: It Was a PHP Problem, Not a WordPress Problem, FFS!. And if a mate sent you one of those “move off WordPress NOW” posts, send them this instead.