This week, two critical security vulnerabilities came to light in the PHP programming language, with fixes released on 21 October 2026. PHP is used in WordPress, among other systems. WordPress is software a business can use to publish and edit its website’s content. It needs PHP to run.
According to CERT-EU’s security advisory, the vulnerabilities could allow attackers to run their own programs on a server. A server is the computer that delivers website pages to visitors’ browsers.
Security flaws are constantly being found, and AI can speed up the search for them, both in security work and in attackers’ hands. It can also reduce the time and expertise an attack requires. As the effort involved decreases, exploiting even small websites can become more profitable.
When does news like this affect an ordinary service business? For example, when its WordPress website runs a vulnerable PHP version and the other conditions for exploiting the vulnerability are met. Using WordPress alone does not tell you whether your particular website is at risk. Few business owners have time to investigate these details alongside running their business. That is why a capable maintenance partner is valuable: they check whether the vulnerability affects the website and take care of the necessary updates. A released fix does not help if it is never installed.
One thing 15 years of working with websites has taught me
I have worked with websites for around 15 years. In that time, I have seen and reviewed countless company websites, but off the top of my head I can recall just one whose technical maintenance was truly in good shape.
One.
This is obviously no scientific sample of Finnish businesses, but it says something about the situation I repeatedly encounter in my work.
The most common problem is simple: a website is launched, and its technical maintenance is then effectively forgotten. By maintenance, I mean updating the website and the software it needs, and checking that it still works after those updates.
WordPress has not been updated, and plugins are years out of date. Plugins are separate programs that add features such as a contact form or booking calendar to a website.
The server may be running a PHP version that reached the end of support long ago. This means PHP’s own developers no longer release security updates for that version.
Updating one part does not mean the whole website has been maintained. Almost always, something has been left undone.
And the problem goes beyond security.
I regularly come across contact forms that appear to work but never deliver the messages. Cookie banners can be little more than window dressing: they appear to ask for consent, yet tracking starts before approval or continues despite a refusal.
Many of these websites look completely ordinary from the outside. Pages open, images load and navigation works. When the content does not need changing and nothing looks broken, the business owner may have no reason to suspect a problem.
But a website appearing in a browser does not mean it works correctly. And it certainly does not mean it is secure.
Attackers are getting faster, but are websites keeping up?
Outdated websites do not have to be found by hand. Hackers have long used software that automatically checks websites across the internet for known security flaws. Not all hackers are criminals: the same methods are also used in authorised security testing.
An attacker does not need to know your company’s name, industry or revenue. It is enough for their software to find a weakness on your website that it can exploit. That is why even a small business can become a target.
There are already concrete examples of attacks becoming faster. A report published by Google’s Threat Intelligence Group in September 2026 describes a case where attackers compromised a cloud service and then launched a large-scale attack to collect usernames and passwords in less than six hours. They used AI-driven software to help them.
“There is nothing worth stealing on our website”
This is understandable, especially for a small service business. If the website does not store customer payment details, passwords or other sensitive information, what could anyone gain from hacking it?
Quite a lot, as it turns out.
Over the years, your company’s website may have received links from other sites and built its position on Google. A criminal may try to use that position to move their own website up in search results.
For example, an attacker could break into an engineering company’s website and add hidden links to gambling sites in its source code. The purpose of those links is to make the gambling site appear more popular to Google. This kind of search result manipulation is known as black hat search engine optimisation.
All of this can happen without the business owner noticing. The website’s appearance may not change, and customers may not see anything unusual.
Google’s spam policies describe the misuse of hidden links and hacked websites. A hack can damage a company’s visibility or lead to pages being removed from search results, even if no customer data has been stolen.
And this is just one example.
A hacked website can be used to distribute malware, redirect customers to scam sites or carry out phishing. In an online store, a criminal may try to steal payment details, and in the worst case the website can be rendered completely unusable.
The consequences are not purely technical. They can mean lost sales, missed enquiries, reputational damage and significant repair costs.
A business may have spent years building its search visibility and thousands of euros on marketing. Yet the technical maintenance of the website underpinning all that customer acquisition may have been neglected.
To me, that is quite a contradiction.
Websites are bought as projects but used as ongoing services
One reason maintenance gets neglected is the way websites are bought and sold.
A company orders a website. The design is planned, the content written, the site built and launched. The project is finished, the invoice paid, and both parties move on to their next jobs.
But a website does not cease to exist when the project ends.
The customer may assume that the website developer handles updates. The developer may assume that the customer is responsible for the site after launch. The hosting provider may look after the computer the website runs on, while updates to WordPress and its plugins may fall outside its service. Updating WordPress alone, in turn, does not update PHP on the server.
The result can be that no one is responsible for the whole picture.
In this sense, I do not see website maintenance as merely a technical issue. Above all, it is a question of who is responsible for what.
What should a maintenance agreement cover?
Of course, I do not think business owners should have to learn how to update PHP, manage servers or investigate security vulnerabilities themselves. They generally have more than enough to do already.
But you can ask your maintenance provider for clear answers to these questions:
- Which website and server software does the provider update, and who looks after the rest?
- After updates, do they check that the website works and that contact form messages actually arrive?
- Do they make backups — restorable copies of the website’s files and content — and have they checked that those copies work?
- Who do you contact when something goes wrong, and who gets the website working again?
At Revla, we aim to keep the number of separate programs a website needs as low as possible, so there is less to maintain. We take care of the agreed technical maintenance on our customers’ behalf.
After all, the purpose of a website is to help a company win customers and grow its business, not to give its owner another technical worry.
Do you know who maintains your company’s website and what that maintenance actually includes?
If the answer is unclear, it is worth finding out before the next critical vulnerability.
Explore Revla’s website service or get in touch, and we can look together at how to arrange maintenance for your company’s website.