After Black October, Should You Move Your Website Off PHP? An Honest Answer

By Umair Ali Sadaqat · Updated · Editorial policy

PHP2Shell is a reason to patch, not automatically a reason to leave PHP. When staying is right, when moving makes sense, what moving actually costs, and the questions to ask before you decide.

A disclosure first: we.inc sells a website builder that does not run PHP, so we have an interest in this question. We have tried to answer it the way we would for a friend, including the cases where the right move is to stay put.

Black October (the PHP2Shell flaws fixed on 21 October 2026) is serious. It is also a bug that got found, fixed and shipped to every supported branch on a scheduled day, with advance packages for Linux distributions. That is what a mature, well-run language project looks like. Every runtime has critical bugs; Node.js, Java, Python and Ruby have all had their own. "PHP had a bad bug" is not, on its own, a reason to leave.

Staying on PHP is usually right when

  • You have someone who maintains the server, whether that is a developer, an agency or a good managed host, and they patched within a day or two this week.
  • Your site does real work in PHP: a custom application, a membership system, a complex store, integrations your business depends on. Rewriting those has its own risk and cost.
  • You rely on the ecosystem: a WordPress plugin or Magento extension that does something nothing else does.
  • Your PHP and CMS are current and upgrade cleanly.

For these sites, the lesson of Black October is about process: know who patches, how fast, and how you find out. Write that down.

Moving makes sense when

  • Nobody really owns the server. The developer who built it left, the host is a reseller, and you learned about this from the news.
  • The site is stuck on an old PHP or CMS version and upgrading means a rebuild anyway (see the old PHP versions guide).
  • The site is mostly content: pages, a blog, a contact form. A brochure site does not need a server-side language answering every request.
  • You keep paying for emergency work on a site that earns little directly.

What "moving off PHP" can mean

There is more than one destination, and they suit different people:

  • A static site generator (Astro, Hugo, Eleventy, Next.js static export): pages built ahead of time and served as files. Very small attack surface. Needs a developer for changes.
  • A headless CMS plus a static front end: editors keep a familiar admin; the public site has no PHP. More moving parts to set up.
  • A hosted website builder (WeInc, Squarespace, Wix, Webflow and others): the platform runs everything and patches it. Less control over the stack; the platform is now the thing you trust.
  • Managed WordPress: still PHP, but someone else's job to patch. A reasonable middle ground if your content and plugins matter most.

What moving actually costs

Be realistic before deciding:

  • Content migration: pages, posts, images and redirects from old URLs. Redirects matter for search rankings; plan them carefully.
  • Features: forms, search, bookings, payments. Check each one exists on the new platform.
  • Lock-in: some hosted builders make it hard to leave. Ask whether you can export your site and content.
  • Time: a small brochure site can move in days; a large one can take months.

And a hard rule: do not migrate instead of patching. Patch now, then decide calmly.

Questions to ask yourself

  1. Who patched our PHP this week, and how long did it take?
  2. Which features of the current site would we actually miss?
  3. If we stayed, what would we change so the next disclosure is a non-event?
  4. If we moved, who would own the new site day to day?

If the answers point to staying, our platform guides cover the work: start with the hub page. If they point to moving, the offer below is one option among several.

Move your site to WeInc

WeInc builds your site with AI as React code, then hosts it for you, so there is no PHP server for you to patch. Move your site to WeInc: first month free with code BLACKOCTOBER, until November 21, 2026. New customers only. Claim the offer

More in Blog

Alternatives mentioned in this article

Related guides and tools

Start building

How we research, test and update this page: our editorial policy. We.Inc is our own product.

Product

Who It's For

Features

Resources

Company

View Sitemap