Built and Left: Why Your Business Systems Need Support, Not Luck
This week's PHP security flaw is a reminder that being small no longer keeps a business hidden. What proper support looks like, and how to tell whether you have it.
For years, plenty of businesses have relied on a security plan nobody ever wrote down: being too small to notice.
This week ended that plan.
A serious flaw was found in PHP, the software behind WordPress and millions of other websites, online shops and booking pages. It let strangers get into a website without a password and quietly read the passwords stored inside it. A fix was released on 21 October 2026, as the EU's cyber security team CERT-EU confirmed, and many web hosts installed it within a day.
The fix is the easy part. The harder question this week has been a simpler one: who is looking after your systems, and did they call you?
Why doesn't being small keep you safe any more?
Two details from this week explain it.
The first is how long the flaw had been hiding. Wiz Research, one of the teams that found it, traced the affected code back to PHP 5.4, released in 2012. It sat unnoticed in millions of websites for well over a decade.
The second is how it was found. Wiz says its researchers used AI models to help discover the flaws and to build working attacks against them. Those tools are not only available to the good side.
Put those together and the old comfort disappears. Flaws that stayed buried for years can now be found far faster. And the tools attackers use do not choose targets by size or fame. They test every website they can reach. Within a day of details leaking, watchTowr reported seeing attempts to exploit the flaw.
Hiding in the crowd only works while nobody is searching the crowd.
How do business systems end up forgotten?
Nobody decides to leave their business exposed. It happens gradually, for understandable reasons.
A website gets built for a launch. An ordering portal is added by an agency. A booking page is set up by a freelancer who did a good job and moved on to other clients. The budget was tight, so ongoing support felt like a cost you could skip. And for years, that seemed fine.
That is the trap. Software that works quietly gives no warning. Nothing looks wrong until the week something is wrong, and then there is nobody whose job it is to notice.
Most teams in this position are not careless. They are relying on one person, one email address, or one agency that has since moved on. They are hanging by a thread without knowing it.
What does missing support cost in a week like this?
It helps to picture the week from the inside.
Your host installs the fix on Wednesday. That closes the door. But it does not remove anyone who came in before the fix, and it does not change any passwords they may have copied on the way out. Security firms such as Aikido list what intruders typically leave behind: admin accounts nobody created and hidden files that act as a back door. A patch does not remove those.
Your website is also rarely on its own. It is usually connected to your payments, your email, your deliveries and your customers' details, and each connection works with a password or access code. SentinelOne advises changing those now rather than waiting for proof of a break-in, because this kind of leak leaves little trace.
With proper support, someone checks all of that for you this week. Without it, the first sign may be a customer asking why they were charged for something they never ordered.
What does proper support actually look like?
It does not need to be complicated or expensive. It needs to be real. A good support partner:
Knows everything you run. Not just the main website, but the old campaign page, the test copy and the portal built three years ago. Nobody can protect what nobody knows is there.
Tells you before you ask. When a headline like this breaks, you hear from them first, with an answer rather than a question.
Fixes, then checks. They apply the update, then confirm nobody got in beforehand, and change the passwords that need changing.
Explains it in plain words. You should come away knowing whether you were affected, what was checked, and what is left to do.
Keeps things current as routine. Updates happen as normal maintenance, not as an emergency. Old systems get an honest plan: upgrade them, rebuild them, or switch them off.
Engages, rather than closing tickets. They treat your systems as something they look after with you.
How can you tell whether you have it?
You can answer these without any technical knowledge:
- Do you have a written list of every website and online system your business uses?
- For each one, do you know who looks after it, and who holds the login?
- Did anyone contact you about this week's security news before you asked them?
- When was each system last updated, and who decided it was fine?
- If a system is old, is there a plan for it, or is everyone hoping it keeps working?
If several answers are "I'm not sure," that is not a failure. It is simply the clearest sign of where support needs to come first.
What should you do this week?
Whoever looks after your systems, these are the steps that matter now:
- Send one message to your web host or developer: "Is the PHP fix installed and running on all our websites, and can you check nobody got in before it?"
- Include the forgotten ones: old campaign pages, test sites, anything an agency built years ago.
- Don't rely on a WordPress update. Updating WordPress or plugins does not fix this; the fix has to happen on the server.
- Change the passwords and access codes your website uses for payments, email and deliveries.
- Test what earns you money once the fix is in: place a test order and send yourself a contact form.
- Ignore any "urgent update, click here" message. Real fixes come from your host or developer, never from a link.
If your website runs on a fully hosted service such as Shopify, Wix or Squarespace, there is no PHP for you to update, though the advice about passwords and scam messages still applies.
Frequently asked questions
Does updating WordPress fix the PHP2Shell flaw? No. The flaw is in PHP, the software underneath WordPress, so updating WordPress, plugins or shop software does not fix it. Your web host or developer has to install the PHP fix on the server.
If my host has installed the fix, is my website safe? Not necessarily. The fix closes the gap, but it does not remove anyone who got in before it was installed, or change passwords they may have copied. Ask your host or developer to check that nobody got in, and change the passwords and access codes your website uses.
Do customers visiting my website need to do anything? No. This is a problem on the server that runs the website, not on visitors' phones or laptops, so there is nothing for them to install.
Is my website affected if it is on Shopify, Wix or Squarespace? You do not run the server on these services, so there is no PHP for you to update. It is still worth changing passwords shared with other systems and warning your team about fake "urgent update" messages.
Why doesn't being a small business protect me? The tools attackers use test every website they can reach, whatever its size. Flaws are also being found faster, including with the help of AI, so being small or forgotten no longer keeps a business hidden.
What should good IT support do when a security problem like this breaks? Contact you before you have to ask, apply the fix, check that nobody got in beforehand, change any passwords that need changing, and explain in plain words what was checked and what is left to do.
How do we think about support at Illuminate?
Software is only half of what a business buys from a technology partner. The other half is the people behind it, and that half usually only gets tested on a bad day.
That is the relationship we work to build with every client at Illuminate. When something like this breaks, our job is to have already looked, to explain what it means for each client in language their team can act on, and to work through the follow-up alongside them. No partner can make a business immune to the next headline. The right one makes sure you are never facing it alone.
Being looked after is not a luxury that comes after growth. It is part of what lets a business grow without wondering what it has forgotten.
Make the list. Find out who is looking after each piece. And if the answer is nobody, fix that before the next headline does it for you.
If you would like to talk through which parts of your business depend on systems nobody is looking after, talk to the Illuminate team.
Sources
- CERT-EU, Security Advisory 2026-018: Critical Vulnerabilities in PHP, 21 October 2026
- Wiz Research, PHP2Shell: AI uncovers critical RCE vulnerabilities, October 2026
- watchTowr, PHP Remote Code Execution (PHP2Shell), October 2026
- Aikido, Critical vulnerabilities in PHP (PHP2Shell), October 2026
- SentinelOne, Stopping PHP2SHELL, October 2026
- Sansec, PHP2Shell: Critical PHP RCE, October 2026
- NBC News, Critical vulnerabilities in commonly used web code spark rush to update systems, October 2026 (Censys count of nearly 55 million web properties running PHP, the basis for "millions of websites")
For media inquiries, please contact:
contact@illuminate.ae
