Website Security: Why Regular Maintenance Matters
In October 2026, websites operated by the German federal government were taken offline as a precaution. Universities also temporarily shut down their websites. At the same time, cybersecurity companies recorded massive waves of attacks targeting a vulnerability in one of the fundamental technologies of the internet.
The cause had a name: PHP2Shell.
What initially sounds like a problem for large data centres and IT departments also affects ordinary business websites. After all, the same technology that powers extensive online platforms is also used by countless smaller websites.
And that is precisely where the real problem lies: a website can appear to be functioning perfectly while still containing a serious security vulnerability.
The Invisible Technology Behind a Website
When someone visits a website, they see the finished result. Text, images, navigation, perhaps a contact form. What happens behind the scenes remains largely invisible.
Many websites are built with WordPress. This system, in turn, relies on the PHP programming language, among other technologies. PHP processes requests, assembles content and turns stored data into the finished page that appears in the browser moments later.
You could think of PHP as part of a website’s engine room. Visitors never see it. As long as everything works, there is little reason to give it much thought.
In October 2026, that very engine room became the problem.
Two serious security vulnerabilities made it possible, under certain conditions, for attackers to execute unauthorised code on affected servers or access sensitive information. And they could do so without having to log in through the usual authentication process.
What made this particularly significant was that the flaws were not found in an individual WordPress plugin or a poorly developed website, but in PHP itself.
Even a carefully maintained website could therefore be affected.
When an Update Isn’t Enough
On 21 October, security updates were released for the affected PHP versions. Unlike a routine WordPress update, however, the problem could not simply be resolved by clicking a button in the administration area.
The fix had to be applied at server level.
That is an important distinction. While website owners can often manage WordPress, themes and plugins themselves, responsibility for the PHP environment frequently lies with the hosting provider.
An up-to-date WordPress installation therefore does not automatically mean that the underlying server technology has received the latest security patches.
Conversely, the PHP version number displayed by a hosting provider does not always reveal whether a vulnerability has already been fixed. Some providers use their own long-term maintained PHP versions, incorporating security patches without changing the visible version number.
Without understanding this, it is easy to develop a false sense of security. Or to become unnecessarily concerned.
Speed Is the Real Problem
Security vulnerabilities are nothing new. Software is developed by people, and wherever people work, mistakes happen. That is unlikely to change fundamentally in the future.
What has changed, however, is the speed at which such vulnerabilities can be discovered and exploited.
As soon as information about a critical vulnerability becomes public, automated systems begin scanning accessible servers for potential points of attack. There is no longer any need to examine each website individually by hand.
Artificial intelligence is accelerating this development.
It can help security researchers analyse complex flaws, simulate potential attacks and develop appropriate protective measures. The same capabilities, however, can also be misused to prepare attacks more quickly or adapt them to different technical environments.
This does not mean that every attack is now controlled by AI. It does mean, however, that technical barriers which once required considerable effort are becoming increasingly easier to overcome.
As a result, the time between the disclosure of a vulnerability and the first attempted attacks can be extremely short.
For website owners, one question is therefore becoming increasingly important: how quickly can they determine whether their own website is affected, and who is responsible for dealing with it?
What This Incident Meant for My Work
When the reports about PHP2Shell emerged, my first priority was to check the PHP versions and hosting environments of the websites under my care.
Some hosting providers had already made the patched versions available. With another provider, however, the version number initially suggested an older release.
Only a direct enquiry to technical support provided clarity: the provider was using a specially maintained PHP environment in which the necessary security patches had already been applied. The version number itself had therefore remained unchanged.
A small example that illustrates rather well why technical website maintenance involves more than occasionally clicking a button labelled “Update”.
You do not need to understand every detail of a security vulnerability. But you should know where to look, which information matters and when it is necessary to contact the provider.
The same applies to less spectacular security issues that never make national headlines.
Security Begins with Architecture
In my work, I therefore try to build websites that are not only visually and functionally well considered, but also technically manageable.
Every additional plugin, every external interface and every unnecessary dependency increases the number of components that need to be maintained and monitored.
That does not mean avoiding plugins or external services altogether. Many of them serve important purposes. What matters is making a conscious decision about what is actually needed.
A lean system is not automatically secure. But a manageable system is easier to understand, monitor and maintain over the long term.
For me, this includes regular updates, checking the components in use, maintaining reliable backups and keeping an eye on the technical environment provided by the hosting company.
It is equally important to remove outdated or unnecessary extensions, secure access points and assess new features not only in terms of what they can do, but also the additional dependencies they introduce.
Security does not come from a single measure. It is the result of many decisions, starting with the initial planning of a website.
And Who Takes Care of Things After Launch?
A new website is planned, designed, developed and finally launched. For many companies, that marks the completion of a project.
From a technical perspective, however, it marks the beginning of a new phase.
WordPress continues to evolve. PHP receives new versions. Browsers change their behaviour. Plugins are updated, discontinued or replaced by other solutions. And occasionally, security vulnerabilities emerge that require a prompt response.
That is why I consider ongoing technical maintenance an integral part of the overall website project.
This does not mean that every small business website needs its own IT department. But it does require clear responsibilities, regular checks and someone who can assess technical developments.
Not every security warning requires immediate action. Some simply call for an investigation, others require an update, while others need direct coordination with the hosting provider.
What matters is that these decisions are not left to chance.
Update, 13 November 2026: Yet More Microsoft Security Vulnerabilities?
The numerous security reports surrounding Microsoft demonstrate just how relevant this issue remains. Hardly has one vulnerability been identified and fixed before another seemingly appears. It is easy to get the impression that our digital infrastructure is becoming less secure by the day.
But the growing number of reports also allows for a different interpretation.
Automated testing methods and artificial intelligence now make it possible to uncover vulnerabilities that may have remained undetected for years. More vulnerabilities being discovered does not necessarily mean that more new flaws are being introduced.
Quite the opposite: every vulnerability discovered and fixed is, first and foremost, evidence that security research is taking place and solutions are being developed.
Then there is the enormous reach of Microsoft’s products. Windows, Microsoft 365 and its numerous cloud services form a substantial part of our digital infrastructure. Accordingly, problems affecting these systems attract considerable public attention.
It is worth looking more closely, however. A security vulnerability for which an update is available is not the same as an outage affecting a major cloud service. Both make headlines, but they do not necessarily share the same causes.
Of course, every serious vulnerability remains a risk, particularly when it is already being actively exploited. Nevertheless, not every new security report needs to be a cause for alarm.
Perhaps the growing number of such reports is also a sign that we are now looking more closely and are able to respond more quickly.
And that brings us back to the central question: what matters is not simply the existence of security vulnerabilities, but how responsibly we deal with them.
A Website Is Never Truly Finished
The PHP2Shell incident illustrates just how dependent even small websites are on a complex technical infrastructure. But it also shows that security is not simply a matter of which software is being used.
It is about awareness, responsibility and understanding your own systems.
Absolute security does not exist. Even a carefully developed and regularly maintained website can be affected by new vulnerabilities. Good maintenance, however, can reduce these risks, make problems easier to detect at an early stage and allow for a more effective response.
A website should not only function on the day it is launched. It should continue to serve its purpose reliably months and years later.
Good web design therefore does not end at launch. Neither does responsibility.
