Why We Don't Use PHP (And Why Your Business Shouldn't Rely on It Alone)
Today, a critical security flaw in PHP—the programming language behind roughly 70% of the world's websites—forced governments offline and sent businesses scrambling. Two remote code execution vulnerabilities (rated 9.2/10 severity) were patched this morning after exploit attempts already began.
The broader lesson? Your website's infrastructure matters as much as what it sells.
The PHP2Shell Crisis, Explained
At 7:43 UTC this morning, Cloudflare observed the first exploit attempts against unpatched PHP servers. By afternoon, thousands of attempts per day were being logged. The vulnerabilities, discovered by AI security tools and coordinated across OpenAI, Google Wiz, and security firm Calif, could allow attackers to:
- Execute arbitrary code on your server
- Access sensitive customer data, passwords, and session tokens
- Modify your website in real-time
- Take your business offline
The catch? Nearly 50% of all PHP systems worldwide run unsupported versions with no clear update path. For those businesses, taking the site offline until a fix can be deployed is now the NSA-recommended response.
This crisis exposes a fundamental truth: choosing your technology stack isn't just a technical decision; it's an operational and security decision.
Why AutoPilotPR Doesn't Use PHP
We built our infrastructure on a different foundation: Next.js, Vercel, and modern cloud services where security patches are automatic, infrastructure is managed by a team of thousands, and there is no version you're responsible for maintaining.
Why? Three reasons:
1. Security is not your job. It's ours.
Every component of our system is updated automatically. We don't wake up to discover a critical vulnerability that requires urgent patching. Our infrastructure provider (Vercel) handles security updates before threats emerge. That's how modern infrastructure works.
When a crisis like PHP2Shell happens, our clients are completely unaffected. No scrambling. No offline downtime. No CEO at 11 PM deciding whether to risk it or take the site down.
2. Old technology compounds old problems.
PHP launched in 1995. Many sites still run versions from 2004-2012 because they work and nobody has a budget to rebuild. That creates a massive surface area for attackers—and a headache for business owners who inherit systems they don't understand.
Modern infrastructure is built with the assumption that you'll upgrade frequently and automatically. Every deployment is a fresh build. Every system is the newest version by default.
3. Your business shouldn't be a legacy-tech support project.
Managing your own server means managing PHP versions, MySQL updates, SSL certificates, backups, and disaster recovery. That's not a website; that's a sysadmin job. AutoPilotPR doesn't ask clients to shoulder that burden.
How We Think About Your Tech Stack
When we onboard a client, one of the first things we audit is infrastructure. Not because we're trying to upsell—but because your website's foundation determines what's possible.
A legacy PHP site limits what AI agents can do. Can it accept form submissions? Can it fetch live pricing? Can it log interactions? Can it scale when demand spikes? These are yes/no questions that depend on your infrastructure, not just your content.
Our own stack—AutoPilotPR and natelind.com—runs on:
- Next.js (modern framework with security built-in)
- Vercel (auto-deployed, auto-scaled, auto-patched)
- Supabase (serverless database with automatic backups and failover)
- WhatsApp Business & Shopify (managed services handling their own security)
When a vulnerability like PHP2Shell emerges, we don't patch it. It's already patched. We just keep working.
The Domino Effect Nobody Talks About
Here's what happened to businesses today:
- At 7:43 AM, exploit attempts began.
- By 2 PM, patches were released (accelerated because the vulnerability leaked early).
- By 6 PM, 50% of PHP sites were still unpatched because upgrading PHP requires a developer, a testing window, and approval from someone who understands the risk.
- By midnight, several major government websites were offline as a precaution.
For a small business running an old WordPress site on shared hosting, this is a nightmare scenario. They can't patch quickly. They can't afford emergency dev work. They can't afford to be offline. They're stuck.
For businesses running on modern infrastructure, today was just another day.
What This Means for Your Business
If your website is a critical asset—if it accepts payments, books appointments, stores customer data, or runs your marketing—the infrastructure underneath is as important as the design on top.
Three questions to ask your current provider:
- How are security updates deployed? (Manual update = risky; automatic = good.)
- What version of the underlying technology are you running? (If they can't tell you, that's a problem.)
- If a critical vulnerability emerges today, how long until you're patched? (Hours = good; days or weeks = risky.)
If the answers are fuzzy, it might be time to rebuild on a modern stack.
Why This Matters for Automation
AutoPilotPR's Airframe—the operating system behind our AI agents—can only run at its best on infrastructure that's secure, modern, and automatically maintained.
A legacy PHP site can run a chatbot. It can't efficiently run agents that:
- Fetch live data from your business systems
- Write verified information back to your CRM
- Scale to handle traffic spikes
- Run 24/7 without manual oversight
The infrastructure decision isn't just about security. It's about what's possible for your business.
FAQ
Q: Does my WordPress site need to be on PHP for WordPress to work?
A: WordPress runs on PHP, so you can't eliminate PHP entirely if you're using WordPress. But you can mitigate risk by: choosing managed hosting that patches automatically (like WordPress.com or WP Engine), upgrading to the latest WordPress and PHP versions immediately, and using a Web Application Firewall (WAF) for defense-in-depth until patches are applied.
Q: What if I'm on shared hosting and can't upgrade?
A: Take the site offline until your host patches, or migrate to a host that handles updates automatically. The NSA's guidance is clear: if you can't patch quickly, offline is safer than vulnerable.
Q: Is the Airframe affected by the PHP vulnerability?
A: No. We don't use PHP. Our stack is Next.js, Vercel, and managed services. We were unaffected by PHP2Shell before, during, and after the patch release.
Q: Should I rebuild my WordPress site in something else?
A: Not necessarily. WordPress on modern, managed hosting (with automatic updates and WAF protection) is secure enough for most businesses. The risk isn't WordPress; it's old versions running on infrastructure nobody's watching. Update everything, immediately. Use a host that patches automatically, going forward.
Q: How do I know if my site is vulnerable?
A: Ask your hosting provider: "Am I running PHP versions 5.4 through 8.1?" If yes, you're in the affected range. If they don't know, that's the real problem—find a host that can answer that question.
The Bottom Line
A security crisis like PHP2Shell is a reminder: your infrastructure is part of your business continuity plan. Choosing old technology might save money on day one, but it costs you control on day two—when you need to patch quickly and your provider can't.
AutoPilotPR runs on modern infrastructure so your business doesn't have to carry that weight. When the next vulnerability emerges (and it will), you'll find out from the news. We'll already be patched.
CTA: Schedule a Consultation
If your site is still on legacy infrastructure and you're wondering how to modernize it—or if you want to explore automation that's built on a foundation you can trust—let's talk.
Book a Discovery Call to discuss your infrastructure and what's possible next.
Further reading: