When major organisations start taking websites offline because of a security vulnerability, it's understandably very concerning. And when the problem affects a technology used across much of the internet, the implications extend well beyond the IT department.
That's what happened this week, following the discovery of two critical vulnerabilities in PHP, the programming language used by popular website platforms including WordPress, Drupal, and Magento.
The vulnerabilities prompted warnings from cybersecurity agencies around the world, with some organisations temporarily taking websites offline while they addressed the risks.
For businesses relying on their websites to generate revenue, serve customers, or deliver essential services, it's a reminder of just how dependent they've become on the technology behind them.
And it raises an important question – how confident are you that your website platform can support your business securely and reliably, both today and in the years ahead?
What happened, and should you be concerned?
On 21 October 2026, PHP released security updates addressing two critical vulnerabilities that could allow attackers to execute malicious code remotely on affected servers.
The UK's National Cyber Security Centre urged organisations using PHP to identify affected systems, apply the updates, and consider taking systems offline where immediate remediation wasn't possible.
The vulnerabilities are serious, but it's important to understand what they mean.
They don't mean that every WordPress, Drupal, or Magento website has been compromised. Nor do they mean that PHP is suddenly unsuitable for building websites. PHP remains a widely used technology with an established development community and ongoing security support.
For organisations running PHP-based systems, the immediate priority is to confirm which versions they're using, apply the necessary updates, and follow the guidance from their hosting and technology providers.
For everyone else, the incident offers an opportunity to consider how well their own technology is being managed.
Why we've taken a different approach at DotCentric
At DotCentric, we've long focused on the Microsoft .NET technology ecosystem, working with platforms including Optimizely and Umbraco to deliver business-critical websites and digital experiences.
That's a deliberate choice, informed by the requirements of the organisations we work with.
When you're building a website that needs to integrate with business systems, handle complex functionality, support growing audiences, and evolve over several years, the underlying technology matters enormously.
We've valued .NET for its mature development framework, established security capabilities, structured release and support cycles, and ability to support sophisticated digital platforms. Microsoft provides regular security updates, documented support lifecycles, and long-term support releases that help organisations plan their technology investments and upgrades.
That doesn't make .NET immune to vulnerabilities. Every major technology has security risks, and every platform needs responsible development, maintenance, and monitoring. But having a clear technology roadmap, a well-supported platform, and an experienced team responsible for keeping everything up to date makes an enormous difference when issues arise.
For our clients, the current PHP vulnerabilities don't directly affect the .NET-based platforms we've built and support. That doesn't remove the need for ongoing vigilance, particularly where third-party systems and integrations are involved, but it does illustrate the importance of understanding the technologies your website depends on.
Security should be part of the platform decision from day one
When organisations choose a content management system or digital experience platform, the conversation often centres on functionality, design flexibility, ease of use, and cost.
Those are all important considerations. But the long-term security and maintainability of the technology deserve just as much attention.
A website might perform brilliantly at launch, but what happens three or five years later? Will the platform still be supported? How straightforward will it be to apply security updates? Can your team maintain it without significant disruption? And if a serious vulnerability is discovered, how quickly can you respond? These questions have direct commercial implications.
For an ecommerce business, website downtime can mean lost sales and frustrated customers. For a membership organisation, it could prevent members from accessing essential services. For organisations delivering public-facing services, an outage can affect thousands of people who depend on them. The financial and reputational consequences can extend well beyond the immediate cost of resolving a technical issue.
That's why we believe platform decisions should consider the full lifecycle of a website, including ongoing support, security, upgrades, and the ability to adapt as business requirements change.
<<IMAGE PLACEHOLDER - GRAPHIC ILLIUSTRATING THE 5 KEY CONSIDERATIONS WHEN REVIEWING A WEBSITE PLATFORM: (1) TECHNOLOGY SUPPORT; (2) SECURITY OWNERSHIP; (3) INCIDENT RESPONSE; (4) THIRD-PARTY DEPENDENCIES; (5) LONG-TERM SUITABILITY>>
Five questions worth asking about your website platform
You don't need to be a technical specialist to understand whether your organisation has the right foundations in place. But you should be able to get clear answers to a few important questions.
1. Is our platform running on supported technology?
Every major technology has a support lifecycle. Understanding which versions you're using, when support ends, and what upgrades are planned is essential to managing risk.
2. Who is responsible for security updates?
Whether it's your internal IT team, hosting provider, or digital agency, there should be clear ownership of security updates, monitoring, and incident response.
3. How quickly could we respond to a critical vulnerability?
If an urgent update were released tomorrow, would your team know what to do? Could you identify affected systems, test a fix, and deploy it without unnecessary delay?
4. How dependent are we on third-party components?
Plugins, integrations, and external services can introduce additional dependencies. Understanding what's connected to your website, and how those components are maintained, is an important part of managing security.
5. Is our platform still right for the business?
Security is one consideration, but it's worth looking at the bigger picture. Is your current platform becoming difficult or expensive to maintain? Does it limit what your teams can achieve? Can it support your future digital plans?
If the answers raise concerns, it may be time to review your technology strategy.
When does moving platform make sense?
A major security incident naturally prompts questions about whether you should reconsider your technology choices. But migrating to a new CMS or digital experience platform is a significant undertaking. It involves investment, planning, content migration, integrations, training, and potentially changes to business processes.
A single vulnerability isn't necessarily a reason to make that move.
However, if security concerns are accompanied by rising maintenance costs, unsupported technology, limited functionality, or difficulties delivering new digital experiences, the business case becomes more compelling.
A modern platform can provide opportunities to simplify operations, improve performance, strengthen security management, and give internal teams greater flexibility. Your decision should be based on what your organisation needs to achieve and whether its existing technology can support those ambitions.
Building confidence in your digital foundations
The PHP vulnerabilities have attracted attention because of their severity and the number of organisations potentially affected. They also highlight something that can be easy to overlook when websites are working as expected – the importance of the technology, people, and processes keeping them running.
At DotCentric, our approach has always been to recommend technologies that support our clients' longer-term business needs. Our experience with .NET-based platforms such as Optimizely and Umbraco, combined with ongoing support and maintenance, helps organisations build digital experiences they can continue to develop with confidence.
If recent events have prompted questions about your own website, whether that's security, ongoing maintenance, or the suitability of your current platform, we're happy to have a conversation.
We can help you explore your options, understand the considerations involved in modernising your digital platform, and determine whether a change would deliver meaningful value for your organisation.
