PHP broke the internet again. Why WordPress should have retired in 2015, and what to build instead
On 21 October 2026 the NCSC warned that any version of PHP can be hijacked remotely (CVE-2026-109618 and CVE-2026-109619), giving attackers a direct path to your files and database. WordPress, Joomla, TYPO3 and every PHP site are affected, with official advice to take sites offline. A plain English guide to the real risk and the modern, secure, owned alternative on Ruby on Rails.