Is WordPress safe after PHP2Shell? Our take

Holy moly, what a day. So PHP has had a critical vulnerability. When you know it's a critical vulnerability is when the FBI gets involved. So if you don't know, basically you have to perform an immediate update, and it's recommended that if you can't perform an immediate update, you should probably take the entire website offline. If you want to know how bad this thing is, the CVSS scale is rated out of 10 and this is a 9.2. So it's pretty bad. So what I want to talk to you about today is the reason why we build headless and why I would avoid a monolithic system like WordPress, which is PHP based, because of mainly this reason. If you don't know, WordPress has been around for a long, long period of time. I think it's coming up to either its 20th birthday or its 20th birthday's past, and it's been one of the most fundamental parts of blogging on the web for God knows how long. It makes up such a substantial amount of the internet. However, because it's monolithic, it has a lot of different systems that are involved in it. So you have the logins, you have the plugins, you have a whole host of different things. A lot of people keep their forms in there. They have user management where it's really quite extensive. All of that is handled in a monolithic system. On the other hand, you have a headless system, and a headless system is usually a website. I'm going to say Next.js because that's the ones that we build, but you could have React Router, you could have Astro, any of these different frameworks. But basically that sits on a very, very narrow surface area versus WordPress, which is a huge surface area. And we'll come back to why that might be a problem in a second. So in comparison, on headless you get to pick and choose whatever you want as a backend. You get to pick and choose whatever you want as a form or whatever else. All these different functionalities, user management, you can use things like Clerk. All of these things are pick and choose. You pick the best one in the industry and you essentially bolt it on. Now, why is this important when we say that we're going to use something like a microservice, like in the example of a CMS, like Sanity or Contentful or, God forbid you're stuck with it, Prismic? Any of these situations, why would you be choosing one of these over WordPress? Because WordPress does everything, right? Well, the reason why is because they have to manage the security. So for example, for Sanity, if Sanity was built in PHP, this is Sanity's problem now, not your problem, because they have lots of enterprise clients and they need to make sure that they don't tick those guys off that are paying hundreds of thousands, millions of dollars. Whereas you have one IT team that needs to sort this out. You might not even be lucky enough to have an IT team. You've got Dave down the hallway that runs WordPress in your team. So you've got to be very careful, because when a zero day like this happens, that needs to get solved fast. Because there's a smaller surface for headless, there's a lot less chance of getting hacked, of having vulnerabilities happen that are as catastrophic as what's just happened here. Whereas the surface of WordPress is massive, and this vulnerability is really, really bad. Those two things work together to be completely catastrophic. Now, if you're looking at moving away from this and you're looking at trying to build your first website that is headless, we actually have a solution just for you. Let me show you this. This is our own open source system called Turbo Start Sanity, and we basically released this into the open. So it's got all the best licenses you could ask for. There's nothing like a clawback clause or any nastiness like that. It's full MIT licensing, so you can use this for your own business today. But this here is the best Next.js, the best Sanity and the best Vercel, in our opinion. The Vercel part, you can switch it out to AWS or you can switch it out to Cloudflare. This particular system makes it very easy for you to spin up and basically vibe code your own website. Obviously, get us in towards the end and make sure that you've got it set up properly. But at the end of the day, this is what I would recommend right now, because the vulnerabilities shrink to an absolute minute scale versus the WordPress PHP meltdown. And it's extremely fast, extremely scalable, and then you can start tacking on what you want as extra features on the website. So I hope this was interesting. Tell me how you're getting on at the minute. If anybody's having any issues with PHP or issues with hosting or all this kind of stuff, drop us a message below. We'll see if we can help you out. Take care. Bye bye.