# Is WordPress safe after PHP2Shell? Our take > PHP2Shell is a critical PHP vulnerability rated 9.2 out of 10. Why we avoid monolithic WordPress, how a headless Next.js and Sanity stack keeps the surface area small, and the open source starter we use to spin one up. **Published:** 2026-10-23 | **Updated:** 2026-10-23 | **Categories:** Talks Watch: https://www.youtube.com/watch?v=cxACne9TxEM --- Related reading: [Thinking of jumping ship from WordPress?](/blog/thinking-of-jumping-ship-from-wordpress) ## Transcript Holy moly, what a day. So PHP has had a critical vulnerability. When you know it's a critical vulnerability is when the FBI gets involved. So if you don't know, basically you have to perform an immediate update, and it's recommended that if you can't perform an immediate update, you should probably take the entire website offline. If you want to know how bad this thing is, the CVSS scale is rated out of 10 and this is a 9.2. So it's pretty bad. So what I want to talk to you about today is the reason why we build headless and why I would avoid a monolithic system like WordPress, which is PHP based, because of mainly this reason. If you don't know, WordPress has been around for a long, long period of time. I think it's coming up to either its 20th birthday or its 20th birthday's past, and it's been one of the most fundamental parts of blogging on the web for God knows how long. It makes up such a substantial amount of the internet. However, because it's monolithic, it has a lot of different systems that are involved in it. So you have the logins, you have the plugins, you have a whole host of different things. A lot of people keep their forms in there. They have user management where it's really quite extensive. All of that is handled in a monolithic system. On the other hand, you have a headless system, and a headless system is usually a website. I'm going to say Next.js because that's the ones that we build, but you could have React Router, you could have Astro, any of these different frameworks. But basically that sits on a very, very narrow surface area versus WordPress, which is a huge surface area. And we'll come back to why that might be a problem in a second. So in comparison, on headless you get to pick and choose whatever you want as a backend. You get to pick and choose whatever you want as a form or whatever else. All these different functionalities, user management, you can use things like Clerk. All of these things are pick and choose. You pick the best one in the industry and you essentially bolt it on. Now, why is this important when we say that we're going to use something like a microservice, like in the example of a CMS, like Sanity or Contentful or, God forbid you're stuck with it, Prismic? Any of these situations, why would you be choosing one of these over WordPress? Because WordPress does everything, right? Well, the reason why is because they have to manage the security. So for example, for Sanity, if Sanity was built in PHP, this is Sanity's problem now, not your problem, because they have lots of enterprise clients and they need to make sure that they don't tick those guys off that are paying hundreds of thousands, millions of dollars. Whereas you have one IT team that needs to sort this out. You might not even be lucky enough to have an IT team. You've got Dave down the hallway that runs WordPress in your team. So you've got to be very careful, because when a zero day like this happens, that needs to get solved fast. Because there's a smaller surface for headless, there's a lot less chance of getting hacked, of having vulnerabilities happen that are as catastrophic as what's just happened here. Whereas the surface of WordPress is massive, and this vulnerability is really, really bad. Those two things work together to be completely catastrophic. Now, if you're looking at moving away from this and you're looking at trying to build your first website that is headless, we actually have a solution just for you. Let me show you this. This is our own open source system called Turbo Start Sanity, and we basically released this into the open. So it's got all the best licenses you could ask for. There's nothing like a clawback clause or any nastiness like that. It's full MIT licensing, so you can use this for your own business today. But this here is the best Next.js, the best Sanity and the best Vercel, in our opinion. The Vercel part, you can switch it out to AWS or you can switch it out to Cloudflare. This particular system makes it very easy for you to spin up and basically vibe code your own website. Obviously, get us in towards the end and make sure that you've got it set up properly. But at the end of the day, this is what I would recommend right now, because the vulnerabilities shrink to an absolute minute scale versus the WordPress PHP meltdown. And it's extremely fast, extremely scalable, and then you can start tacking on what you want as extra features on the website. So I hope this was interesting. Tell me how you're getting on at the minute. If anybody's having any issues with PHP or issues with hosting or all this kind of stuff, drop us a message below. We'll see if we can help you out. Take care. Bye bye. ## Frequently asked questions ### How serious is the PHP vulnerability covered in the video? It is rated 9.2 on the CVSS scale, which goes up to 10, so it is pretty bad. The advice is to update immediately, and if you can't update immediately, you should probably take the entire website offline. We cover this at 0:00 in the video. ### Is WordPress safe after PHP2Shell? Our take is that we would avoid a monolithic, PHP-based system like WordPress, and this vulnerability is the main reason. WordPress has a huge surface area, and a zero day like this needs to be solved fast. In our view, a massive surface plus a vulnerability this bad is a catastrophic combination. We cover this at 0:29 and 2:49 in the video. ### Why do we call WordPress a monolith? WordPress handles a lot of different systems in one place: logins, plugins, forms that a lot of people keep in there, and quite extensive user management. All of that runs inside one monolithic system, which is what gives it such a large surface area. We cover this at 0:58 in the video. ### What is a headless website and why is it more secure? A headless system is usually a website built with a framework like Next.js, which is what we build, or React Router or Astro. It sits on a very narrow surface area compared to WordPress. Because the surface is smaller, there is a lot less chance of getting hacked or of a vulnerability as catastrophic as this one. We cover this at 1:17 and 2:55 in the video. ### Can I choose my own backend, forms and user management with headless? Yes. With headless you pick whatever you want as a backend, whatever you want for forms, and a service like Clerk for user management. You pick the best option in the industry for each job and bolt it on. We cover this at 1:39 in the video. ### Why would a hosted CMS like Sanity be safer than WordPress? With a CMS like Sanity or Contentful, the vendor has to manage the security, so a vulnerability is their problem, not yours. Sanity has enterprise clients paying hundreds of thousands to millions of dollars, so it has to keep them happy. With WordPress, the fix falls on your one IT team, or on whoever runs WordPress in your team if you don't have one. We cover this at 2:17 in the video. ### What is Turbo Start Sanity? Turbo Start Sanity is our open source starter for building a headless website with Next.js, Sanity and Vercel. It is fully MIT licensed with no clawback clause, so you can use it for your own business, and you can swap Vercel for AWS or Cloudflare. It makes it easy to spin up and vibe code your own site, though we recommend getting us in towards the end to check it is set up properly. We cover this at 3:26 in the video. ## Related services - https://robotostudio.com/services/cms-migration - https://robotostudio.com/services/headless-cms