Operations matter more than design

AI is here and it isn’t going away. With it you can build a website in an afternoon and adapt a theme in an hour. That’s good. It’s no excuse for sloppy work, though. That’s exactly what many people did with WordPress: buy a theme, add twenty plugins, go live, never touch it again. The bill came later, as hacked sites and late-night updates.

October 2026 shows why operations and maintenance now count for more than the next layout.

What happened in October

PHP, 20 to 26 October. On 20 October the PHP project announced a critical security release for the next day. On 21 October PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 shipped. They fixed two vulnerabilities, both rated CVSS v4.0 9.2:

• CVE-2026-109618: remote code execution via memory corruption when the memory limit is hit at the wrong moment.
• CVE-2026-109619: remote code execution via state that survives a request after its memory has been freed.

According to the PHP project, every web-serving installation is affected (PHP-FPM, Apache mod_php, php-cgi, FrankenPHP, LiteSpeed). Risk is highest with mod_php, where an unauthenticated request was shown to trigger the attack before any application code runs. The release notes are blunt: “There are no complete mitigations, updating is the only safe choice.” PHP 8.1 and older no longer get updates from the PHP project; 7.4 to 8.1 only got source backports. The industry calls the pair PHP2Shell.

Singapore’s Cyber Security Agency soon reported widespread exploitation attempts and several proof-of-concept exploits in development. On 23 October PHP published a further notice on a rare edge case (CVE-2026-115560), and on 26 October new Windows builds for a flaw in the Brotli library.

For WordPress this means: WordPress runs on PHP. Every WordPress site whose host didn’t update PHP promptly was exposed, no matter how well theme and plugins were maintained.

Node.js, 21 October. The same day Node.js released security updates for all supported lines (v22.23.4, v24.22.1, v26.12.1). Ten CVEs, four rated high, including an out-of-bounds write in the Brotli decoder that permits remote code execution (CVE-2026-111497) and several TLS hostname-check bypasses. That same Brotli flaw was the reason for PHP’s Windows rebuilds on 26 October. One library, two ecosystems.

WordPress itself, September and October. WordPress 7.1.2 (22 September) closed an unauthenticated path traversal that could lead to code execution under certain conditions. WordPress 7.1.3 (6 October) brought seven security fixes, including stored XSS on the comments admin screen and an SQL injection in the export.

Why this will grow, not shrink

There’s no clean statistic about the future, but there are two plausible reasons.

More code. Every site built with AI help brings dependencies. Every dependency is code that can contain bugs.

More searching, much of it automated. Several of the seven fixes in WordPress 7.1.3 were reported by, among others, AI labs and security firms. The PHP Foundation writes that PHP was scanned with AI tools in 2026 and that AI-assisted research has raised the number of reports. Its conclusion on 21 October 2026: “Tools now find bugs faster than ever, for defenders and attackers alike, and the number of reports will keep growing.”

That’s good, because flaws get found before someone exploits them. It also means anyone running a website will get “please update now” more often, and someone has to act on it.

For scale in the WordPress world: Patchstack counted 11,334 new vulnerabilities in 2025, 91 % in plugins, 46 % with no patch at the time of disclosure. Patchstack sells WordPress protection, so this is vendor data. It’s plausible all the same.

What it costs agencies and site owners

A week like 21 October means, for an agency with many WordPress clients: check every installation, ask every host which PHP version runs, update where needed, inform clients. On top of the usual plugin updates. That time appears in no quote unless you put it there.

And an awkward truth: clients don’t notice good maintenance. They only notice when their site suddenly advertises online casinos.

What you need

1. An update routine with a date. Subscribe to security advisories for PHP, Node.js and your CMS. For critical ones, check the same or next working day which client sites are affected. Otherwise once a month.
2. Off-site backups with tested restores. A backup at the same provider in the same account isn’t a backup for the worst case. Once a year, restore a site from backup onto an empty system.
3. External monitoring. Uptime, TLS certificate expiry, domain expiry. Monitoring on the same server goes down with it.
4. Fewer moving parts. Every plugin, database and embedded third-party script is something to maintain. Do you really need it?
5. Static wherever possible. A static site runs no PHP or Node code on requests and isn’t directly hit by flaws like PHP2Shell. Node then only runs at build time on your machine or in CI, not live on the internet. You still update it, but without time pressure on the live site.
6. Clear responsibility. The handover document says who does updates, how often and how fast. Domain and hosting are in the client’s name so nothing depends on one person.

Where Kiekkist helps, and where it doesn’t

Kiekkist sells designs, not hosting or maintenance contracts. Here’s what we can take off your plate:

• Static export with no plugin stack. Astro or plain HTML. No database, no admin login to attack.
• Zero third-party requests out of the box. Fonts and images live on your server. Less foreign code on the page means less that changes without you.
• Checked before sale. Accessibility against WCAG 2.2 AA (automated plus manual spot checks) and load time. You don’t start with legacy problems.
• Handover pack with an operations section. For the end client: where the site lives, who owns domain and hosting, how backups run, who does updates, what to do in an emergency. As a template to fill in.
• Nothing depends on our server. After download everything works without us, and the licence can be verified offline.

What we don’t take off your plate: someone has to host the site, renew the certificate, renew the domain, update the build now and then and keep a backup. For a static site that’s little work. It’s never zero. And if you export a Kiekkist design as a WordPress theme, you also take on maintaining WordPress and PHP.

A good-looking design is quick to make, especially with AI. A site that still runs safely in three years needs someone who looks after it. That’s the real work, and it belongs in the quote.

Sources

• php.net, Upcoming Critical PHP Security Release, 20 Oct 2026: https://www.php.net/archive/2026.php#2026-10-20-1
• php.net, Security advisory: critical remote code execution vulnerabilities, update now, 21 Oct 2026: https://www.php.net/archive/2026.php#2026-10-21-5
• GitHub Advisory GHSA-w8hw-w9fx-j79w (CVE-2026-109618): https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
• GitHub Advisory GHSA-6wmf-4rv5-p3rp (CVE-2026-109619): https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
• The PHP Foundation, 21 Oct 2026: https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/
• Cyber Security Agency of Singapore, AL-2026-151: https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-151/
• Node.js, October 2026 Security Releases, 21 Oct 2026: https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
• WordPress 7.1.3, 6 Oct 2026: https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/
• WordPress 7.1.2, 22 Sep 2026: https://wordpress.org/documentation/?p=16370921
• Patchstack, State of WordPress Security in 2026 (vendor data): https://patchstack.com/whitepaper/state-of-wordpress-security-in-2026/