An update on the recent PHP security issues

Moshi continues to be impacted as we repair, upgrade and rebuild affected client websites. This work has disrupted our normal schedule, and we thank you for your patience as we resolve these issues as quickly as possible.

The recent global security issue concerns PHP, part of the technology running many websites, including WordPress. Critical vulnerabilities prompted urgent updates in October. The issue extends beyond WordPress, and a vulnerable website isn’t necessarily an infected one—but it does require attention. Official advisory

As we work through the affected websites, we’re considering both their immediate needs and their longer-term foundations. Where substantial recovery or rebuilding is needed, it’s worth discussing whether WordPress remains the right platform for that business.

We moved most of our website development towards Webflow in 2021 for greater design flexibility, fewer plugins and compatibility issues to manage, and a simpler editing experience for clients. Its managed hosting also brings more of the underlying platform maintenance into one place. Webflow’s security overview

For some of our more involved custom projects, we’ve also chosen to build outside WordPress, using technology suited to the requirements. Every approach still needs ongoing care.

The wider lesson is to keep cyber security an ongoing conversation with your providers. Weaknesses can originate in website software, hosting, email, accounts or connected services. Understanding who maintains each part—and where responsibilities overlap—is increasingly important.

AI adds further complexity to the systems we use and the threats they face. Our digital assets are connected, and a vulnerability in one should prompt us to consider what it means for the others.

If you’re unsure how this relates to your website or business systems, or would like to understand more, please get in touch. We’ll make time for a conversation and help you work through it.