In high school I worked at Taco Bell, and nearly every paycheck went straight to musical instruments and recording gear. They weren’t huge paychecks, to be fair, but it was nothing for me to come home from school and find a few giant Musician’s Friend boxes leaned against my bedroom door.
The problem was that I was awful at playing all of it. I never took the time to learn any of those instruments or even practice them. The day my bass arrived, I plugged it into GarageBand through my fancy little audio interface and just started recording. The learning, and even the playing, came second to the output.
When I moved out and had real bills for the first time, I sold the microphones and admitted I was not Trent Reznor.
Digital Relativity went through its own version of this with web hosting. Last week, when a serious PHP vulnerability hit the internet, we got a clear reminder of why letting go of the dream of managing servers was the right call.
We Used to Patch Our Own Servers
This was more than ten years ago, but I can still picture myself on the side of a back road on Christmas Eve, phone held up toward the sky for a signal, trying to reboot an unruly unmanaged Linux server.
Around the same time, one of our partners experienced a massive DDoS attack and we had no real way to deal with it. There was the server with the website on it and there was the open internet. Nothing stood in between.
We patched what we could and kept the lights on, but we were an ad agency. Every hour spent babysitting a server was an hour we weren’t spending on the work partners pay us to do. I can put gas in my lawnmower and change my own oil, but I probably shouldn’t be performing aircraft maintenance.
So We Went Looking for the Best WordPress Host We Could Find
So we stopped playing. We didn’t try to get better at running servers. We went looking for the best managed WordPress host we could find and handed the infrastructure to people who do nothing else.
We landed on WP Engine and never looked back. Every site we build gets its own production, staging and development environments. Server updates, PHP versions and platform security are handled by a team whose whole job is keeping WordPress fast and safe. Where we can, we put Cloudflare in front of it all for another layer of protection.
That freed our developers to spend their time building things for our partners.
What Happened This Month
On October 21, researchers from Calif.io, Wiz, OpenAI and Quarkslab disclosed two flaws in PHP itself, nicknamed php2shell (CVE-2026-109618 and CVE-2026-109619). PHP is the language WordPress runs on, along with a huge share of the web. The flaws affect PHP 5.4 and later. With one specially crafted web request, an attacker could crash a site, read data they shouldn’t see or run their own code on the server.
Because the problem lives in PHP and not in WordPress, updating plugins and themes doesn’t fix it. The server has to be patched.
To make it worse, details leaked before the official release, and attackers were already trying it out.
Cloudflare Got There First
Cloudflare started building protections in early October. At 3:02 am UTC on October 21, about nine hours before the vulnerability went public, its web application firewall started blocking php2shell attacks by default on every plan, including the free one.
After the leak, Cloudflare watched attackers tweak their payloads to get past those rules and kept adjusting. Their full write-up is worth a read because it explains in detail how the mitigations were rolled out.
WP Engine Did the Rest
Cloudflare is clear that a firewall is one layer of defense and the real fix is patching PHP. Their advice to site owners was to ask their hosting provider to apply the update.
We didn’t have to ask. WP Engine worked with Cloudflare to put the mitigation in place and installed the actual PHP patch on their platform. Our team didn’t lift a finger.
Our Only Job Was Telling Our Partners
Writing this post is the only work DR had to do for php2shell.
That won’t be true everywhere. Plenty of agencies still host client sites on unmanaged servers, and this week someone there is reading advisories, scheduling maintenance windows and patching PHP late at night. Clients pay for those hours, and none of them move a single goal forward.
Patching Linux matters, and it belongs with teams built for it. We made that call years ago, and this week shows why.
Know What You’re Good At
Selling all that recording gear stung a little. But admitting what I wasn’t made room to get good at what I am.
We build websites that help our partners hit their goals, and we leave the servers to people who are great at them.
If you have questions about where your site lives or how it’s protected, let’s talk.