What happened, in plain words

PHP is the language WordPress runs on, on the server. Both flaws are in PHP itself, not in WordPress, a plugin or your theme. That means:

• updating WordPress or plugins does not fix them,
• the only real fix is updating PHP on the server.

Both are rated 9.2 out of 10 (CVSS v4.0). Details leaked before the planned disclosure, and attacks were seen from the morning of 21 October.

Which versions are safe

Every way of running PHP on a web server is affected (PHP-FPM, Apache mod_php, LiteSpeed, CGI). Apache with mod_php carries the highest risk.

What to do today

1. Check which PHP you run. In WordPress: Tools → Site Health → Info → Server. Or in your hosting control panel.
2. Don’t rely on the number alone. Many hosts and Linux distributions apply the fix without changing the version number. Ask your host directly: “Have you applied the 21 October PHP fix (CVE-2026-109618 / 109619)?”
3. Own VPS or server: install the updated PHP packages and restart every PHP process (e.g. php-fpm) so the new version is actually running.
4. On PHP 8.1 or older: plan the move to 8.2 or newer. Take a full backup, test on staging, and check forms, cart and payments after the switch.
5. Behind Cloudflare: managed firewall rules help, but they are an extra layer, not a fix.

How do I know if my site was already hit?

There is no single sure sign, but watch for unknown admin users in WordPress, unknown .php files in the uploads folder, redirects to unrelated sites, sudden server load, or “dangerous site” warnings from Google. If you see any of these, updating PHP is not enough: the site needs cleaning, new passwords and a file review.

Our clients’ sites

Our hosting provider has informed us that its servers are already protected: it applied additional security rules (ModSecurity/Imunify360) and PHP’s recommended interim settings, and installed the fixed PHP builds as soon as the vendors (CloudLinux, cPanel, Plesk) released them. Because some fixes ship as security backports, the PHP version shown in WordPress may differ from the official php.net number without the fix being missing.

If you are not a client and don’t know what your site runs on, send us the address and we’ll tell you what it needs.

Sources

• CISA — Critical Vulnerabilities in PHP Require Immediate Patching
• watchTowr — PHP2Shell FAQ
• Rapid7 — CVE-2026-109618 and CVE-2026-109619

The idea that AI is a tool only for large organizations with huge budgets is outdated. Many AI tools are accessible, affordable, and usable by a small business with no technical team at all.

Where it genuinely helps

Customer service: chatbots that answer common questions 24/7, without needing someone available around the clock.

Content: help drafting a first version of text, which a person then edits and refines.

Data analysis: spotting patterns in customer behaviour that would take hours to find manually.

What it doesn’t do well (yet)

AI doesn’t replace genuine understanding of your business, your customers, and your market. It works best as a tool that speeds up the work, not as a full replacement for human judgment.

How to get started

You don’t need to change everything at once. Start with one specific, repetitive problem — answering common questions, or drafting first versions of text — and see if it genuinely saves you time before expanding further.

SEO (Search Engine Optimization) is the process of making your website more understandable and more relevant to search engines, so it shows up higher when someone searches for something related to what you offer.

Why a beautiful website isn’t enough

Google doesn’t “see” your website the way a person does. It reads code, structure, loading speed, and whether the content actually answers what the user is searching for. A visually impressive website with the wrong technical structure can stay invisible.

The three core pieces

Technical SEO: proper structure, speed, mobile-friendly design — the foundation.

Content: pages that answer exactly what the user is searching for, not generic text.

External credibility: how much the rest of the web “trusts” your website.

How fast it brings results

SEO isn’t instant — it typically takes months for results to become consistent. But unlike paid ads, the results stick around even after you stop actively working on it, because the content keeps answering real searches.

See how we approach SEO on our service page.

Google Ads gives you instant visibility — you pay, you show up. SEO builds visibility gradually, without paying per click, but it needs time to “mature.”

When Google Ads first makes sense

If you need immediate results — launching a new product, a seasonal offer, or testing whether a specific market responds — Google Ads gives you fast feedback.

When SEO first makes sense

If you’re thinking long-term and want steady, organic traffic that doesn’t depend on an ongoing ad budget, SEO builds something that stays.

The combination works best

In practice, the two don’t compete — they complement each other. Google Ads brings immediate traffic while SEO builds in the background. Once SEO starts performing, you can gradually reduce ad spend without losing visibility.

What to watch out for

Google Ads stops performing the moment you stop paying. SEO takes patience, but keeps performing even when you’re not actively investing every month.

Every extra field on the purchase form is a chance for the customer to give up. Ask only for what you actually need.

2. No shipping-cost transparency

Customers need to know the shipping cost early, not at the last step of checkout — otherwise they abandon the cart.

3. Slow-loading product pages

Large, unoptimized images are the most common reason for a slow eShop. A few extra seconds of delay are enough to lose a sale.

4. Thin product descriptions

“Nice product, good quality” says nothing. Customers want dimensions, materials, close-up photos — whatever they’d ask about in a physical store.

5. No trust signals

Without clear contact details, a return policy, and secure payment options, many customers hesitate to complete a purchase.

6. Poor product search

If a customer can’t easily find what they’re looking for, they leave. Proper search and filters aren’t a luxury, they’re a core feature.

7. No strategy for abandoned carts

Most visitors don’t buy on their first visit. Without some kind of reminder system, you lose sales that were already close to closing.

8. Neglecting mobile

Most visitors arrive from a phone. An eShop that doesn’t work flawlessly there loses the majority of its audience.

9. No regular maintenance

An eShop that’s set up and forgotten accumulates technical issues, security gaps, and outdated plugins — until something breaks at the worst possible moment.

10. No SEO from the start

Many eShops are built without even basic SEO structure, and then wonder why they don’t show up on Google.

The truth: after the first 12 months, you can buy the site outright at a preferential price and get full ownership. Leasing is a way to start, not a permanent state.

Myth: “It’s more expensive long-term”

Depends. If you only compare the one-off build cost against the monthly subscription, yes, leasing can look more expensive over time. But an outright purchase doesn’t include hosting, updates, or maintenance — you’re paying for those anyway, just separately. Once you add it all up, the gap often shrinks considerably.

Myth: “You lose control of your website”

The site runs normally, on your own domain, with your own content, your full branding. The only thing that differs is who technically owns the code until you buy it out — not how you manage it day to day.

Fact: it does require a 12-month commitment

This one’s real, not a myth — and worth knowing upfront. It’s not a service you cancel the first month if you change your mind. It’s built for businesses that want stability and predictability, not a trial run.

Fact: it suits some businesses better than others

If you already have the capital and plan to keep the same site for years with no changes, buying outright may fit better. If you’d rather start without a large upfront cost and want maintenance already sorted, leasing is built exactly for that.

Shopify is a closed platform-as-a-service: you pay a monthly subscription, and Shopify itself hosts, maintains, and updates everything. WooCommerce is a plugin on top of WordPress — open, flexible, but it needs someone to set it up and maintain it.

When Shopify fits

If you want to launch quickly, without technical involvement, and don’t mind paying an ongoing subscription to the platform itself, Shopify is simple and reliable.

When WooCommerce fits

If you want full control over how your store works — custom features, integrations with Greek invoicing or shipping systems, or simply want to avoid ongoing dependence on a foreign platform — WooCommerce gives you that freedom, at the cost of needing proper setup from the start.

The Greek angle

For businesses in Greece, WooCommerce usually has a practical edge: easier integration with Greek payment systems, courier companies, and accounting software, through plugins built specifically for the Greek market.

There’s no universally “better” choice

It comes down to how much control you want, how much technical support you have available, and where you see your store in 2–3 years. Our own FlexShop is built on WooCommerce, precisely for that flexibility.

Search “website cost” and you’ll see figures anywhere from €300 to €8,000+ — both ends are genuinely real, they just describe completely different things.

• Landing page (single page, basic setup): roughly €300–700
• Business website (5–10 pages, basic SEO): roughly €800–2,500
• More complex project (multilingual, custom features, API): €1,500–8,000+

Why the gap is so wide

Cost doesn’t depend only on page count. What matters is design time, whether the content is ready or needs writing from scratch, whether custom code is needed versus a well-configured template, and the level of SEO/performance work required from day one.

What the initial price doesn’t show

The most common trap: the build price doesn’t include hosting, security updates, or the maintenance your site will need afterward. Those are ongoing costs — worth factoring in alongside the initial build cost, not treating separately.

How to decide what you actually need

Start from what your website needs to do, not from how many pages you want. A small business with a clear, focused offer often needs less than it thinks; a business with a complex service catalog or a need for multiple languages needs more design work upfront.

See our own Website Design packages with clear pricing, or if you’d rather pay monthly than upfront, see FlexSite.

When you pay upfront for a website, the problem isn’t the initial cost — it’s what comes after. Hosting, security updates, backups, small fixes: all of that keeps existing, it’s just that nobody factors it into the original price.

What “leasing” a website actually means

With a model like FlexSite, you’re not paying for a product that gets delivered and then leaves you on your own. You’re paying for a service that stays alive: hosting, updates, support, all bundled into the monthly subscription. The upfront cost gets spread into small installments instead of one large lump sum.

When it actually pays off

It’s not always the cheaper option long-term — if you plan to keep the same site for years with no changes, paying upfront can end up cheaper overall. But if you want zero upfront cost, maintenance already built in, and the ability to move up or down a tier as your business changes, the flexibility is worth it.

The key point: you’re not locked in

After the first 12 months, you can buy the site outright at a preferential price and own it fully — “leasing” doesn’t mean “never yours.” It’s just a different way to start, without committing a large amount of capital upfront.

If you’re not sure which model fits your situation, try our comparison tool — plug in your own numbers and see exactly which one actually works out cheaper.