On 21 October the PHP project fixed two critical flaws that let an attacker run their own code on a web server without logging in (PHP’s advisory). They affect any site whose pages are made by PHP when someone visits, which includes WordPress, Drupal and Joomla. If you run one of those, update PHP to a fixed release now. The advisory lists them.
A site that builds its pages on the server runs code each time someone visits, so a flaw in that code can be reached through an ordinary page request. A static site doesn’t run code for its visitors, so this kind of flaw has nothing to reach, as long as the site’s content comes from files rather than from another online system.
Sites built on the server
A WordPress site builds each page when a visitor asks for it. PHP, WordPress, the theme and every plugin run on the server, and they talk to a database holding the content and the user accounts. There is also a login page at a known address, /wp-admin, which needs strong passwords and two-factor sign-in.
Each of those parts needs regular updates, because its code runs whenever someone visits a page.
Static sites
A static site is turned into finished HTML files when it’s published, by a static site generator such as Astro, Hugo, Eleventy or Jekyll. The web server only hands out those files. Nothing runs for each visit, and the website has no database, no plugins and no login page.
The content can come from many places. This post is about the simplest: Markdown files kept in a git repository, usually on GitHub or GitLab. Changing a page means changing a file there, and publishing means the host rebuilds the site from the repository.
Many static sites instead pull their content from an online content system when they’re built, often called a headless CMS. Some of these run on PHP, including WordPress itself when it’s used this way. The public site is still static, but the content system is a server with its own login page, and it needs the same care as any WordPress site.
Some frameworks, including Next.js and Nuxt, can also work either way. Pages they build ahead of time are static. Pages they build on a server for each visit bring back running code, and that code has had serious flaws of its own, such as CVE-2025-29927 in Next.js.
Remaining risks
A static site built from Markdown moves the risk rather than removing it. The places to protect are:
- the git host account. Anyone who can push to the repository can change the site, so use two-factor sign-in and give each person only the access they need.
- the build. The host that publishes the site runs its build tools, so keep the site’s dependencies up to date.
- the hosting account and the domain registrar, which control where the site’s address points.
Each of these sits behind an account with two-factor sign-in rather than a public login page, and the git host keeps every change, so a bad one can be undone by bringing back an earlier version.
Orbit MD
Orbit MD is a desktop app for editing static sites whose content is Markdown in git. It changes the site’s files through git, using each editor’s own access to the repository, so the website itself gains no login page, plugins or database.
For a more technical take on this, read The attack surface of a static site built from Markdown in git.