What happened
PHP is the software that runs a large share of the world’s websites. Most funeral home websites built on WordPress, and many built by local web designers, rely on it.
On 21 October 2026, the people who maintain PHP released a fix for a serious security flaw, which security researchers have named PHP2Shell. In the days since, security firms have recorded millions of attempts to exploit websites that haven’t been updated, and the BBC reported sites being taken offline worldwide while they were patched. At the time of writing, there are no confirmed reports of sites being broken into through this flaw, but the advice from security experts is clear: update now.
Why older websites are most at risk
Websites on recent versions of PHP can simply be updated. Older versions are no longer supported, so there is no official update for them, and the oldest versions get no fix at all. A site on an old version needs a bigger upgrade, and that takes planning.
This is common in our profession. Many funeral home websites were built several years ago, work perfectly well day to day, and haven’t had their underlying software touched since. Nothing looks wrong from the outside, which is exactly why it gets missed.
Why AI makes this more pressing
AI tools are now everywhere, and most of what they do is helpful. But they also make it faster and cheaper for people with bad intentions to search the internet for websites running out-of-date software, at a scale that wasn’t practical a few years ago. A small, independent funeral home is no longer too small to be noticed by an automated scan.
What’s at stake for a funeral home
Your website does more than it used to. Families use it to:
- find your phone number at any hour
- check your prices and compare options
- send enquiries, and in some cases arrange and pay online
- read obituaries and funeral notices
Keeping it up to date is simply part of looking after them.
Five simple steps to take this week
- Ask your web provider whether your site has been updated for the PHP security issue.
- Find out who is responsible for keeping your site’s software up to date, and how often it’s done.
- Check for old sites. If you’ve moved to a new website, make sure the old one has been switched off and isn’t still online somewhere.
- Remove unused plugins and logins. Old add-ons and ex-staff accounts are common weak points.
- Know your recovery plan. Ask how quickly your site could be restored if something went wrong.
Be careful of scam emails
Whenever a security story hits the news, scam emails follow. A genuine message will never ask for your passwords or ask you to pay urgently to “fix” your site. If in doubt, call your web provider on a number you already have.
How FuneralBranch sites are built
The websites we build are fast, static pages with no PHP, so this week’s issue doesn’t affect them.
Want a second opinion?
If you’re not sure whether your website is affected, or who looks after it, we’ll take a look for free and send you a short, plain-English note you can pass on to your web provider. There’s no cost and no obligation.
