of all websites with detectable server technology run on PHP.
Source: W3Techs, 21 October 2026After PHP2Shell . New website possible in 1 to 2 weeks
Website relaunch without PHP risk: a new website in 1 to 2 weeks
On 21 October 2026, two critical vulnerabilities in the core of PHP became public under the name PHP2Shell. PHP is the technology underneath WordPress, TYPO3, Joomla, and almost all page builders. Self-hosted websites are most at risk, especially where nobody installs the PHP update. LILOX moves your website to a secure foundation: as a static Astro website with no PHP on the server at all, or as a WordPress website on enterprise hosting, where security updates are installed immediately. A new website is possible in 1 to 2 weeks at a fixed price from €4,900, with your content and Google rankings preserved.
Static without PHP or managed WordPressNew website in 1 to 2 weeksFixed price from €4,900Rankings are preserved
Problem
What is PHP2Shell and what risks does the vulnerability bring?
PHP2Shell mainly hits websites that nobody looks after
PHP2Shell is two critical vulnerabilities in the core of PHP. Attackers can use them to run their own code on the web server without credentials, and neither a security plugin nor maintenance mode protects you. Only the PHP update to a patched version works. At risk are self-hosted websites where nobody installs the update, outdated builders that break when PHP is changed, and every additional plugin as an open door. The consequences range from a data breach with a duty to report within 72 hours under Art. 33 GDPR, through liability questions for management, to queries from the cyber insurer.
of PHP websites use a version with no official update against PHP2Shell.
Own estimate based on W3Techs datapoints: both vulnerabilities score this on the CVSS severity scale.
Source: PHP Security Advisoryafter the update, Sansec expected the first mass attacks.
Source: SecurityWeek, 21 October 2026Systems at a glance
Which page builders and website systems use PHP?
Almost every website system runs on PHP
All builders for WordPress are extensions of WordPress and therefore run on PHP. Whether your website is at risk depends on the PHP version on the server. Statically delivered websites are not affected.
| System | PHP2Shell | Quick note |
|---|---|---|
| WordPress with page builders (Elementor, Divi, WPBakery, Avada, Bricks, and others) | affected if unpatched | Safe with current PHP and updates. |
| WordPress on enterprise hosting (LILOX) | patched | PHP updates installed immediately. |
| TYPO3, Joomla, Drupal, Contao | affected if unpatched | Maintained PHP and upkeep required. |
| Shop systems (WooCommerce, Shopware, Magento, PrestaShop) | affected if unpatched | Customer accounts raise the risk of a data breach. |
| Astro, delivered statically | not affected | No PHP, no database, no login. |
PHP2Shell: what website owners should do now, read the five steps for today (article in German).
Solution
What does a secure website look like after PHP2Shell?
Two secure paths for your new website
For maximum security and load speed we recommend Astro, and for teams that do a lot of the upkeep themselves, WordPress on enterprise hosting. If TYPO3 is the standard in your company, we build on TYPO3 14 LTS with a maintenance contract.
| Criterion | Self-hosted with page builder | WordPress on enterprise hosting (LILOX) | Static Astro website from LILOX |
|---|---|---|---|
| Attack surface | PHP, system, builder, plugins, database, public login | PHP and plugins, secured and monitored by the host | Finished HTML files on a CDN, no login on the website |
| Vulnerabilities like PHP2Shell | Open until someone installs the update | Patched immediately by the host | Not affected, because no PHP runs |
| Updates in operation | Often left undone, nobody responsible | Handled continuously by LILOX and the host | Hardly needed |
| Maintaining content | In the builder, often only with help | Familiar WordPress interface with Divi 5 | Editorial interface with approval |
Static Astro website from LILOX
- Attack surface: Finished HTML files on a CDN, no login on the website
- Vulnerabilities like PHP2Shell: Not affected, because no PHP runs
- Updates in operation: Hardly needed
- Maintaining content: Editorial interface with approval
Self-hosted with page builder
- Attack surface: PHP, system, builder, plugins, database, public login
- Vulnerabilities like PHP2Shell: Open until someone installs the update
- Updates in operation: Often left undone, nobody responsible
- Maintaining content: In the builder, often only with help
WordPress on enterprise hosting (LILOX)
- Attack surface: PHP and plugins, secured and monitored by the host
- Vulnerabilities like PHP2Shell: Patched immediately by the host
- Updates in operation: Handled continuously by LILOX and the host
- Maintaining content: Familiar WordPress interface with Divi 5
Why LILOX
What do you get from LILOX?
A new website in 1 to 2 weeks, with no risk to your rankings
You do not get a website builder. You get a website written for your customers and built for Google and AI search.
New website in 1 to 2 weeks
The duration depends on the scope, the number of web pages, and how quickly content and approvals are ready.
Fixed price before you sign
You know what the relaunch costs before you sign, at a fixed price from €4,900.
Rankings are preserved
In the redirect plan, every old address gets a destination on the new website.
Readable for Google and AI
Clean HTML with structured data, easy to read for Google AI Search, ChatGPT, Copilot, and Gemini.
Operation with updates and monitoring
You know who is responsible when a new vulnerability becomes known.
The founders look after your project themselves
Nadine and Christoph Fraiss look after your project themselves, from the intro call to handover.
References
Technical companies from Austria, Germany, and Switzerland work with LILOX
Pydro . IoT Hardware
One website in six languages, from the UK to Greece.
A strong product for a clearly defined audience of water utilities across Europe. What was missing was a path to them that didn’t rely on the founders’ own time.
- Website built and rolled out in six languages
- Two automated LinkedIn campaigns, connected directly to Pipedrive
- Google Ads, a lead magnet with email flow, and a newsletter combined into a single path
- 17 booked calls through the website, all from the researched target audience
Schwab AG . Partition Systems
At home in Bern since 1917, online since 2026.
The website had grown organically over the years and sat in the hands of an external provider. Management wanted two things: a presence that matched the quality of the products, and their own digital infrastructure back under their own control. We led the B2B website relaunch and took the site live in four months.
- Complete WordPress build with custom design, in German and French
- Sales funnel with Calendly booking for four sales advisors
- Tracking setup, cookie consent, and Looker Studio reporting
- Four months from kickoff to launch
Sample video, project footage to follow
IT Service Provider . Managed Services
One page per service, all leading to the same calendar.
All the services sat on a single page and couldn’t be promoted individually. Today, every service has its own page with its own question and its own booked call.
- One page per service, each with a clear job
- Questions phrased the way real searches are worded
- A booking path leading to a shared calendar
- A monthly report for management
01
+12 qualified first conversations a month.
Software company, 6 monthsCounted were conversations with companies matching the agreed target customer profile. The website took over explaining the product, so the call itself could focus on discussing the need.
02
€480k pipeline in 5 months.
Hardware, 14 calls at CIO levelThe pipeline came from 14 calls at CIO level. Every one of these calls had a traceable source, because measurement was in place before launch.
03
17% response rate instead of around 10%.
IT service provider, 9 months, 5 new customersThe outreach pointed to pages that backed up the offering. Over the nine-month period, five new customers resulted.
5 out of 5
My previous agency never came close to engaging with my company at the same depth Nadine and her team did.
Mulundo SichoneFounder, Pydro5 out of 5
Advice between equals, no fluff, always focused.
Prof. (FH) Dr. Uwe HeilEntrepreneur, Dr. Heil KG Consulting & Coaching for Executives5 out of 5
A clear recommendation if you’re building B2B new-customer acquisition for the first time.
ManfredHead of Sales, Cloud ERPProcess
How does a website relaunch without PHP risk work at LILOX?
A new website in 1 to 2 weeks: how your relaunch works
- Day 1
Intro call and audit
We clarify goals, scope, and the state of your current website.
PHP version · Builder and plugins · Forms · Which pages rank on Google
- Day 2 to 3
Sitemap and redirect plan
Every old address gets a destination on the new website. This keeps what you have built up on Google over the years.
- Day 3 to 6
Website as an HTML draft
You see the complete website with design and copy in the browser and give feedback directly on the draft. We carry over existing content from WordPress, TYPO3, or the builder.
- Day 6 to 9
Build with Astro or WordPress
The approved draft is built, statically with Astro or as a WordPress website.
Forms · Tracking · Structured data · Your editorial interface
- Day 10
Go-live and shutdown of the legacy system
Redirects go live, and the old installation is backed up and switched off. The old attack surface disappears instead of merely being patched.
- Afterwards
Operation, monitoring, and walkthrough
You know who is responsible when a new vulnerability becomes known. Your team maintains content itself after a walkthrough.
Service and price
What does a website relaunch without PHP cost?
What you get and what it costs
WEBSITE RELAUNCH
from €4,900
Fixed price for your new website, static with Astro or as managed WordPress, including carrying over content, redirect plan, forms, tracking, and a walkthrough. For SMEs in Austria, funding for digitalisation projects may be available.
RELAUNCH WITH LEAD GENERATION
from €2,900 / month
Relaunch and ongoing support with LinkedIn, email, ads, or AI visibility, with a monthly report for your management.
You know what the relaunch costs before you sign. The price depends on the scope, special functions, and the path you choose. With the static option there are no licence fees for builders and plugins.
15 / Who We Are
Who at LILOX works on our project?
The two founders of LILOX, from marketing and technology
LILOX is owner-led and deliberately works with only a handful of companies at a time. Your point of contact stays the same, from the first analysis through to ongoing service.
Nadine Fraiss . Marketing
15 years in digital marketing, several of them at CMO level.
Head of Marketing across traditional Mittelstand, startups, and scale-ups. Nadine has sat on both sides of the table: as the client who had to justify agency budgets, and as the person responsible for delivering pipeline by the end of the quarter.
For you, she leads positioning, the website, and campaigns, and stays your point of contact throughout the ongoing service.
- Positioning and messaging for offerings that need explaining
- Website as core module, from structure to conversion path
- LinkedIn, email, and ads working together instead of side by side
“Marketing is measured on pipeline today.”
Christoph Fraiss . Technology
Engineer and industrial engineer, Head of Engineering and managing director in production.
Christoph is a mechanical engineer, industrial engineer (MSc) and holds an international MBA from the Carlson School of Management and WU Vienna. 15 years of experience in managing large-scale projects, engineering high-performance plants and as a production and company manager, including at Thermo Fisher, Novartis and Aenova. He knows the moment an offer fails on price, and the moment it fails on a missing explanation.
For you, he translates between technology and market. That way, the project understands your product from the very first conversation.
- Technical translation from datasheet to customer benefit
- The investment decision-maker’s view of your offering
- Process understanding from production, costing, and sales
“I know how these companies run on the inside.”
Frequently asked questions
Questions about website relaunch after PHP2Shell
Is WordPress still secure after PHP2Shell?
Yes, WordPress can be run securely if the server uses a patched PHP version and the system, theme, and plugins are updated continuously. The vulnerability sits in the PHP core underneath WordPress, so the hosting is what matters. LILOX hosts WordPress websites on enterprise hosting, where security updates such as the one against PHP2Shell are installed immediately.
Does LILOX also offer WordPress websites?
Yes, LILOX builds WordPress websites with Divi 5 and hosts them on enterprise hosting, where security updates such as the one against PHP2Shell are installed immediately. LILOX takes care of updates, backups, and monitoring. For websites where security and load speed come first, we recommend the static option with Astro.
Which page builders use PHP?
All page builders for WordPress use PHP, including Elementor, Divi, WPBakery, Avada, Bricks, Oxygen, Beaver Builder, and Breakdance. Builders for Joomla such as YOOtheme and SP Page Builder also run on PHP.
Are Elementor and Divi affected by PHP2Shell?
Elementor and Divi are affected if the server uses an unpatched PHP version, because as part of WordPress they run on PHP. Updating the builder does not close PHP2Shell, the hosting is what counts. Outdated builder versions and add-ons often no longer run on PHP 8.3 or 8.4, which is why many unmaintained websites stay on unprotected PHP.
Is a static Astro website more secure than a self-hosted website?
A static Astro website offers the smallest attack surface, because when it is requested, neither PHP nor a database nor a login runs on the server. Vulnerabilities like PHP2Shell and plugin vulnerabilities do not affect it. It still needs upkeep, for forms, the hosting account, and the editorial interface.
Does a static website also need maintenance?
Yes, forms, the hosting account, and the editorial interface have to stay up to date. The difference: these parts do not sit in the path of every visitor, and there are three instead of thirty. Contact forms, appointment booking, and the connection to your CRM run through separate, secured services, while the rest of the website stays static.
Can we maintain the content of an Astro website ourselves?
Yes, your team maintains text, posts, and images in an editorial interface with approval, without a developer. After saving, the change is online within a few minutes. The interface is not on the public website, so visitors and bots see no login. For large editorial teams we connect Astro to a headless CMS such as Storyblok or Sanity.
What is a headless CMS?
A headless CMS is a content management system that only manages content and does not deliver a website. The website is built separately, at LILOX statically with Astro. With services such as Storyblok or Sanity, the CMS runs with the provider, and no PHP runs on your web server.
Astro or TYPO3: which is the better choice?
For most B2B company websites, Astro is the better choice, because it is faster, cheaper to run, and gets by without PHP. TYPO3 fits if many editors with tiered permissions work in several languages, or if TYPO3 is mandated across the group. In that case we build on TYPO3 14 LTS with security updates until mid-2029 and a maintenance contract.
Is the PHP update enough, or do we need a new website?
The PHP update is enough if your website already runs on PHP 8.2 or newer and the theme, builder, and plugins are maintained. A new website makes more sense if you are stuck on PHP 8.1 or older, components are no longer maintained, or design and content are outdated anyway. In the free intro call we tell you honestly which case applies to you.
What does a website relaunch without PHP cost?
A website relaunch at LILOX costs from €4,900 at a fixed price. The price rises with scope, functions, and the editorial solution you choose, and we name the exact fixed price after the intro call. With the static option there are no licence fees for builders and plugins.
Is a website relaunch possible for under €20,000?
Yes, most B2B relaunches at LILOX come in well under €20,000, and the entry point is €4,900 at a fixed price. What costs more is mainly many languages, special functions, and connecting a headless CMS. You know the price before you sign.
How long does a website relaunch take at LILOX?
LILOX delivers a website relaunch in 1 to 2 weeks. The duration depends on the scope, the number of web pages, and how quickly content and approvals are ready. Very large websites with many languages take longer.
Do Google rankings get lost in a relaunch?
Rankings are not lost if addresses, redirects, and content are carried over cleanly. LILOX creates a redirect plan for this, in which every old address gets a destination on the new website, and switches over web page by web page. Thanks to the shorter load time, rankings often even improve.
Is PHP2Shell already being exploited in attacks?
Security firms such as Cloudflare and watchTowr have observed attack attempts since 21 October 2026. According to public statements, a successful break-in has not been confirmed so far, as of 23 October 2026. Authorities such as the BSI and CERT.at nevertheless advise updating immediately.
What happens to our old website after the relaunch?
After go-live we back up the old installation completely and switch it off. This makes the old attack surface disappear instead of merely being patched. Content, images, and documents are carried over to the new website beforehand.
Does LILOX do website relaunches in Austria and Germany?
Yes, LILOX is an owner-led B2B agency from Tyrol and works for companies in Austria, Germany, and Switzerland. Projects run remotely with fixed dates for each phase. For SMEs in Austria, funding for digitalisation projects may be available.
Next step
Let us work out whether an update is enough or a new website is safer
In the free intro call we look at your website together and tell you honestly whether the PHP update is enough. If not, you get a fixed price for the relaunch without PHP risk.
30 minutesfree and non-binding
