Your WordPress site runs on PHP. Ours don't.
On 21 October, PHP shipped emergency fixes for PHP2Shell: two critical flaws that let an attacker run code on a web server without logging in. Every WordPress site runs on PHP. Join Leadout Pro (any business) for US$299 a month and we rebuild your site, up to 20 pages, as plain files with no PHP and no plugins to patch.
30 days free · Cancel any time · Your domain stays yours
A flaw in PHP, not in WordPress.
That's why updating WordPress doesn't fix it. The fix is the PHP version your host runs.
Two critical flaws in PHP itself
CVE-2026-109618 and CVE-2026-109619, rated 9.2 out of 10, let an attacker run code on the server without logging in. PHP fixed them on 21 October 2026.
No WordPress update will fix it
WordPress.org says no WordPress update is needed or planned. Your host has to update PHP on the server.
Older PHP gets no fix
PHP 8.1 and older no longer get updates from the PHP project. CISA's advice for systems that can't be patched is to take them offline until they are.
Attacks started early
Cloudflare reported early attacks on the flaws, as reported by BleepingComputer. CISA had not seen a successful break-in when it issued its alert.
Sources: PHP security advisory, 21 Oct 2026 · CISA alert · WordPress.org
Check your site now.
Do this whether or not you ever talk to us.
Find your PHP version
Log in to WordPress and go to Tools, then Site Health, then Info, then Server.
Compare it
Fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or newer on the same line.
Older, or not sure?
Ask your host whether they have applied a fix. Hosts sometimes patch older versions without changing the version number.
If your host has patched, you're covered for this one. The catch is the next one: a WordPress site needs its PHP, theme and plugins kept patched for as long as it runs, and PHP 8.2 stops getting fixes on 31 December 2026.
Plain files. Nothing to patch.
Members get their WordPress site rebuilt, up to 20 pages, within the first 30 days.
No PHP, no plugins
We rebuild your site as plain pages on our hosting. They are not served through PHP, and there is no database or plugin for an attacker to work on.
Your content comes across
Your pages and photos come across, your existing blog posts move to your blog or news subdomain, and your old page addresses point at the new ones so links and search rankings keep working.
Forms that reach your CRM
Every enquiry form, chat and booking lands in Leadout CRM, which comes with the membership.
Found by search and AI
Pages planned from keyword research and written so search engines and AI assistants describe you correctly.
Online shops, member logins and booking engines need more than plain pages. Tell us what your site does on a call and we'll say what fits.
Plain pages, live now.
Three of the sites we build and run. Each one is plain pages, with its forms landing in the owner's CRM.
inspireelectrical.com.auInspire Electrical & Ventilation
Electricians and sub-floor ventilation on Sydney's Northern Beaches, with a film through the house that plays as you scroll and quote forms that land in their CRM. Hosted by us.
Visit Inspire →
swanhillgardencentre.com.auRhimahden Plant Nursery
A family nursery in Swan Hill, Victoria. Every page rewritten from Search Console research, and an enquiry form that lands in their CRM. Hosted by us.
Visit Rhimahden →
velveteer.coVelveteer
A vegan cocktail foamer sold to bars and distributors, with cocktail recipes, pages for venues and distributors, and a samples form that lands in their CRM.
Visit Velveteer →More of our work, including our own sites, is on the web design page. Want to see yours first? Get a free sample.
US$299 a month. 30 days free.
The whole deal, up front.
- Leadout CRM, with full API access: every enquiry, call, text, email and chat in one inbox, with booking, forms, review requests and the AI receptionist.
- Each month includes a usage credit, enough for up to 5,000 emails, 400 texts, 360 phone minutes or 2.5 hours of Voice AI, or a mix. Use beyond the credit is charged at Leadout's usage rates; ask us for them any time.
- Your website rebuilt, up to 20 pages, within your first 30 days, and hosted free while you're a member. You approve every page.
- Your build includes a blog, projects or news section on its own subdomain, such as news.yourbusiness.com, with your existing blog posts moved across and ready for new posts.
- Changes after your site goes live are charged at our consultancy rates.
- Cancel any time, including during the 30 free days. When membership ends, the site comes down unless you keep it for a one-off US$10,000.
- Your domain is yours: take it with you when you leave, whether you already owned it or we registered it for you.
- Prices are in US dollars, plus GST for Australian businesses.
WordPress rebuild questions.
My host says it has patched PHP. Do I still need this?+
For PHP2Shell, no. You're covered. The rebuild is for the next flaw, and the one after: a WordPress site needs PHP, theme and plugin updates for as long as it runs.
Will I lose my blog posts?+
No. Your existing posts move to your blog or news subdomain, and their old addresses point at the new ones. New posts go there too.
Is this only for Simpro users?+
No. Leadout Pro (any business) is for any small business. On Simpro? Leadout Pro for Simpro adds the Simpro connection.
I run an online store on WordPress.+
WooCommerce needs more than plain pages. Book a call and we'll tell you honestly what fits.
Is my site already hacked?+
We can't tell from here. If you see pages you didn't make, odd redirects or new admin users, ask your host to check it straight away.
Off WordPress, onto plain pages.
Book fifteen minutes and tell us what your site does. We'll tell you whether the rebuild fits.
Hayden Nosatti · Leadout · Sydney