On October 21, 2026, a critical vulnerability was discovered in PHP, and an emergency patch was released. The following day, the Information-technology Promotion Agency (IPA) also issued a warning.
News like this makes me think again. Is a website really necessary? Is it worth paying maintenance fees, keeping it updated, and implementing security measures just to maintain your own company website?
Recently, I saw opinions suggesting that a website is unnecessary if you have social media. Given the management effort and costs involved, I can understand why people feel that way. However, I do not agree with getting rid of your own company website. The issue is not a binary choice of whether a website is necessary or not.
What We Learned from This PHP Issue
This issue is known as "PHP2Shell" and involves two vulnerabilities, CVE-2026-109618 and CVE-2026-109619. If exploited, it could allow unauthorized code to be executed remotely. Its severity was rated 9.2 on the CVSS v4.0 scale.
The patched versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Since server companies and others may apply patches independently, you should not assume a site is safe based solely on the version displayed on the screen. You also need to check the response status of your service provider.
What is important here is that this is not just a WordPress issue. It affects various systems that use PHP, including WordPress and Drupal. On the other hand, not all websites are attacked under the same conditions. The impact varies depending on the server configuration and update status.
I have also been checking the operational status of several websites I previously created. Just because a page displays normally does not mean it is safe. That is the most troublesome part.
You need to look not only at the WordPress core and plugins, but also at PHP and the server. A website is not finished once it is built.
So You Stop Having a Website. Does That Solve the Problem?
Some people think that since maintenance is a hassle, they should just use Facebook or Instagram. There are certainly cases where this approach makes sense if the only goal is to share information.
However, social media is not your own land. The display mechanism, terms of use, and continuation of the service are all determined by the operating company. Your posts may stop reaching people, and there is also a risk of losing access to your account.
The same applies to Amazon, Rakuten Ichiba, Yahoo! Shopping, Mercari, and Yahoo! Auctions. They have great sales power. If that is what you need, you should use them. However, you cannot take all the reputation you have built there and all your customer touchpoints with you as your own company assets.
Use external services. But do not entrust your company information and entire sales infrastructure to them. I believe this boundary is necessary.
In the Era of AI Search, Where You Store Your Information Becomes Even More Important
Nowadays, more people are not only using Google Search but also asking questions directly to ChatGPT and other AI. "How does this product differ from others?" "What kind of tests are performed?" AI may answer such questions by referencing publicly available information.
Public social media posts may also be searched or referenced by AI. It is not accurate to say that "social media is not cited by AI." However, there are restrictions on visibility and data collection, and it is not always referenced. The same applies to your own company website.
Even so, your own company website has strengths. You can organize and preserve product specifications, development history, test conditions, results, and precautions all in one place. If there is a mistake, you can correct it. You can also link related articles together.
We at NEXT SCIENCE develop products such as ORBITRON and GERHON. The reasons for prototyping, the measurement conditions, and both the successful and unsuccessful results are all information that should originally be accumulated. It is a great waste to post them on social media and let them disappear into a timeline.
It Is Not a Question of WordPress vs. Shopify
What we should not misunderstand here is that having a website and using WordPress are two different things. For an informational site that is updated infrequently, a static site may be suitable. If you are selling products, you have the option of using an e-commerce service like Shopify.
Shopify is also an external service. You can never eliminate your dependence on it. That is why it is important to have your own domain, properly store your product and article data, and keep it in a state where it can be migrated.
What needs to be protected is not a specific system, but your company's information and customer touchpoints. For that, you should decide what you will manage yourselves and what you will entrust to a professional service.
Just Building It Is Not Enough. If It Does Not Sell, You Need to Improve It
Of course, having a website is not enough. Even if you get traffic, if the differences in your products are not conveyed and people do not buy, you need to make improvements. If your security is outdated, that should be the first thing you fix. If there is no one to update it, you should reconsider your management method.
Our website is still being improved. The challenge is to create a flow where people find us through search, understand our products, trust us, and purchase them if they need them.
We have also organized the same theme in Reasons Why Your Shopify Store Is Not Making Sales and How to Use GA4, GSC, and Clarity.
Social Media Is the Entry Point. Your Own Company Website Is Where Your Company's Records Are Kept
Announce new initiatives on Facebook. Share the background of development on note. Show test procedures on YouTube. Let people discover your products for the first time on Amazon. I think it is best to make the most of each platform's role.
And keep detailed information and its supporting evidence on your own company website. So that you can still understand the content when you look back at it years later. So that it can be found by search engines, AI, and those who need it.
This PHP issue is not a reason to abandon your website. It is an opportunity to think again about what you should protect and not leave management entirely to others.
There is value that cannot be measured by immediate traffic numbers or sales alone. You must preserve what your company has done over many years in your own words. I believe you must not lose that place.
NEXT SCIENCE
References
IPA: Regarding PHP Vulnerability Countermeasures (October 22, 2026)
PHP Official: PHP 8.3.36 Security Release
Google Search Central: AI Features and Websites
Photo: Manuel Luikenga / Unsplash