Over 100,000 Swiss websites offline. Why we moved away from PHP.

SRF reported on October 22, 2026 that Cyon had temporarily taken more than 100,000 websites offline because of critical PHP vulnerabilities. The shutdown was a precaution. It does not mean those websites had been hacked.

Cyon reported that its websites were back online early on October 22 after security updates. At the time of SRF’s report, the Swiss Federal Office for Cybersecurity knew of no attacks in Switzerland attributable to these particular vulnerabilities.

I spent years working with WordPress and helping businesses whose websites had been hacked. I saw how much time goes into cleaning up damage, restoring access and finding out what went wrong.

Those experiences helped shape our decision to move away from PHP several years ago. For the service businesses we work with, a website rarely needs a public content management system, a database and a collection of plugins running behind every page.

This incident concerns PHP itself. It should not be confused with a vulnerable WordPress plugin. Both are reminders that every part of a website’s software needs someone responsible for maintaining it.

Our websites are built in advance and delivered as static files. The public website does not run PHP or a WordPress installation. These PHP vulnerabilities therefore do not apply to its website runtime.

That removes an entire class of PHP-related risks from the website itself. It also means fewer moving parts to maintain. We choose this approach because it fits the job: presenting your business clearly and helping visitors contact you.

The hosting setup still matters. A provider can take a whole server offline, including static websites, while addressing a security issue elsewhere. Avoiding PHP alone is no guarantee against an outage.

No responsible provider can promise a website is 100% unhackable. Hosting accounts, domain access, build tools and connected services still need protection. Our approach reduces the attack surface; it does not remove every risk.

If your current website uses PHP, ask your host to confirm that the relevant updates are in place. The BACS guidance linked below is a useful starting point. A move to another platform can be a considered next step, rather than a rushed response to a headline.