Your website still loads. The contact form seems to work. Nobody has complained.
As the Aussie colloquialism goes: “She’ll be right.”
Will she, though?
The quick read
Black October key takeaways
- A working website can still be vulnerable. Ask your host or developer to confirm PHP is patched.
- Review old plugins, account access and working backups, and give someone responsibility for maintenance.
- Investigate a suspected breach. Patching a vulnerability does not undo an earlier intrusion.
- Plan your next foundation: content, redirects, forms, integrations and a proper handover to a Sanity build.
When the plumbing gives way
Black October was a fairly blunt reminder that putting off updates and neglecting website hygiene can have consequences well beyond a broken page. And this isn’t new. In October 2025, Forbes reported 1.6 million blocked attack attempts against outdated WordPress plugins in just 48 hours. Show someone an enticing door and they’ll want to open it.
Keeping with that metaphor, it’s worth remembering that a website is a bit like a house. You notice the paint, not the plumbing. Everything looks lovely until something hidden gives way and you’re standing in the living room wondering where all that water came from.
Black October shows us how the structural web can have subsidence in the form of critical PHP vulnerabilities, urgent patches and public services taking websites offline as a precaution. Turns out “it’s still working” isn’t much of a security check. And now you’re past smoothing things over with a bit of filler and a lick of paint, and straight into underpinning your entire online business presence.
On the dreaded day of 21st October, WordPress warned site owners to update PHP after fixes were released for two critical vulnerabilities. These were flaws in PHP itself, not something confined to WordPress. On affected servers, attackers could run code without even logging in. Updating WordPress alone won’t fix them.
For a business, we’re not just talking 404s. The fallout can extend well beyond a broken page. An unavailable site can mean lost enquiries. A compromised one can expose data and leave customers questioning whether they can trust you. That’s an awkward conversation to have after deciding maintenance could wait.
Clean up on aisle 404
So, how about a little web hygiene? Ask your host or developer to confirm PHP is patched. Review old plugins and account access. Check that backups work and somebody actually owns the maintenance job. If you suspect a breach, get it investigated. A patch closes the vulnerability it fixes; it doesn’t undo an earlier intrusion.
Then ask the bigger question: how much longer do you want to keep nursing this setup along?
For bespoke business websites weighed down by plugins and workarounds, we think the move away from WordPress is long overdue.
A better foundation for your business
At Fireplace Digital, we build with Sanity because we can shape the editing experience around your business. Services, articles and staff profiles live where you’d expect them. Your team can update content without wandering through settings they shouldn’t need to touch. Your CMS is streamlined to the options you actually use instead of a face full of out-of-date plugins.
Sanity provides a managed content backend, and we build the website separately. Retiring WordPress removes its PHP-based CMS and plugin stack from your setup.
The move needs a plan, including the content worth keeping, redirects, forms, integrations and a proper handover. That’s where we can help. We design the content structure and editing experience as part of the build, rather than handing you a new dashboard and wishing you luck.
Patch the current site now. Talk to Fireplace Digital about moving to a Sanity build that fits the business you actually run.
“She’ll be right” is doing a lot of heavy lifting. Let’s give her a break.