Outdated software puts SME websites at risk

Some 30.5% of Dutch small and medium-sized enterprises (SMEs) run outdated software. Hundreds of thousands of websites are also set to lose access to security updates for their PHP version. This is according to research by web agency Bureau Imago involving 1,280 SMEs, conducted following the disclosure of two critical PHP vulnerabilities on 21 October. Websites worldwide were taken offline as a precaution, including those of the Dutch House of Representatives and MijnOverheid, the Dutch government's online public services portal.

Outdated software includes PHP versions that no longer receive updates, outdated WordPress installations, and plugins that are out of date or have been removed. Support for PHP 8.2 ends on 31 December 2026. Websites that continue to use this version will no longer receive regular security updates and may remain vulnerable to newly discovered security issues.

Plugins fall behind

WordPress, which is built on PHP, is the most widely used platform in the sample: 57% of the companies surveyed have a WordPress website. On 44% of these websites, at least one plugin is one version behind. On 23%, at least one plugin is an entire major version behind. In addition, 4% use a plugin that WordPress.org has removed for security reasons.

Updates often remain overdue at smaller companies. Updating outdated software can also cause a website to stop working properly, for example if certain plugins are incompatible with a newer PHP version. As a result, organisations may postpone updates, leaving their websites vulnerable to known security issues.

The risk is increasing as vulnerabilities in plugins and themes continue to be discovered, particularly at a time when AI is being used more widely. According to cybersecurity company Patchstack, the number of reported vulnerabilities in WordPress plugins and themes rose from 1,382 in 2021 to 11,334 in 2025. Around half of serious vulnerabilities are exploited within a day of disclosure.

An alternative to WordPress

Bureau Imago suggests that businesses with outdated websites consider rebuilding them without WordPress. The agency offers its own service for this purpose, Resite Now. It uses AI to convert existing WordPress websites into static websites while retaining their text, images and URLs. This eliminates the need for WordPress, plugins and PHP. According to the agency, an employee reviews every page before the new website goes live.

WordPress users can check for outdated components under Dashboard and Updates. The PHP version can be found under Tools, Site Health, Info and Server, or in the hosting provider's customer portal. For PHP 8.2 or older, Bureau Imago recommends contacting the web developer or hosting provider to discuss the necessary updates.