Security-hardened delivery
This copy of the concept site is served as pre-built static pages from an edge network. There is no PHP, no database, no plugin layer and no public login on the visitor-facing site.
Response headers sent on every page
| Header | Value |
|---|---|
Strict-Transport-Security | max-age=63072000; includeSubDomains |
Content-Security-Policy | default-src 'self'; img-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self' |
X-Content-Type-Options | nosniff |
X-Frame-Options | DENY |
Referrer-Policy | strict-origin-when-cross-origin |
Permissions-Policy | camera=(), microphone=(), geolocation=() |
Cross-Origin-Opener-Policy | same-origin |
Try it: CMS paths return 404
Why no PHP matters: PHP2Shell (October 2026)
On October 21, 2026, Wiz Research disclosed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), the same day PHP released patched versions. These are flaws in core PHP itself. They allow unauthenticated remote code execution, and disclosure of server memory that can contain passwords, tokens and API keys. The site's own code does not need to have a bug.
| Fact | As published by Wiz Research |
|---|---|
| Share of the web on PHP | PHP “powers 70% of all websites in the world”; “With 70% of the Internet affected” |
| Versions affected | Every PHP version released in the last decade, back to PHP 5.4, is affected by at least one of the flaws |
| Severity | Grouped under 2 CVEs, severity up to CVSS 9.2 |
| Demonstrated against | Pre-login takeover of the latest WordPress, Drupal and Joomla |
| Fix | Patched PHP releases, October 21, 2026: “the only complete remediation” |
Separate, older issue: CVE-2024-4577 (June 2024) was a different PHP flaw, limited to PHP-CGI on Windows.
What it means for KhS: khsglobal.com runs WordPress on PHP, which is the kind of stack PHP2Shell affected. We make no claim that the KhS site was affected or exploited. The point is the category: a PHP site depends on every engine and plugin flaw being patched quickly, every time. This static/edge rebuild removes that category, because there is no PHP runtime, no plugins and no public login on the visitor-facing site.
Source: Wiz Research, “PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet”, Oct 21, 2026, wiz.io/blog/php2shell-php-rce
HTTPS
Plain http:// requests are permanently redirected (301) to HTTPS. Check any page with a public header scanner such as securityheaders.com.