People using website builders usually focus on design, copy, images and launch speed. Programming languages remain inside the product and are largely invisible. Yet the technology stack determines how a website works, which components require maintenance and whether a newly disclosed vulnerability applies to a particular project.
A modern website has two broad layers. The frontend is what people see in the browser: pages, navigation, forms, animation and buttons. The backend handles requests, data and server-side logic. Different languages and platforms can serve these roles. JavaScript is used in browsers and on servers, PHP remains common in traditional web development and WordPress-based systems, while Python, Java, Ruby and other technologies are selected according to a product’s architecture.
FOTBO AI uses a JavaScript stack. Interfaces generated for its websites are built with React, while the server side runs on Node.js/Express. A user describes the required result in plain language, and the AI creates the page structure, design, copy, images and functional components. The website can then be refined through chat, previewed across screen sizes, connected to a custom domain and published without manual server configuration.
PHP is not used in the standard FOTBO AI stack. This distinction became relevant after reports of critical PHP vulnerabilities collectively referred to as PHP2Shell. The issues affect the PHP runtime and, in certain configurations, may create a risk for servers where that runtime is installed. A vulnerability in one language or runtime, however, does not automatically put every website on the internet at risk.
The practical assessment starts with one question: does the project use the affected technology? PHP is absent from the standard FOTBO AI architecture. As a result, PHP2Shell does not apply to websites created and published in that environment. Their users do not need to locate a PHP version, install a PHP update or change a server setting.
For a non-technical user, this is also an example of how a managed platform simplifies website creation. The user concentrates on the idea, content and outcome, while implementation, publishing, SSL and managed infrastructure remain part of the service. When a security issue is disclosed in a programming technology, the first step is to determine whether that technology is present in the product stack before asking users to take action.
There is an important boundary. FOTBO AI supports code export and GitHub integration. After export, an external developer may change the architecture, add PHP, WordPress, Laravel or another component, and deploy the project to a separate server. That modified project should be assessed independently because its actual stack may no longer match the standard FOTBO AI environment.
Cybersecurity communication often becomes either too technical or unnecessarily alarming. A clearer explanation follows a simple chain: websites can use different technologies; a vulnerability affects systems where the relevant technology is present; FOTBO AI uses React, JavaScript and Node.js/Express and does not use PHP in its standard stack.
The practical conclusion for FOTBO AI customers therefore does not involve emergency action. PHP2Shell is a significant issue for administrators of affected PHP systems, but it is not an issue for standard FOTBO AI websites. For a future technical audience, the example also demonstrates platform transparency: the stack can be stated directly, and the responsibility boundary can be explained without making broad claims of absolute invulnerability.
