The worldwide PHP emergency should prompt executives to fund the clean-up and give digital leaders the mandate and authority they have lacked for years. That work includes dealing with poor and outdated content, whose annual financial burden is modelled at $4.63 trillion. [3, pp. 5–6].

In Europe and Japan, governments, hospitals, banks and transport companies temporarily withdrew websites and online services in response to two critical PHP flaws, often as a precaution. [1] The UK’s National Cyber Security Centre warned that, under certain conditions, attackers could execute commands on an affected web server without authentication. It urged organisations to identify PHP installations across their infrastructure, including supported versions, and apply updates or, where updating was not possible, temporary mitigations. [2]

Finding the affected systems is part of a wider task: establishing what an organisation still has online. Digital leaders have been shouting for years about websites that are no longer maintained, information left available after it becomes outdated and uncertainty about who is responsible. Insufficient budgets and the absence of a top-level corporate mandate have limited their ability to deal with this systematically.

Orphaned websites need to be brought into that review. An unused website can still leave the organisation with vulnerabilities to address, even when its original purpose has ended. Digital leaders need to retire sites that are redundant and arrange maintenance for those still needed.

Clearing digital debt also means dealing with the information still available across websites and documents. Research by Storyblok, in collaboration with FT Longitude, found that respondents estimated spending an average $4.8 million per company annually correcting inaccurate or misleading content. They also estimated that poor, unclear or outdated content affected close to 5.9% of annual revenue, averaging $658.6 million per company in the sample. [3, p. 5]

The survey ran from 16 May to 8 June 2026, months before the PHP withdrawals. The 550 respondents were senior leaders at organisations with at least $1 billion in annual global revenue and at least 1,000 employees globally. [3, p. 24] Revenue affected does not mean that the entire amount was lost. Combining survey responses with external company data, the report modelled an annual content-debt burden of $4.63 trillion across a base of 6,138 companies in five markets. [3, pp. 5–6]

More than 6 / 10 respondents said they lacked clear visibility of all their published content. [3, p. 13] An inventory must cover old campaigns, regional pages, PDFs and material in legacy systems, recording where content sits, who owns it and when it was last reviewed. The report identifies outdated claims, duplicated answers and inconsistent product information among the risks to look for. [3, pp. 14–15]

Just over nine months ago, we started showing how AI could be used, or had already been used, to identify orphaned websites and their vulnerabilities. The ability to look for these exposures predates the present publicity.

Technology investment must support that discovery and assessment across the organisation’s websites and content, including material outside the systems its digital teams already manage. The report recommends directing spending towards content issues that create the greatest hidden risk. [3, p. 7]

A sizeable budget must also provide the people and time to act on the findings, whether that involves fixing vulnerabilities, correcting information or taking redundant sites down. The report treats the audit as a business exercise in deciding what the organisation still stands behind. Business, legal and technical teams have a role in determining which information is still necessary, accurate and suitable for use. The review also needs to consider whether the structure allows reuse across channels and markets. Some material will need correction or consolidation; other material will need archiving or removal. [3, pp. 14–15]

Executives must give digital leaders the mandate and authority to carry that work through across the organisation. This includes the power to require remediation and authorise the retirement of redundant websites, with responsibility for retained material clearly assigned. The report describes how language models can surface material that organisations had previously kept out of sight by removing it from navigation or search. Customers can consequently receive inaccurate or inconsistent information about a company and its products. [3, p. 11]

In the report, Rachael Donnelly, chief marketing officer at Experian Financial and Marketing Services, describes checking major language models to see what customers encounter. She recounts finding inaccurate information based on old content that should have been updated or deleted. Donnelly also describes AI as an opportunity to find and correct those outdated content sources. [3, p. 13]

In my earlier article, I described an anonymised case in which the technical structure of PDFs did not reflect the intended sequence of instructions for servicing heavy industrial machinery. The documents were being used within an agentic system supporting engineers. Critical isolation information was not presented at the right point in servicing. The risk was present in the source material before the AI system used it. [4]

The report also found that 67% of respondents believed poor content quality or structure reduced their visibility in search and AI-driven discovery. [3, p. 11]

Continuing maintenance must be funded alongside the initial clean-up. The report says organisations assessing content management systems should check for ownership, review dates, approvals and version control, and stresses the need for governance and review cycles. [3, p. 23] The NCSC also advises continued monitoring of suppliers’ security updates. [2] Executives must assign responsibility for this continuing work through the corporate mandate and provide sizeable budgets to sustain it after the emergency patching has ended.

TEN QUESTIONS AND ANSWERS

1. Why should executives respond beyond the emergency patching? Patching addresses the identified vulnerabilities in the affected software. [2] The wider work is to establish which websites and information the organisation still has, what it needs to retain and who must maintain it. Digital leaders need funding and authority to carry out those decisions.

2. What must an executive mandate allow digital leaders to do? It must give digital leaders authority to require remediation and retire redundant websites across the organisation. The mandate must also establish responsibility for the sites and information retained, with the relevant business and technical teams involved in decisions about their future.
3. What company-level financial evidence can digital leaders use? Respondents estimated average annual corrective spending of $4.8 million per company. They also estimated that poor, unclear or outdated content affected close to 5.9% of annual revenue, averaging $658.6 million per company in the sample. These findings came from senior leaders at organisations with at least $1 billion in annual global revenue and at least 1,000 employees globally. [3, pp. 5–6, 24]
4. Does the $658.6 million figure represent revenue definitely lost? No, it represents revenue respondents believed was negatively affected. The research does not establish how much of that revenue was lost or how much could be recovered. The separate $4.8 million figure concerns estimated annual spending on correcting inaccurate or misleading content. [3, pp. 5–6]
5. What is included in the $4.63 trillion estimate? To estimate annual content debt, the model combines a revenue-impact estimate derived from the survey with external listed-company revenue data and estimated corrective spending. Its base case covers 6,138 companies across five markets: 4,852 listed companies with annual revenue of at least $1 billion and 1,286 private unicorns valued at least $1 billion. [3, pp. 5–6]
6. What should a sizeable digital budget actually cover? The budget needs to pay for technology that supports discovery and assessment, the people who review the findings, and the work needed to correct, consolidate or retire material. Continuing maintenance must also be funded so that retained websites and content have ongoing support.
7. How should the organisation decide which content to keep? Review whether the organisation still stands behind the information, whether it is accurate and current, and whether its structure allows reuse. Business, legal and technical teams should contribute to decisions about retaining, correcting or withdrawing content. [3, pp. 14–15]
8. Why do PDFs need attention when preparing information for AI? The anonymised machinery case in my earlier article involved PDFs whose technical structure did not reflect the intended servicing sequence. The documents were being used within an agentic system, and critical isolation information was not presented at the right point. Reviewing structure is therefore part of preparing the source information for use. [4]
9. Is using AI to identify orphaned websites a new development? No, just over nine months ago we started showing how AI could be used, or had already been used, to identify orphaned websites and their vulnerabilities.
10. What must remain in place after the initial clean-up? Retained websites and content need assigned responsibility, continuing review and funded maintenance.

The report identifies ownership and review cycles as necessary alongside content management technology. [3, p. 23] Organisations should also follow suppliers’ security updates, as the NCSC advises, so the work continues beyond the immediate PHP response. [2]

REFERENCES

1. Reuters, “Governments, companies take websites offline over PHP flaws”, 21 October 2026. https://www.reuters.com/technology/websites-taken-offline-over-php-risks-2026-10-21/
2. National Cyber Security Centre, “Critical security issue affecting PHP”, 21 October 2026. https://www.ncsc.gov.uk/news/critical-security-issue-affecting-php
3. Storyblok, in collaboration with FT Longitude, “Content Debt: A $4.63 Trillion Business Liability” https://www.storyblok.com/lp/ft-longitude-content-debt-report; survey conducted 16 May–8 June 2026. Financial estimates and model: pp. 5–6; targeted spending: p. 7; search and AI-driven discovery: p. 11; content visibility and Experian account: p. 13; audit and business decisions: pp. 14–15; governance and review: p. 23; survey methodology: p. 24.
4. Lawrence Shaw, “The human life risk organisations are already creating with AI”, LinkedIn, 10 September 2026. https://www.linkedin.com/pulse/human-life-risk-organisations-already-creating-ai-lawrence-shaw--j83ee/