By the RaiseThon Staff

Today, Websites Everywhere Are Under Attack

On October 21, 2026, as we were finishing this article, a serious security crisis hit websites around the world. It’s one of the most alarming warnings the internet has had in years, and every mosad with a website should be concerned.

Here’s what happened. Security experts found two hidden weaknesses in PHP, one of the most common building blocks of the web. PHP is the programming language behind a huge share of websites, online stores and donation pages. The flaws had sat there, unnoticed, for about 20 years. Websites everywhere scrambled to install an emergency fix.

What it meant: a stranger with no password and no account could take over the computer running a website. Not just peek at it. Take it over, with everything stored inside.

It didn’t matter how carefully the site was built. Even sites with clean, secure code were exposed. The crack wasn’t in the house. It was in the foundation underneath it.

Then it got worse. Attackers started trying to break in before the emergency repair came out. Government websites across Europe went offline as a precaution. In the Netherlands, the national ID login, the parliament’s website and even the national cybersecurity center’s own site went dark.

And AI was part of the story. The experts who uncovered the flaws used AI tools to do it. The hackers have those same tools.

Small sites are the most exposed. News reports singled out sites run by people or organizations with limited tech resources, often on cheap shared hosting where nobody controls the servers. That’s exactly how most homemade donation sites are run.

What this means for your mosad

– What is your site built on? Most people who build with AI have no idea.
– Who fixed it today? The repair came out, but it only protects sites where someone actually installs it. A site on outdated technology, or one nobody is watching, may still be wide open.
– Would you know if someone got in? A hacked site looks exactly like a safe one, until your donors start getting calls from scammers who know their names.

At RaiseThon, the platform behind more than 1,000,000 donors, over $1 billion raised and thousands of organizations, our team was on it the same day. With a homemade site, nobody’s watching. You find out when your donors do.

And that’s just one day’s news. Here’s what else we hear from mosdos.

The Phone Call

The call came in late. The voice was shaking: “Our processor froze everything. The donations came in, but we can’t touch a dollar.”

The mosad had built its own donation site with AI. It looked professional, the donations came in, and they were proud of the fees they saved.

Then the processor froze the funds. The site broke processor rules nobody on their team knew existed, and the AI never warned them.

That money is still in limbo. Salaries, bills and programs are waiting. All to save a few thousand dollars.

Let’s Be Honest

AI isn’t a fad. It’s extraordinary, and it improves every day. Describe a donation page and it appears in minutes: polished design, working checkout, no fees, no contracts. For a mosad watching every dollar, that’s tempting.

So why use a platform at all?

Because a fundraising campaign isn’t a website. It’s a moment of trust. That trust is tested on campaign night when thousands of donors pour in, at 2 AM by a hacker you’ll never meet, and the day a scammer gets your donor list.

A Pretty Page Isn’t a Campaign

The part of a campaign everyone sees is the front end: the page, the photos, the thermometer climbing. AI can make that part look glamorous in minutes.

But the front end isn’t what makes a campaign work. The backend does. It’s the foundation underneath that processes every card, stores every donor, sends every receipt, counts every dollar and keeps the hackers out.

That’s where homemade sites fall apart. The page looks great, until something breaks underneath. Then you’re stuck, because you have no clue what was actually built.

It’s not about the front end. It’s about a robust backend that works: built over years, tested on real campaigns with real donors, and still tested day in and day out.

Your Donor List Is a Treasure Map

Your site holds the names, addresses, phones, emails and giving history of the most generous people in our community. To a scammer, that’s a treasure map.

When it leaks, donors get calls: “This is the mosad. There’s an emergency.” The caller knows their name and last year’s gift. Your donors get robbed, and your name is on it.

Nobody remembers the AI tool. They remember you. Twenty years of trust can disappear in a week.

AI Writes Code You Think Works

AI code looks like it works. You test it and launch. Then a snag comes up: one bug, buried in thousands of lines, takes the whole site down. And you have no idea where to look, because nobody on your team understands the code. Nobody wrote it, and nobody ever read it.

Even on days it runs, it often isn’t safe. AI-built apps are known to leak data, leave databases open and leave passwords in plain sight. You won’t see it, but hackers will. Automated programs scan thousands of sites an hour for easy targets, and being small makes you an easier one.

Card thieves love unprotected donation forms for testing stolen cards. You wake up to hundreds of tiny “donations,” then chargebacks, fees and a frozen account.

Every Change Can Break Something Else

Not every danger comes from outside. Some of it comes from the building itself.

A homemade site is never really finished. You go back to the AI to add a feature, change a color or fix a bug, and each time it rewrites code. It doesn’t remember why the old code was there, and it doesn’t check what else depended on it.

Add a matching feature, and receipts quietly stop sending. Fix the mobile layout, and the donate button stops working on iPhones. Update the donor form, and monthly donations stop charging.

And you’ll never know it broke. Nobody tests everything every time. You check the one thing you asked for, it works, and you move on. You don’t retest every page, every card type, every receipt and every recurring gift after each change. So the break sits there unnoticed, until donors call or the money doesn’t come in.

And when you do catch it? You ask the AI to fix it. It fixes it, and you discover three more things broke. You ask it to fix those, and something else goes. Each round of fixes creates new problems, and you’re stuck chasing the AI in circles, usually with campaign day getting closer.

Professional teams guard against this. Every change is tested against everything that already works, and nothing goes live until it passes. With a homemade site, every improvement is a gamble, and the more you build, the more fragile it gets.

And it always seems to happen at the worst time: the night before the campaign, someone asks the AI for “one small change.”

The Rules Change Every Month

Card security standards, processor rules, data-breach laws and fraud patterns never sit still. Mass texting needs registration and opt-outs. Get it wrong, and carriers block your campaign-night blast, and texting laws allow lawsuits for every message.

A homemade site learns new rules the hard way: a frozen account, a fine, a breach letter to every donor, or a lawsuit. That can cost far more than one campaign.

It Looks Like It Works. That’s the Problem.

Often AI code simply doesn’t work. When it seems to, that’s worse. It passes every test, but ten office donations aren’t campaign night.

Picture the final hour of your match. Donations pour in, ten in the same second. Nobody knew that when two donors give at once, the site counts one twice and skips another. The thermometer says $480,000. The real number is $410,000. Your matcher celebrates a goal you didn’t hit, receipts are wrong or missing, and by morning your matcher, donors and processor all want answers.

Who do you call? The freelancer moved on. The volunteer is at a wedding. The AI doesn’t answer the phone. Ask it to fix the bug, and it fixes one thing and breaks two.

It’s a beautiful house with no blueprint. Everything works until a pipe bursts in the wall, and the plumber says, “I have no idea how this was built.”

When It Has to Connect to Everything Else

Your site must talk to your processor, CRM, email, texting, accounting and receipts. Each connection runs through an API with its own rules, keys and limits, and they keep changing. AI guesses, and it often guesses wrong: an outdated version, a skipped step, a hidden mistake that surfaces weeks later.

Donations stop syncing. Receipts don’t match. Payments get declined. “Please give” emails go to donors who already gave.

And there’s no one to talk to. The processor says it’s your end. The CRM says the same. Everyone points at code nobody understands.

We Use AI, Too. Here’s the Difference.

We build AI into our systems every day. The difference is who’s holding it. Our developers review the code AI helps write, and outside experts review it too. We track new processor policies, threats, regulations and every change in AI itself.

In expert hands, AI is a powerful tool. In anyone else’s, it’s a risk that doesn’t look like one.

Would You Board That Plane?

One pilot just finished flight school. The other has thousands of hours and can land on the Hudson when both engines fail. AI is the new pilot. On your biggest day, who’s in the cockpit?

Your donors deserve an experienced crew. Don’t risk them, or your chance to reach every one of them, on something you don’t understand, or only think you understand.

You may be sure you know what your mosad needs. But a great platform isn’t built from one mosad’s guess. It’s built by working through these exact problems with thousands of institutions, one campaign at a time. That’s the only way a product becomes stellar.

“But We’re Saving on Fees.” Are You?

A DIY site is held together by paid services, each with its own bill:

– Email: Mailchimp or Constant Contact, every month
– Texting: a separate SMS service, per message
– Donor management: a CRM, or a messy spreadsheet
– Design: a designer or a design subscription
– Hosting and security: keeping it online, patched and safe
– A developer for when it breaks, at the worst possible time

None of them talk to each other. The donor who gave $1,000 an hour ago gets another “please give” email tonight. You pay for five systems and get the results of none.

A Fundraising Company That Builds Its Own Technology

RaiseThon is a team that lives and breathes fundraising. Donor engagement keeps changing. What worked three years ago, for a yeshiva or a chesed organization, on Tuesday morning or in the final hour, isn’t the same.

With over 1,000,000 donors and $1 billion raised, we’ve learned which amounts lift the average gift, which words make donors hesitate, what turns $180 into $1,800, and what brings back a donor who stopped mid-checkout. It’s all built in, and we improve it every day.

One system, built to work together:

– Donor CRM: who lapsed, who’s returning, who to call, with a list for every team member
– Email system: built for fundraising, with real reporting; skips donors who already gave
– Texting system: your own registered number, two-way inbox, automatic opt-outs, spam check
– Milestone automation: emails and texts go out when the match unlocks or a goal is hit
– AI graphics: your photos turned into ready-to-post graphics in every size
– Every campaign style: auctions, Torah dedications, events, matching and more
– Donor app: because donors give from their phones
– Fraud protection: stops card thieves before they freeze your account
– Your funds, your processor: built the way processors require; we never hold your funds
– Your donors, your data: your donor list belongs to you, and you can export it anytime
– Live campaign-night team: at 11 PM, we pick up

Thousands of Organizations Behind You

Build your own, and you get only what you thought to ask for. Join RaiseThon, and you get every feature thousands of organizations asked for: a yeshiva’s auction, a shul’s Torah dedications, a school’s event tickets, a Shliach’s list of donors who haven’t come back. Each one is proven with real donors and real dollars.

A homemade site only knows what one person asked an AI one afternoon.

“But I Only Built What I Need”

How do you know what you need? When your best donor finally reaches your page, the right ask, timing, options and a safe checkout decide the gift. Miss one, and they give less. You’ll never know, because money you didn’t raise never shows up on a report.

You can’t build what you don’t know you’re missing.

The Biggest Backfire a Mosad Can Face

This risk doesn’t just gamble one campaign. You lose the features we develop every day to help each donor give their fullest, and you put every donor’s personal information on the line.

Saving on fees can become the biggest backfire a mosad ever faces: less money raised, a donor list in the wrong hands, and a name built over decades, damaged overnight.

The Real Math

Maybe you save a few thousand dollars in fees. Now weigh that against:

– The email, texting, design and hosting bills you still pay
– One frozen account
– One data breach
– One security hole nobody patched
– One “small change” that quietly broke your checkout
– One texting violation
– One crash in the final hour
– One major donor who gave less
– Every feature you didn’t know you needed

Those savings can cost you many times over, along with your donors’ trust.

Building your own platform is like building your own safe to save on bank fees. The lock clicks shut, but you’ve never met a burglar. Burglars have met plenty of homemade safes.

5 Questions to Ask Whoever Built Your Site

If you already have a homemade donation site, ask these today. If nobody has a clear answer, that is your answer.

1. Did anyone install today’s PHP security fix? Who is responsible for the next one?
2. Where is our donor data stored, and who can access it? Is it encrypted? Is it backed up?
3. Does the site follow our processor’s rules? Has anyone checked the card security requirements?
4. What stops card thieves from testing stolen cards on our form?
5. Who answers the phone at 11 PM on campaign night if donations stop going through?

The Bottom Line

AI is here to stay, and we use it every day. But your campaign isn’t the place to experiment. This week proved it: sites with a real team were fixed the same day, while homemade sites could only hope someone noticed.

Is it worth risking my donors, my reputation and my campaign to save a few dollars?

Your mission is Yiddishkeit, chinuch and chesed. Let the people who build fundraising technology every day protect it.

Talk to Us Before Your Next Campaign

Not sure your site is safe? Our team will walk through those five questions with you, at no cost. Ready to switch? We’ll set up your campaign and bring your donor list over for you.

raisethon.com
RaiseThon is a fundraising platform that has served more than a million donors and helped mosdos raise over $1 billion.

Sources on the October 21, 2026 PHP security crisis: CNBC, “Government websites in Europe and elsewhere go dark as software flaw sparks security scramble”; NL Times, “Dutch parliament website taken offline as cybersecurity warning triggers precautions”; The Jerusalem Post; The Korea Times.