On October 20 and 21, 2026 the web had a rough two days. Details of two critical remote code execution vulnerabilities in PHP, known as "PHP2Shell" (CVE-2026-109618 and CVE-2026-109619), leaked ahead of the planned disclosure. The PHP security team rated them critical and released emergency patches. Attackers did not wait: Cloudflare reported tens of thousands of exploit attempts within minutes of the news spreading. Around the world, some organizations took their sites offline as a precaution until the patch was applied.
PHP runs a very large share of the web, including a large share of corporate sites, online stores and WordPress sites. This post is not meant to cause panic. It is meant to ask: how did this crisis affect your site, and is it ready for the next one?
First step: patch now
If your site runs on PHP, the order is clear:
- Find out your PHP version: The emergency patches were released for the supported branches (8.2, 8.3, 8.4 and 8.5). If you run an older version, the patch may not cover you.
- Apply the patch: Contact your hosting company or software provider right away.
- Look for traces: Have your site checked for unknown files, new admin accounts or unexpected redirects.
For current technical details, follow PHP's official security advisories.
The real question: why are we always patching?
PHP2Shell is not a one-off. It is a symptom. A site built years ago, running on an old PHP version and full of unmaintained plugins, lives through the same risk with every new vulnerability. Many of these sites are also slow, weak on mobile and expensive to update.
A patch puts out the fire. A new platform lowers the risk of the next one.
A modern platform: Next.js
Next.js is a modern web framework used by many of the world's leading companies. Compared with legacy PHP sites, the main differences are:
- A smaller attack surface: Most pages can be served as pre-built static content, so less code has to run on the server for every visitor.
- Faster pages: Modern caching and image optimization make sites load much faster, especially on mobile.
- Easier maintenance: Updates go through a controlled software process. The era of "update the plugin and hope nothing breaks" is over.
A safe move, without losing SEO
What holds many companies back from switching platforms is the fear of losing the Google rankings they have built over years. We plan the move to manage that risk:
- Content and SEO inventory: All existing pages, the URLs that rank on Google and the incoming links are listed.
- Permanent redirects: Every changed URL is linked from its old address to the new one with a 301 redirect.
- No-downtime launch: The old site is not switched off until the new one is ready and tested.
The payoff is more than security
- A faster site: Better user experience and higher conversion.
- Safer infrastructure: Fewer components, fewer gaps, more controlled updates.
- Ready for AI search: Structured content for visibility not only on Google but also on AI search engines such as ChatGPT, Gemini and Perplexity (GEO).
Where to start
First, get a clear picture of your site today: which PHP version it runs on, which plugins it uses, which pages bring in traffic. That picture shows whether you need only a patch or a new platform. To have your site reviewed, talk to us.