Patch PHP tonight. Then leave the PHP treadmill for good.

TL;DR: Two critical PHP flaws, nicknamed PHP2Shell (CVE-2026-109618 and CVE-2026-109619), let attackers run code on PHP servers without logging in. The fix is to update PHP now: php.net advisory. Your host or system administrator installs that update. We do not patch PHP. When you're ready, we'll move your Drupal or WordPress site to Next.js + Supabase on Netlify, so you no longer run a PHP server you have to patch.

Drupal or WordPress

Both run on PHP, so the free PHP version check applies to either host. Pick the migration that matches the site:

• Drupal to Next.js migration for Drupal 7, 8, 9, 10, and 11.
• WordPress to Next.js migration for posts, custom post types, ACF, and SEO fields. The WordPress to Next.js guide lists what moves.
• Migration pricing is the same three tiers. Page count is not a price.

What happened this week

• On October 21, 2026, PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two unauthenticated remote-code-execution bugs rated CVSS 9.2 (php.net).
• CISA urged organizations to patch immediately (CISA). ENISA and EU partners issued a joint statement (ENISA). Drupal's security team told site owners to update PHP (PSA-2026-10-20).
• Amazon reports PHP2Shell "is now being broadly exploited in the wild" (AWS Security Blog).
• Updating Drupal doesn't fix it. The bug is in PHP itself (Drupal.org, Tag1).

Read the full PHP2Shell guide →

Step 1: Patch now, through your host

Your host or system administrator updates PHP. We do not log into your server and we do not patch PHP.

• Free version check

  paste your PHP version. It runs in your browser and sends no exploit traffic.

• Patch guide

  the steps PHP, CISA, and Tag1 published, for the person who administers the server.

• Site already down? Emergency overnight migration is $4,999 for a rebuild on a modern stack (pricing). That is a migration, not a PHP patch. Heavy custom work, e-commerce, or several integrations start with the $499 audit instead.

Step 2: Decide whether you need a PHP server at all

Patching closes this hole. It doesn't change the calendar:

Every major Drupal version means another upgrade project, and every PHP CVE means another patch night. We move sites to a stack with no PHP server for you to run:

• Next.js 16 + React + TypeScript, styled with Tailwind CSS and shadcn/ui, with custom React graphics where your brand needs them.
• Supabase: Postgres, member logins, file storage, and row-level security, so the database itself decides who can see which records (Supabase docs).
• Netlify builds and deploys from your GitHub repo every time main changes (Netlify).

Straight talk: no stack is immune. React and Next.js had their own critical RCE in December 2025 (React, Next.js). The difference is what *you* maintain. Fixes here are dependency updates that redeploy from GitHub, not patching a long-running PHP server. See the honest comparison → Benefits of migrating Drupal to Next.js → How AI is used in the move →

Site down? Emergency overnight migration · Start a migration from $999

How a migration works

1. Audit: content types, fields, views, users, modules, every URL.
2. Model: Drupal content moves into Postgres tables. Drupal roles and permissions become row-level security policies.
3. Build: Next.js front end, server-rendered for speed and SEO.
4. Preserve SEO: a 301 redirect for every old URL, plus a fresh sitemap.
5. Launch: DNS cutover, monitoring, handover to your team.

Service details →

AI-improved migration

We don't only port the site. During the move we use current AI tools to make the site clearer and easier to maintain, and a person reviews every change. Nothing here is a guaranteed ranking, citation, accessibility certificate, or speed score.

• Content audit. Dead pages, duplicates, and outdated copy get a suggested list. A person decides what stays.
• Clearer copy. Rewrites aim at plain language and answer-first pages, for readers and for search and AI-search. Rankings are not promised.
• Structured data, alt text, and links. JSON-LD, missing alt text, and a proposed information architecture with internal links. A person checks them before launch.
• Reviewed delivery. AI-assisted coding, automated tests, and visual regression. Faster on some tasks. A day-count for your project is not published here.
• Optional features, quoted separately. Site search or a Q&A assistant over your content, smart forms, and personalization. Not included in the $999 floor. Pricing.

Read how the AI pass works →

Who's behind this

DrupalMigration.ai is a service of The Gants Group. Shawn Gants is the founder. The team is all US-based. The team behind DrupalMigration.ai →

FAQ

Is my Drupal site affected by PHP2Shell?

If the PHP version serving it is older than 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and your host hasn't installed a patched package, assume yes. Your Drupal version doesn't matter (php.net, PSA-2026-10-20).

Do I have to migrate to be safe?

No. Updating PHP is the fix for PHP2Shell. Migration is a long-term choice to stop running a PHP server and stop paying for Drupal major-version upgrades.

Do you only work with Spokane clients?

No. We work remotely with clients anywhere. We're based in the Spokane, WA area.

What does a migration cost?

Standard starts at $999 and rises with custom functionality, member logins, and integrations. Page count is not a price. A site that is down, and is not a complex rebuild, is a $4,999 overnight migration. Complex work starts with a $499 audit, credited toward the project. Optional AI features for the new site are quoted and have no published price. See pricing.

Do you migrate WordPress, or only Drupal?

Both. WordPress and Drupal use the same tiers. WooCommerce is the complex audit, not the $999 floor. Start at the WordPress migration service or the Drupal migration service.