Your website may still display products, bring in enquiries, and support sales. But when an ageing system prevents security updates, there is work to address before the next feature request.
My website rebuild service starts with both the technical problem and the business behind it: which functions need to stay, what is getting in the way, and how the replacement will be maintained. You discuss these decisions directly with me, Dicky Ibrohim, so we can define the work before agreeing on a fee.
The PHP2Shell disclosures in October 2026 make those decisions more urgent. First, assess exposure and apply the available fixes. Rebuilding becomes an option when the condition of the website calls for more substantial changes.
Nearly 70% use PHP. What does that mean for your website?
On 23 October 2026, W3Techs reported that 69.3% of websites whose server-side programming language it could identify used PHP. This measures adoption. It does not measure how many websites are vulnerable or have been hacked. W3Techs PHP usage statistics.
That widespread use means a vulnerability in PHP itself can matter to many different applications. As a business owner, you need to know whether your website runs an affected version and whether the appropriate fixes have actually been installed.
A homepage that looks normal cannot answer those questions. The software version, hosting provider's package, server configuration, and application all need to be considered.
PHP vulnerabilities known as PHP2Shell
The researchers use PHP2Shell as the name of an exploit demonstration and their research into PHP vulnerabilities. The two flaws discussed here are tracked as CVE-2026-109618 and CVE-2026-109619. The research publication credits contributions from Wiz Research, OpenAI Codex Security, and Calif. The researchers' explanation of the PHP2Shell name.
The Netherlands' National Cyber Security Centre also uses this name in its response information. This article mentions PHP2Shell to identify the security topic. The article and service offer are independent and do not represent the researchers or the PHP project. NCSC-NL PHP2Shell information.
Both vulnerabilities carry a critical CVSS 4.0 score of 9.2 out of 10. CVSS rates the severity of a vulnerability; it is not a percentage estimate of the chance that your website will be hacked.
- CVE-2026-109618 concerns the handling of an out-of-memory condition, which can leave internal data in an invalid state. Under exploitable conditions, an attacker can run code remotely without signing in. PHP advisory for CVE-2026-109618.
- CVE-2026-109619 concerns internal state from an earlier request that can still refer to freed memory. Reusing that state under certain conditions can allow remote code execution. PHP advisory for CVE-2026-109619.
Remote code execution, or RCE, lets an attacker run code on the server with the access available to the compromised process. Possible consequences include reading data that process can reach, changing website content, or disrupting the service. The actual impact depends on permissions and the surrounding system.
PHP advises urgent attention to installations serving web requests. The highest demonstrated risk is with Apache mod_php, where exploitation has been shown before application code runs. Other configurations still need assessment; the presence of PHP alone does not prove a successful attack. PHP security announcement, 21 October 2026.
PHP releases containing the fixes
Fixes for these two CVEs were released on 21 October 2026:
| PHP branch | Fix released in |
|---|---|
| PHP 8.2 | 8.2.35 |
| PHP 8.3 | 8.3.36 |
| PHP 8.4 | 8.4.27 |
| PHP 8.5 | 8.5.12 |
Linux distributions and extended-support providers may deliver fixes through their own packages. Ask your provider to confirm the installed package and its security updates, particularly when it uses a backport: a fix applied to an older software package. PHP update guidance.
A further advisory followed on 23 October 2026. PHP described an RCE path involving an uncommon combination of configuration and application code. Administrators were advised to review session upload progress settings and follow the official mitigation until the next corrective release. Read the versions above alongside the latest advisory; they are not a guarantee that every risk has been resolved. PHP advisory, 23 October 2026.
The difficulty: an older website may not be ready for an update
On some websites, upgrading PHP exposes another problem: a theme stops loading, a plugin fails, or a custom function returns an error. WordPress core supporting a PHP version does not establish that every theme, plugin, and custom addition will work with it. WordPress documentation calls for compatibility checks and backups before an upgrade. WordPress guidance on updating PHP.
This is where a more focused assessment helps. Identify what blocks the update, whether that component is still maintained, what could replace it, and how much change is involved.
Those answers let us compare targeted repairs with rebuilding the website. A visual redesign alone will not remove the technical dependency that keeps delaying updates.
Older PHP branches have support deadlines
As of 23 October 2026, PHP 8.1 and earlier versions have reached the end of official upstream support. Security support for the maintained branches is scheduled as follows:
| Branch | Security support ends |
|---|---|
| PHP 8.2 | 31 December 2026 |
| PHP 8.3 | 31 December 2027 |
| PHP 8.4 | 31 December 2028 |
| PHP 8.5 | 31 December 2029 |
Use these dates alongside application compatibility when choosing a migration target and planning its maintenance period. Official PHP support schedule.
For PHP2Shell, the PHP security team provided minimal source backports for PHP 7.4, 8.0, and 8.1. Some vendors also offer extended support. These exceptional fixes do not restore regular support for those branches. The coverage of any vendor package still needs to be confirmed. PHP explanation of support and backports.
React2Shell: newer technology also needs maintenance
A serious example affecting React and Next.js is React2Shell, CVE-2025-55182, disclosed on 3 December 2025. This React Server Components vulnerability received a CVSS score of 10.0 and allows unauthenticated remote code execution in affected applications. It is an earlier case relevant to website planning, rather than a new October 2026 disclosure. Official React announcement.
Its impact on Next.js concerns the App Router and vulnerable RSC components. The initial advisory covered particular Next.js 15 and 16 releases and experimental 14.3 canary releases. Patched applications should not be grouped with vulnerable versions. Official Next.js advisory.
React2Shell does not automatically affect every Node.js application. React also states that applications without a server, or without tooling that supports React Server Components, are not affected by this CVE.
That distinction matters when choosing a replacement technology. Check that the components can be updated and that someone will be responsible for maintaining them. For React and Next.js, follow current fixes on a supported release line, since further advisories have been published. React update guidance.
AI makes the ability to update your website more important
New Zealand's NCSC explains that threat actors increasingly use AI to discover and exploit vulnerabilities. For newly disclosed flaws, AI can shorten the interval between discovery and exploitation, leaving organisations less time to apply fixes. NCSC guidance, 18 June 2026.
For a business owner, the practical response is to improve readiness: know which components your website uses, who handles updates, and how changes will be checked before release.
AI can help with defence and development too. However, a page successfully generated with AI does not establish that its forms, permissions, data storage, and integrations work correctly.
An engineer can help turn your requirements into technical choices and functional checks within an agreed scope. AI output still needs assessment, and its access needs limits. The NCSC guidance also stresses restricted permissions and information protection when using AI with systems. NCSC guidance on using AI.
When is an update enough, and when should you rebuild?
A rebuild should follow an assessment of the website. These situations provide a starting point for that discussion:
| Website condition | Option to assess |
|---|---|
| Components remain supported and updates are compatible | Apply the updates, then check essential functions. |
| A few plugins or custom functions block the upgrade | Repair or replace the components causing the problem. |
| Many components are abandoned and updates repeatedly fail | Compare extensive repairs with a rebuild. |
| Business requirements have outgrown the original design | Replan the structure, functions, and ongoing management. |
| There are signs of intrusion or unauthorised changes | Prioritise incident response and checks of related systems. |
This is a decision guide, not a diagnosis of a particular website. If you suspect an infection, review the scope of website malware assessment and removal before planning a move.
A rebuild must not postpone action on an exposed vulnerability. While the old website continues serving visitors, its administrator still needs to apply suitable fixes or mitigations.
Rebuild around the functions your business actually needs
I offer custom website development based on the way your business works. With an existing site, we start by identifying what remains useful: page addresses, service information, product materials, forms, and connections to other systems.
For example, a service business that needs a company profile, service catalogue, and enquiry route may suit a simpler design. A shop with transactions, stock management, and customer accounts needs different functions and maintenance. Those requirements deserve separate consideration. For a business profile, the custom company profile website guide can help you define the initial pages and functions.
Priorities we can discuss in the proposal include:
- Organising information so visitors understand your services and can find the next step.
- Defining the forms, catalogue, bookings, or integrations the business needs.
- Identifying which content you can update yourself, when editing facilities are included.
- Selecting content to migrate and planning how changed page addresses will be handled.
- Agreeing on updates, functional checks, handover access, and support.
The value of custom development comes from making those choices fit your requirements. If the business adds a service or opens another branch, we can assess the necessary changes against the system's capabilities. Further development still requires its own scope, schedule, and cost assessment.
A website builder can also be suitable when its features and plan limits meet your needs. Before choosing one, check content management, integrations, renewal costs, and how you can retrieve your data when moving or if the service closes. Exporting text and images may not produce a complete website ready to run elsewhere.
The same questions apply to my service: source code is not automatically included, requires a separate offer, and may not be available. Account access, licences, handover files, and migration options need to be specified in the agreement.
If the site collects customer data or uses analytics, also determine what information is necessary, who can access it, and which third-party services are involved. A custom website still needs those dependencies to be managed.
Keep valuable content and plan the SEO migration
Your existing website may have pages that customers recognise, partners link to, or search engines display. List those pages before rebuilding so their destination is considered during the move.
When addresses change, plan a mapping from old URLs to relevant replacement pages and use appropriate permanent redirects. Internal links and sitemaps also need to reflect the new structure. Google explains that a site move can cause temporary ranking fluctuations while pages are crawled and indexed again. Google Search Central migration guidance.
Discuss the scope of SEO migration before work begins. There is no basis for promising that rankings or traffic will remain exactly the same after a rebuild.
Clear project costs and maintenance responsibilities
The cost of rebuilding depends on the existing site's condition, the types of pages, functions, content readiness, integrations, and data migration work. Timing also depends on available access and the approval process.
The proposal should distinguish project fees from recurring expenses such as the domain, hosting, licences, storage, and additional services. Maintenance and support after launch need their own agreed scope, so you know who will handle the next update.
A new website can develop vulnerabilities later. Rebuilding can replace problematic components and improve maintainability within the agreed work. Ongoing security still depends on updates, access management, and readiness to recover. It does not come with a promise of immunity from attacks or freedom from maintenance.
Vulnerability information, release versions, and support status in this article were checked on 23 October 2026.
Frequently asked questions
Does every PHP website need rebuilding because of PHP2Shell?
No. Check the PHP version and package, apply the appropriate official fixes, and assess application compatibility. A rebuild becomes an option when technical barriers or business requirements cannot reasonably be addressed through updates and targeted repairs.
Will moving straight to Next.js solve the security problem?
Changing technology does not automatically establish security. React2Shell shows that modern applications can also have serious vulnerabilities. Any technology choice needs a plan to update and maintain its components.
Does updating PHP also clean a website that has already been hacked?
An update addresses the vulnerabilities fixed by that release. After an intrusion, investigation and recovery also need to address malicious changes and potentially compromised access. The condition of the website determines what recovery work is needed.
What should I prepare for an initial discussion?
Share the website address, the problems you have noticed, the functions that must keep working, and the changes you want. Hosting or software version details can help if you have them. An initial description is enough; do not include passwords or customer data in your first message.
