# PHP2Shell: Time for a WordPress Replacement? | BrightRay > The PHP2Shell flaw puts WordPress sites at risk. Don’t reinvest in a flawed stack: get a free WordPress vulnerability scan and compare a secure replacement. Source: https://brightray.co.uk/wordpress-replacement-php2shell/ Security · 22 October 2026 # Three takeover flaws in four months. Don’t reinvest in a flawed stack. The latest is “PHP2Shell”, two critical bugs in PHP itself that let attackers take over a server without logging in. If your site runs on WordPress it is probably affected, and updating WordPress won't fix it. Before you spend another penny patching it, ask whether it's worth patching at all. Get a quote [See pricing](https://brightray.co.uk/prices/) Or call 0800 208 4430 · [WhatsApp us](https://wa.me/447977785345?text=Hi%20BrightRay%2C%20I'd%20like%20a%20quote%20for%20a%20website.) · [Book a call](https://brightray.co.uk/book-a-call/) - Free WordPress vulnerability scan: contact us now - PHP2Shell affects PHP 5.4 up to 8.5.11, whatever your WordPress version - Our sites run no PHP, no database and no public login - We move your site across and protect your Google rankings From £500 fixed Live in 7 days 20% off for charities Found on Google Key takeaways - —PHP2Shell (CVE-2026-109618 and CVE-2026-109619) lets attackers run code on unpatched PHP servers without logging in. - —A fully updated WordPress site is still exposed if the PHP underneath has not been patched. - —PHP 8.1 and older will never get a fix. The only route is PHP 8.2 or newer. - —A static site has no PHP, no database and no admin login on the live server to take over. Free WordPress vulnerability scan Not sure if you're affected by the PHP flaw? Contact us now and we'll scan your WordPress site for free. We'll tell you whether it's exposed, check it for signs of compromise, and if it needs it, back it up and move it onto a platform that doesn't run PHP, so your business stays online. Contact us now for your free scan ## What happened On 21 October 2026 the PHP project released emergency security updates for two vulnerabilities in the core PHP runtime, CVE-2026-109618 and CVE-2026-109619. Researchers have nicknamed them **“PHP2Shell”**. They were found by Wiz Research and disclosed through a coordinated process. Both bugs are about how PHP manages memory between web requests: - **CVE-2026-109618:** an out-of-memory condition can interrupt PHP while it is still setting up a request. Clean-up code can then treat that half-built data as valid. - **CVE-2026-109619:** data belonging to one request can survive after its memory has been freed. The next visitor handled by the same PHP worker can then trigger use of that stale data. Put simply, a carefully crafted request from anyone on the internet can let them run their own code on your web server. No password and no plugin bug is needed. | PHP2Shell at a glance | | Severity | Critical: CVSS 9.2 for each flaw | Impact | Unauthenticated remote code execution and leaks of server memory | Affected | PHP 5.4 up to and including 8.5.11 | Fixed in | PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 | No fix coming | PHP 8.1 and older are end-of-life. The only route is to upgrade to 8.2 or newer. | Status | Exploitation attempts reported by security vendors, who are actively hunting for intrusions ## Why WordPress sites are in the firing line WordPress is written in PHP, so every WordPress site runs on a PHP server. Because the flaw sits in PHP rather than WordPress, **a fully updated WordPress install with every plugin patched is still exposed** if the server underneath runs a vulnerable PHP version. The same goes for Drupal, Joomla, Magento, WooCommerce shops and any other PHP application. Whether you're safe depends on your host: - **Managed WordPress hosts** such as SiteGround and GoDaddy have announced that they are patching PHP on their platforms. It's worth confirming with yours that it's done. - **Cheap shared hosting, a VPS someone set up years ago, or a site “nobody looks after any more”** is the real worry. Nobody is going to patch PHP on those for you. - **Old PHP versions.** Many small-business sites still run PHP 7.x or 8.0/8.1 because a theme or plugin breaks on anything newer. Those versions won't get a fix at all. ## 2026 has been a bad year to run WordPress PHP2Shell isn't a one-off. It's the third serious WordPress security flaw to make headlines since July: - **July 2026, wp2shell.** A chain of bugs in WordPress core that allowed takeover without logging in, with one request. Emergency updates went out on 17 July. The US cybersecurity agency CISA confirmed active exploitation and added both flaws to its Known Exploited Vulnerabilities list on 21 July. Attackers installed webshells, created admin accounts and planted malicious plugins. - **September 2026, Click2Shell.** Another core flaw, fixed in WordPress 7.1.1. If a logged-in administrator clicked a crafted link, an attacker could get a theme installed, and combined with a vulnerable theme, run code on the server. - **October 2026, PHP2Shell.** Two critical flaws in PHP itself, so every WordPress site is exposed until its host patches PHP, however up to date WordPress is. Behind the headlines, the plugin ecosystem is the everyday risk. WordPress security firm Patchstack's figures for 2025: - **11,334** new WordPress vulnerabilities found in 2025 - **42% more** than in 2024 - **91%** of them were in plugins - **46%** had no fix available when they were made public A typical small-business WordPress site runs a couple of dozen plugins, so every one of them is a door that someone has to keep locked. Usually that someone is you. ## A safer WordPress alternative: how our stack is different The sites we build at BrightRay don't run PHP, and they don't have a database or admin login on the public web server. We build them with Next.js, React, TypeScript and Tailwind CSS, export every page ahead of time as plain static files, and serve them from Microsoft Azure Static Web Apps behind Azure Front Door's global network. This site runs on exactly the same stack. When a visitor loads a page, no code runs on our side to put it together, so there's nothing for a PHP2Shell-style attack to target. | | Typical WordPress site | BrightRay site | Exposed to PHP2Shell | Yes, unless the host has already patched PHP | No. There's no PHP on the server. | Code running per visit | PHP plus a MySQL database, on every page load | None. Pre-built files are served from Azure’s global network. | Things to keep patched | PHP, WordPress core, the theme, every plugin, the database and the server OS | We handle it. There's very little on the live site to patch. | Public login page | /wp-admin, a constant target for password-guessing bots | None on the live site | If something goes wrong | Clean-up, malware scans, restoring the database, and Google blacklist warnings | Redeploy a known-good version in minutes | Speed | Depends on caching plugins and hosting | Fast by default, because pages are pre-built ## Don’t reinvest in a flawed stack: choose a WordPress replacement When something like PHP2Shell hits, the natural reaction is to patch and carry on. Look at where that money actually goes: - An emergency developer to update PHP, then fix the old theme and plugins that break on PHP 8.2 - A malware clean-up, and a review request to Google if your site was flagged - Another security plugin, a firewall subscription or pricier “secure” hosting All of that buys you the same site on the same stack, waiting for the next wp2shell, Click2Shell or PHP2Shell. 2026 has shown that the next one is never far away. Spend that budget once on a WordPress replacement that doesn't have the problem, instead of paying again and again to prop up one that does. ### The hidden cost of “free” WordPress Even in a quiet year, WordPress itself is free but keeping it safe isn't. Most businesses end up paying, in money or in their own time, for: - Hosting that's fast enough and patched quickly when something like PHP2Shell lands - Premium themes and plugins, plus their yearly licence renewals - Security plugins, firewalls and backup services - Someone to apply updates every week and fix whatever an update breaks - Clean-up when it goes wrong, plus lost sales and search ranking while the site is down or flagged by Google A static site removes most of that list. There are no plugins to update and no database to back up, and nothing on the live server can be taken over. To be fair: no website is “unhackable”, and WordPress can be run securely by a team that watches it closely. But most small businesses don't have that team. A site that has no server-side code is far less work to keep safe. ## Why so many agencies sold you WordPress If you paid an agency for a “cheap and quick” website in the last ten years, there's a good chance you got WordPress. That isn't because it was the best choice for your business. It's because it was the fastest way for *them* to turn a site round: - **Buy a theme, bolt on plugins, hand it over.** A £50 theme and a stack of free plugins can look like a finished site in a few days. Every one of those plugins is someone else's code that has to be kept patched for as long as the site exists. - **Security becomes your problem after launch.** Many low-cost builds come with no plan for updates. If there's a maintenance package, it often covers WordPress and plugin updates, but not the PHP version underneath. That's exactly the gap PHP2Shell goes through. - **Old sites are left on old PHP.** A cheap theme that breaks on newer PHP is a common reason so many small-business sites are still on PHP 7 or 8.1. Those versions will never get a fix for this flaw. - **The fix is always “more WordPress”.** Another plugin, another retainer, another emergency invoice. The agency's model depends on the stack staying the same. Cheap to build, expensive to own. That's the WordPress agency model, and in 2026 the bill is arriving. ### Questions to ask your web agency today - Which PHP version is my site on, and has it been patched for CVE-2026-109618 and CVE-2026-109619? - How many plugins does my site run, and who updates them? - Who would notice if my site was hacked tonight, and how quickly? - When was my site last backed up, and where is that backup kept? - If Google flagged my site tomorrow, what would it cost me to get it cleaned up? If the answers are vague, or you can't get hold of the agency that built your site at all, contact us for a free WordPress vulnerability scan and we'll answer those questions for you. ## We build back better than you had before We don't patch up an old WordPress site and send you the invoice. We rebuild it on the same modern stack we use for our own site (Next.js, React and TypeScript on Microsoft Azure), with automated checks on every change, so you come out with a **better** website than the one you had: - **More secure:** no PHP, no database and no public login to attack. - **Faster:** pre-built pages served from Azure Front Door, with no plugin bloat slowing them down. - **Easier to find:** clean code and structured data that Google and AI assistants can read and understand. - **Watched:** monitoring and Search Console alerts set up from day one. - **Yours:** your content and code under version control, not locked inside a theme someone else controls. ## What a hacked website does to your business A compromise is rarely just a technical problem. Once attackers are in, the damage spreads well beyond the server: - **Google warns people off.** Google can label your site *“This site may be hacked”* in search results, and browsers can show a full-screen red warning before anyone reaches your homepage. The label stays until you clean the site and ask Google for a review. - **Your rankings get buried in spam.** Hackers often add thousands of hidden spam pages (pharmacy, gambling, counterfeit goods) to borrow your site's reputation. Google sees a site full of spam, and your real pages suffer. - **AI assistants repeat what they find.** ChatGPT, Perplexity, Google's AI Overviews and similar tools read the web to answer questions about you. If your site is serving injected spam or redirects, that's what they pick up, and a site Google has flagged is unlikely to be one they recommend. - **Customers are sent elsewhere.** Visitors, and the clicks you pay for in ads, get redirected to scam or malware sites. - **Your email stops arriving.** Hacked servers are used to send spam, which can get your domain blocklisted. Your invoices and quotes then land in junk folders. - **You may have a data breach to report.** If customer details were exposed, UK GDPR can require you to report it to the ICO within 72 hours. Cleaning up is the easy part. Recovering lost rankings and trust can take months. ## How we protect your Google and AI rankings Avoiding that damage isn't about one security plugin. It comes down to the right processes and the right stack, which we set up for every client: - **Nothing to hijack.** The sites we build are static, so the live site has no PHP, no database and no admin login for attackers to take over and fill with spam. - **Every change is tracked and tested.** Your site lives in version control on GitHub. Every change is recorded, and automated checks (code quality, a full build, performance and security headers) run before anything goes live. Any change can be rolled back in minutes, so nothing appears on your site without someone knowing. - **Locked down by default.** Strict security headers, including a Content Security Policy, tell browsers to refuse scripts and content we didn't put there. - **We watch it for you.** We set up uptime monitoring, Google Search Console and Bing Webmaster Tools, so we hear about security warnings and indexing problems before your customers do. - **Built to be found on Google and in AI answers.** Fast pages, clear factual answers and structured data (schema.org) generated from the same content as the page, so it always matches what visitors see. That's what Google's AI Overviews, ChatGPT and Copilot read when they describe your business. - **Consistent everywhere.** We make sure your name, address and phone number match across your site, Google Business Profile and directories. That consistency is one of the strongest signals for AI answers. ChatGPT's search leans on Bing, which is why we set that up too. - **No shortcuts that backfire.** We don't churn out near-identical pages for every town or stuff in thin content. Google treats both as spam, and we've removed exactly that kind of page from our own site. - **Backups that live elsewhere.** A complete copy of your site sits off the live server, ready to redeploy. ## Looking for a WordPress replacement? Here's how the move works Moving away from WordPress doesn't mean starting again. Our [WordPress conversion service](https://brightray.co.uk/wordpress-conversion/) keeps what's working and leaves the risk behind: - **Back up everything.** We take a full copy of your WordPress files and database first, so nothing is lost. - **Convert your content.** Pages, blog posts, images and your design move across to our static stack. - **Protect your rankings.** We keep your domain and redirect any page addresses that change, so Google, AI search tools and your visitors find the new pages. - **Switch over.** Your new site goes live and the old WordPress install, along with its PHP, is retired. ## Check your WordPress site right now - **Find your PHP version.** In your WordPress dashboard go to *Tools → Site Health → Info → Server*. Anything below 8.2.35, 8.3.36, 8.4.27 or 8.5.12 (for its version line) is vulnerable. - **Ask your host.** Ask whether PHP has been patched for CVE-2026-109618 and CVE-2026-109619, and get a yes or no in writing. - **Look for warning signs.** Watch for new admin users you don't recognise, unfamiliar plugins, odd files in wp-content, redirects to spam sites, or warnings from Google or your browser. - **Take a backup now.** Back up both the files and the database, and store the copy somewhere other than the server. If you're unsure how, that's one of the things we'll do for you. ## Don't patch it. Build back better. Start with a free scan. If you're not sure whether the PHP flaw affects you, we'll check for free. Your free WordPress vulnerability scan covers: - Your PHP version and whether your host has patched it for PHP2Shell - Signs of compromise, such as unknown admin users, injected spam pages and suspicious redirects - Google security warnings and how your site appears in search - How AI assistants currently describe your business We'll give you a plain-English report with no obligation, so you know the facts before you reinvest in anything. If your site *is* affected, we will: - **Back up your site immediately**, including content, images and the database, so nothing is lost. - **Check it for signs of compromise** and tell you plainly what we find. - **Rebuild it better on our static stack**, keeping your content, design and web address. - **Get your business back up and running** quickly, on a site with no PHP to attack, so your money goes into a better platform rather than the old one. Free WordPress vulnerability scan Get your free WordPress vulnerability scan Send us your website address and we'll check it for PHP2Shell and signs of compromise. Plain English, no obligation. Contact us now for your free scan ## Sources - Google Cloud: [Responding to core PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619](https://cloud.google.com/blog/products/identity-security/responding-to-core-php-vulnerabilities-cve-2026-109618-cve-2026-109619) - PHP security advisories: [GHSA-w8hw-w9fx-j79w](https://github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w) and [GHSA-6wmf-4rv5-p3rp](https://github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp) - SiteGround: [Critical PHP vulnerabilities, October 2026](https://www.siteground.com/blog/critical-php-vulnerabilities-october-2026) - GoDaddy: [Important PHP security update](https://www.godaddy.com/resources/news/important-php-security-update-what-website-owners-need-to-do) - Patchstack: [Major security alert: PHP vulnerable to critical RCE](https://patchstack.com/articles/php-major-vulnerability-alert-10-2026/) - Patchstack: [State of WordPress Security in 2026](https://www.patchstack.com/whitepaper/state-of-wordpress-security-in-2026/) - Google Search Help: [“This site may be hacked” message](https://support.google.com/websearch/answer/190597) - Google Search Console Help: [Security issues report](https://support.google.com/webmasters/answer/9044101) - Dark Reading: [“WP2Shell” opens millions of WordPress sites to remote takeover](https://www.darkreading.com/cyberattacks-data-breaches/wp2shell-millions-wordpress-sites-remote-takeover) - INCIBE-CERT: [Chain of critical vulnerabilities in WordPress, wp2shell](https://www.incibe.es/index.php/en/incibe-cert/publications/cybersecurity-highlights/chain-critical-vulnerabilities-wordpress-wp2shell) - BleepingComputer: [WordPress Click2Shell flaw lets hackers execute PHP on the server](https://bleepingcomputer.com/news/security/wordpress-click2shell-flaw-lets-hackers-execute-php-on-the-server) [Message us on WhatsApp](https://wa.me/447977785345) [Or use our contact form](https://brightray.co.uk/#contact) What we do ## Websites and an AI voice assistant for small businesses. A website that brings in enquiries, set up for Google and AI search, plus an AI voice assistant (AI receptionist and smart voicemail) that answers the calls you miss. [WebsitesA website that wins you work →Designed and built for you, mobile-first, set up for Google and AI search. Live in as little as 7 days.](https://brightray.co.uk/websites/) [AI receptionistEvery call answered, 24/7 →A natural, clear voice answers your calls, takes the details and emails you a summary, recording and transcript.](https://brightray.co.uk/ai-receptionist/) [AI voicemailNo more lost voicemails →Only answers the calls you miss. Callers talk to an assistant instead of a beep, and you get their details straight away.](https://brightray.co.uk/ai-voicemail/) Website + AI voice assistant Your website brings in the calls and the AI voice assistant answers them, 24/7. We set up both for you. Ring 0141 461 4870 to talk to our AI receptionist. It’ll take your details and we’ll call you back. [Book a call about both](https://brightray.co.uk/book-a-call/?topic=receptionist) [How it works](https://brightray.co.uk/websites/#bundle) Questions ## Asked and answered. What is the best WordPress replacement for a small business?+ For most brochure sites, portfolios and blogs, a static site is the safest WordPress replacement. Pages are built in advance and served from a CDN, so there is no PHP, no database and no admin login on the live server for attackers to take over. Is my WordPress site affected by the PHP2Shell flaw?+ If your server runs PHP 5.4 up to 8.5.11 and your host hasn't applied the October 2026 fixes (PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35), it is exposed, even if WordPress and every plugin are up to date. Contact us for a free WordPress vulnerability scan and we'll check for you. Will I lose my Google rankings if I move away from WordPress?+ Not if the move is done properly. We keep your content and web address, and redirect any page addresses that change, so search engines and visitors find the new pages. Can you move my existing WordPress site rather than starting again?+ Yes. We back up your WordPress site, then convert its pages, images, blog posts and design to our static stack, so you don't start from scratch. Get in touch ## Let’s build yours. Tell us what you do and what you need — two sentences will do. You’ll get a reply within one working day with a fixed price and a start date. No obligation. Or call 0800 208 4430 [Book a call with us](https://brightray.co.uk/book-a-call/) [Request a callback](https://brightray.co.uk/book-a-call/#callback) Prefer to give us the full picture? [Start a detailed project brief](https://brightray.co.uk/brief/) — pick your business type, content and exact brand colours.