PHP2Shell and Why We Build Business Websites With Next.js

Your website can look completely normal while the software underneath it needs an emergency security update.

On October 21, PHP released emergency fixes for two critical vulnerabilities that can allow attackers to run code on vulnerable web servers without logging in. For a business that depends on its website for inquiries, bookings, or sales, that deserves immediate attention. PHP's security advisory explains the affected systems and required updates.

The scale is what makes this story hard to ignore. As of October 22, W3Techs reports that PHP runs on 69.3% of websites whose server-side programming language it can identify. That's roughly seven out of ten in that measured group. It is a measure of how widely PHP is used, not a count of hacked websites.

At Final Orbit, we build most custom websites on Next.js. It lets us leave PHP out of the application when the project doesn't need it, which avoids this particular set of vulnerabilities. That choice also comes with its own maintenance responsibilities.

What happened with PHP2Shell

PHP is a programming language used by applications such as WordPress and Magento. The server runs the PHP code that helps deliver the website.

PHP2Shell refers to two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, involving the way PHP handles memory. Successful exploitation can let an attacker run malicious code, expose information, or disrupt a service. The flaws are in PHP itself, so they can affect different applications built on it. Cloudflare's explanation describes both the issue and its potential impact.

Attackers have already been trying to use them. Amazon's security team traced an exploitation attempt back to October 17, four days before public disclosure. AWS could not confirm whether those early attempts would have succeeded against live sites. After public disclosure, the company reported broad exploitation. AWS published its findings on October 21.

For business owners, the practical concern is whether the software serving your website has received the fix. A working homepage cannot answer that question.

PHP2Shell requires a server update

A traditional WordPress website has several layers: WordPress itself, its theme and plugins, and the server software that runs them.

PHP2Shell affects that underlying PHP software. Updating a contact form plugin or installing the latest WordPress release does not, by itself, update the server's PHP installation. Cloudflare explicitly calls out this distinction and tells customers whose hosts manage PHP to have the provider apply the security update.

This is the question to send your host:

Ask for confirmation that the update is active. A hosting plan with “security included” is a service description; you need to know whether this particular job is done.

Why we use Next.js for custom websites

Most of our custom website builds use Next.js, with Sanity for content management and Vercel for deployment.

That setup lets us build a website without a traditional WordPress installation or a PHP application server. A business can still edit its services, publish articles, update its team, and manage its content. The publishing workflow does not require WordPress underneath it.

The security benefit is straightforward: a website deployment that does not execute PHP has no PHP runtime for PHP2Shell to exploit. A site without WordPress also leaves out WordPress's theme and plugin code. Next.js can run on Node.js or as a static export, so PHP is not a requirement.

We also get to decide how the site's features are implemented. A service business might need location pages, project galleries, a quote form, and a connection to its CRM. We can build around those requirements without adopting a WordPress theme and its collection of plugins.

That still involves third-party software. Next.js applications have packages and integrations of their own. Every library, CMS, and integration still needs an owner and an update plan.

Next.js security still needs an owner

Next.js needs security updates too. On October 14, its maintainers released fixes that included two critical remote code execution issues affecting particular features and configurations. That was one week before the PHP emergency. The official Next.js security update describes the affected functionality and patched releases.

Our reason for choosing Next.js is the control it gives us over how a custom site is built. Avoiding PHP removes this particular dependency and its vulnerabilities from a PHP-free application. It does not remove the work of maintaining the application we chose instead.

Before commissioning a website, ask who handles security advisories, who applies dependency updates, and who checks that the deployed site is actually running the fixed version. Those answers should be clear before launch. They matter just as much when an existing team takes over maintenance.

Website security affects SEO and the next customer who clicks

A compromise can damage the work that brought people to your website in the first place.

Google describes hacked sites containing injected spam pages, hidden links, malicious code, and redirects that send visitors elsewhere. It specifically warns that newly injected pages can hurt search performance even when the original pages show no obvious signs of a problem. Some malicious redirects appear only when a visitor arrives from search. Google documents these behaviors in its search spam policies.

Imagine paying to bring a homeowner to your service page, only for that visit to end on an unrelated website. Or having a prospective customer find spam under your company's domain. The lost inquiry is one problem. Having to explain what happened to your brand is another.

That is why website maintenance belongs in the same conversation as technical SEO and lead generation. The pages need to stay available, the content needs to remain trustworthy, and the forms need to keep working.

What to do now if your website runs PHP

Get confirmation from your hosting provider or developer that the PHP fix is deployed. The October 21 releases containing the fixes were:

These are the releases identified in PHP's October 21 advisory. Some hosting vendors apply the same fixes to their own packages without using those exact version numbers. Ask the provider to verify the patch status rather than judging it from the number alone. Older unsupported installations need a supported upgrade or a confirmed vendor fix.

Include other PHP services you still operate, such as an older blog or a separate customer portal. Moving the main website does not automatically retire them.

Have the technical team review possible signs of compromise as well. AWS recommends examining server logs, unexpected process execution, and file changes, with investigation reaching back to at least October 17. Applying a patch closes a vulnerability; it does not establish that earlier activity was harmless.

Handle the immediate update before making a migration decision. A business should be able to evaluate a new website on its merits without leaving the current one exposed while it decides.

Two questions worth asking before a rebuild

Does a Next.js frontend remove the risk from a WordPress backend

A Next.js frontend can still use WordPress to manage and deliver content. In that arrangement, WordPress and PHP remain part of the system and still need maintenance. Vercel's headless WordPress guide shows exactly this architecture. Ask what runs behind the website, including services visitors never see.

Should every business move away from WordPress

A properly maintained WordPress site can still fit a business's needs. PHP2Shell calls for an immediate security response; a rebuild is a separate decision.

If the current website is difficult to maintain, depends on features nobody understands, or no longer supports how the business operates, then it is reasonable to assess alternatives. Compare the editing experience, required features, ownership, and ongoing maintenance before choosing the next platform.

Talk to us about what your website needs

Final Orbit builds custom websites for businesses in Powell, Columbus, and across the country. We choose the platform around the work the website needs to do and the people who will run it.

If you're considering a rebuild, talk to a Final Orbit partner. Bring your current website and tell us what it needs to do better. We'll discuss what a new build would need to solve.