PHP2Shell CVE-2026-109618 / 109619 · WordPress and Drupal hosts should update PHP now.

Patch guide for your host
DrupalMigration.aiPatch tonight. Migrate to modern, AI-improved.

Patch tonight. Migrate to modern, AI-improved.

TP2X: how we moved our own site off Drupal

Last updated: 2026-10-23 · Shawn Gants

Before

Drupal on a PHP server

  1. Web server

    Apache, nginx, or the host's edge

  2. PHP runtime

    PHP2Shell lives here, before the CMS

  3. Drupal

    Core, modules, and theme. Still PHP.

  4. Database

    Whatever that PHP process can reach

After

Next.js, Netlify, Supabase

  1. Netlify CDN

    Prerendered pages and hashed static files

  2. Next.js

    TypeScript. No PHP interpreter in the path.

  3. Supabase Postgres

    Content in ordinary tables

  4. Row-level security

    The database decides who can see a row

The confirmed shape of the TP2X rebuild: off a PHP CMS, onto Next.js, Supabase, and Netlify. Counts, dates, and measured results stay blank on this page until they are real.

This case study is not indexed. Measured results are not published here.

The rebuild uses Next.js 16, React, and TypeScript, styled with Tailwind CSS and shadcn/ui, with two custom-drawn filter wheels written in React. Supabase provides the Postgres database, member logins, file storage for thumbnails, and row-level security for who can see which videos. Netlify builds and serves the site from GitHub on every change to main.

After: the new stack

NeedSolution
Front endNext.js 16, React, TypeScript, Tailwind CSS, shadcn/ui
Signature UITwo filter wheels drawn as custom React graphics
DatabaseSupabase Postgres
Member loginsSupabase Auth
Thumbnails/filesSupabase Storage
Who sees which videosRow-level security policies in Postgres
Hosting / deploysNetlify, building from the GitHub repo on every push to main

Request a free Drupal site audit