PHP2Shell CVE-2026-109618 / 109619 · WordPress and Drupal hosts should update PHP now.

Patch guide for your host
DrupalMigration.aiPatch tonight. Migrate to modern, AI-improved.

Headless Drupal vs a full migration

Stay

Headless Drupal

Next.js in front. Drupal and PHP stay behind it, so the patch treadmill stays too.

Leave

Full migration

Retire the PHP server. Content moves to Postgres with row-level security.

The middle option still runs PHP. The short version is on the comparison page.

The comparison page says headless Drupal keeps PHP.

Drupal migration service · WordPress migration service