PHP2Shell CVE-2026-109618 / 109619 · WordPress and Drupal hosts should update PHP now.

Patch guide for your host
DrupalMigration.aiPatch tonight. Migrate to modern, AI-improved.

Patch tonight. Migrate to modern, AI-improved.

Drupal migration to Next.js + Supabase, with no PHP server to patch

Last updated: 2026-10-23 · Shawn Gants

Before

Drupal on a PHP server

  1. Web server

    Apache, nginx, or the host's edge

  2. PHP runtime

    PHP2Shell lives here, before the CMS

  3. Drupal

    Core, modules, and theme. Still PHP.

  4. Database

    Whatever that PHP process can reach

After

Next.js, Netlify, Supabase

  1. Netlify CDN

    Prerendered pages and hashed static files

  2. Next.js

    TypeScript. No PHP interpreter in the path.

  3. Supabase Postgres

    Content in ordinary tables

  4. Row-level security

    The database decides who can see a row

Left is a PHP server you still have to patch. Right is the replacement this shop builds: Next.js on Netlify's CDN and Supabase, where row-level security is a database rule. A smaller surface, not a promise that the new stack is unhackable.
Answer: We migrate Drupal 7, 8, 9, 10 and 11 sites to Next.js 16 (React + TypeScript), Supabase (Postgres, logins, file storage, row-level security) and Netlify (deploys from GitHub on every push to main). Your content, users and URLs come with you. Every old URL gets a 301 redirect, and your hosting no longer includes a PHP runtime you have to patch. A fixed-price quote follows a site audit.

Request a free Drupal site audit · Estimate my migration · Benefits of migrating Drupal to Next.js · Moving a WordPress site to Next.js · AI-improved migration

Why teams are leaving now

  • PHP2Shell (Oct 2026): two critical, unauthenticated RCE flaws in PHP itself (php.net). Patch first (our guide). Then ask whether you want PHP in your stack at all.
  • Drupal 10 end of life: December 9, 2026 (Drupal.org). Drupal 7 ended in January 2025 (Drupal.org). Drupal 8 and 9 are already out of support.
  • PHP version churn: PHP 8.2 ends Dec 31, 2026 (php.net). Drupal 11 requires PHP 8.3+, and Drupal 12.0 lists only PHP 8.5 as supported (Drupal.org).

What you get

LayerWhat we buildWhy it matters
Front endNext.js 16, React, TypeScript, Tailwind CSS, shadcn/ui, custom React graphicsFast, server-rendered pages that search engines and AI crawlers can read
DataSupabase Postgres with your content types mapped to tablesStandard SQL. No proprietary lock-in
Access controlRow-level security policies replace Drupal roles and permissionsRules run *inside the database* on every query (Supabase)
LoginsSupabase Auth for members and editorsMember areas without a PHP session layer
FilesSupabase Storage for images, PDFs and thumbnails, with access policiesPrivate files stay private
HostingNetlify, auto-deployed from GitHub mainEvery change is versioned. Rollback means redeploying a previous build (Netlify)
SEO301 map for every Drupal alias, metadata carried over, sitemap, structured dataKeep the rankings you've earned

  1. 01

    Audit

    Content types, users, URLs, integrations

  2. 02

    Model

    Drupal fields become Postgres tables

  3. 03

    Build

    Next.js pages, server-rendered

  4. 04

    Redirects

    A 301 for every old URL

  5. 05

    Launch

    DNS cutover and a repo you own

The migration route. Duration and price follow complexity, not page count.

How it works

  1. Audit (duration set in the quote): content types, fields, taxonomies, Views, Webforms, users and roles, custom modules, files, URL aliases, integrations. You get a written report and a fixed price.
  2. Data model + migration scripts: Drupal 8+ content comes out through JSON:API or the database. Drupal 7 comes straight from the database. Scripts are repeatable, so we can re-run them right before cutover.
  3. Access rules: each Drupal permission becomes an explicit RLS policy, with automated allow/deny tests for every table (the testing approach Supabase recommends).
  4. Build: pages, components, forms and editor workflow.
  5. Redirects + QA: every old path is mapped. Broken-link and Core Web Vitals checks.
  6. Cutover + handover: DNS switch, a monitoring window set in the quote, documentation, and a repo you own.

What happens to…

  • User passwords? Decided at audit. Options include a password-reset campaign, or verifying the old Drupal hash once at first login and then re-hashing. We'll recommend one after looking at your user base.
  • Editors? You choose an editing setup during the audit: a simple admin built into the app, or a headless CMS. Options and trade-offs are in the audit report.
  • Webforms? Rebuilt as React forms that store submissions in Supabase, with RLS so only staff can read them.
  • Views and listings? Rebuilt as SQL queries and server components.

When NOT to migrate

  • Your Drupal 10/11 site is current, the upgrade to 11 is small, and your team loves Drupal's editor. A Drupal upgrade may cost less. Drupal Aid's free "30-minute check" with Upgrade Status is a good way to size it (Drupal Aid).
  • You depend heavily on Drupal Commerce or complex Rules workflows. Get both quotes first.
  • You need this week's security fix. That's patching, not migrating.

The honest security picture

Moving off PHP removes the PHP runtime from your hosting. It doesn't make you unhackable. React and Next.js shipped fixes for a critical RCE in December 2025 (React, Next.js). On this stack, staying patched means updating dependencies and redeploying from GitHub. Our care plan does that for you.

Who does the work

Shawn Gants, Cprofessionals (Spokane, WA area). Fourteen years on Drupal.org, contributor of modules, themes and patches (profile). He moved his own site, TP2X, off Drupal to this stack (case study).

Pricing

Standard migration is from $999. Member logins, row-level security, and custom features are part of that tier, and the quote rises with them. Page count is not a price. A site that is down can be an overnight rebuild at $4,999 when the scope is not e-commerce or a pile of integrations. That heavier scope starts with a $499 audit, credited toward the project. See pricing.

FAQ

Which Drupal versions can you migrate? Drupal 7, 8, 9, 10 and 11.

Will we lose Google rankings? Ranking drops after migrations usually come from missing redirects. We map every old URL to a 301 and resubmit the sitemap. No one can guarantee rankings, but this protects what you've earned.

How long does it take? An emergency rebuild for a down site is overnight. Other schedules are set in the quote, after we see custom functionality, logins, and integrations. Page count does not set the price or the date.

Can we keep our domain and email? Yes. Only the website's DNS records change. Email (MX) records are left alone.

Do we own the code? Yes. It lives in your GitHub organization, deployed to your Netlify account. <!-- Confirm with Shawn: client-owned accounts by default? -->

Is Supabase/Netlify lock-in? Supabase is Postgres, which you can export with standard tools. Next.js runs on many hosts.

Do you work outside Spokane? Yes, remotely anywhere.

Request a free Drupal site audit

Sources on this page

  1. S02: php.net News Archive 2026: Security advisory + 8.5.12/8.4.27/8.3.36/8.2.35 release notes
  2. S12: Drupal Aid: October 21 Critical PHP Security Update — verified (summary on blog index)
  3. S15: Drupal core release schedule (Drupal 10 EOL Dec 9, 2026; Drupal 12 week of Dec 7, 2026) — verified (search extract)
  4. S17: Drupal.org: Drupal 7 has reached end of life | PSA-2025-01-06
  5. S18: Drupal.org: PHP requirements (version matrix)
  6. S22: React blog: Critical Security Vulnerability in React Server Components (CVE-2025-55182) — snippet
  7. S23: Next.js Security Update: December 11, 2025 — snippet
  8. S24: Supabase Docs: Row Level Security
  9. S26: Netlify Docs: Next.js on Netlify — snippet
  10. S39: Drupal Aid blog index (incl. 'Is Your Drupal 10 Site Ready for Drupal 11? 30-Minute Check')
  11. S41: Drupal.org profile: Shawn Gants (cprofessionals)
Site down? Emergency overnight migrationStart a migration from $999